A free hook that holds your agent’s sends until you have read them.
send-guard sits in Claude Code and catches recognizable send, publish, schedule and delete calls from MCP tools. Drafts pass.
No email needed. Open source under MIT. Install steps
Needs Claude Code, Bash and Python 3. Tested on macOS; Linux not verified yet. Open source under MIT. Read it first: hook.py and its 59 test cases are in the ZIP.
It reads the call before the call runs.
send-guard is a PreToolUse hook. Claude Code asks it about every MCP call and answers with either nothing (the call goes on to your normal permission check) or a denial with the reason.
Holds the irreversible
Send, publish, schedule, activate, launch, delete, forget, and budget changes, in snake, kebab or camel case.
Looks inside the payload
A status set to ACTIVE in a nested change, an activation flag, a scheduled time. A draft flag does not turn a send into a draft.
Lets work continue
Drafts, reads and pauses pass. When you mean it, one marker file lets the next matching call through, so pause other sessions first.
Two calls, two answers
mcp__example__send_message{}Heldmcp__example__create_draft{"status": "DRAFT"}PassesBoth lines are cases from the test suite. Run bash tests/run_all.sh and you see every case with the answer it expects. Try eight of them on the home page.
What it does not do
It works from tool names and arguments. A tool with a misleading name, or an action encoded in a way it does not recognize, can pass. Try it against your own MCP servers first.
It is not a security boundary and it does not stop prompt injection. An agent that can edit your hooks or marker files can get around it, so keep those paths in your hands and keep your usual permissions on.
Its default is fail-closed: if it cannot read a call, it denies it. That is the safe default, and it is also why you should install it on a test profile first.
Install on a test profile first
The installer never picks a real profile for you. Start with a throwaway directory and a dry run:
bash install.sh --target /tmp/guardrails-demo/.claude --guards send-guard --dry-run bash install.sh --target /tmp/guardrails-demo/.claude --guards send-guard bash tests/run_all.sh
To remove it, run the same command with --uninstall. Your other hooks and settings are kept, and changed settings get a backup.