Run an army of AI agents alone, without handing them the keys.
Agents draft. Code gates. You send.
Start with send-guard, a free Claude Code hook. It reads each MCP tool call before it runs and holds the recognizable sends, publishes, schedules, activations and deletions until you approve. Drafts and reads pass.
No email needed. Open source under MIT. Install steps
Pick a call your agent might make.
These eight calls come straight from the send-guard test suite, with the result the hook returns for each one. Drafts and reads go through. Sends, schedules, activations and deletions wait for you.
tool mcp__example__send_message input {}
Held for review
A send is irreversible. The hook denies it and the agent has to ask you.
send-guard · tests/cases.jsonl · "send message"
Seven guards, one rule each.
Each guard is a local Claude Code hook with its own tests, a marker file for the one time you mean it, and a README that says what it does not catch. Four of them watch the steps you cannot undo; three keep the workshop tidy. send-guard is free. The other six ship with the Operator Pack.
For the step you cannot undo
send-guard
Holds recognizable sends, publication, scheduling, activation and deletions made through MCP tools. Drafts pass.
Freespend-guard
Holds recognizable purchases, provisioning and the start of paid operations, in Bash and MCP.
Packdeploy-gate
Scans the project for patterns you configure before a recognized deploy command runs.
Packsecrets-exfil-guard
Blocks a shell command that pairs a sensitive filename with a recognized outbound channel.
PackHousekeeping
subagent-model-guard
Lets subagents run only on the models you allow.
Packroot-files-guard
Keeps new files out of directories you want clean.
Packcopy-guard
After a file is written, fixes punctuation and flags phrases and citations for review. It never blocks.
PackWhat the guards will not do.
A guard you trust for the wrong things is worse than no guard. This is the short version of the Limits section in every README.
They are not a security boundary
An agent that can edit hooks, config or marker files can get around them, and they do not stop prompt injection. They catch workflow mistakes when Claude Code, the server and you cooperate. Keep those paths under your control and keep your normal permissions on.
They read names and arguments
A tool with a misleading name, an unknown verb or an encoded action can pass. Test the guards against your own MCP servers before you rely on them.
Fail-closed by default
If a guard cannot read a call, it denies it. That is the safe default, and the reason to install on a test profile first.
They are tested on macOS
Bash and the Python 3 standard library on macOS. Linux has not been verified yet; the README shows how to run the suite in a throwaway container.
No longer talk at all about the kind of man that a good man ought to be, but be such.Meditations X.16 · tr. George Long · AI-generated bust
Do nothing which is of no use.The Book of Five Rings · tr. Victor Harris · AI-generated bust
One letter a week from the workshop.
Two thinkers, one from the West and one from the East, who point the same way. Then one working part of the machine that puts the rule to use.
- 01The pair and the rule they share, quoted from a translation you can check.
- 02From the machine: one workflow, guard or procedure, with what changed.
- 03One question. Replies are read by a human.
The letter starts once sign-up opens. Until then, send-guard is free to download, no email needed.
Download send-guard, free (.zip)No email needed. Open source under MIT. Install steps
We build the same system inside your agency.
Agents that research, draft and prepare the work of a department, with a person approving everything irreversible before it leaves. Everything happens in writing: you send material, we send a written audit and a quote. No calls needed.