Claude Code

Claude Code supports a PreToolUse hook: a command that runs before every tool call and can block the call by exiting with a non-zero status. agentjail is designed to sit exactly there. Claude Code, Codex, and Cursor are all supported : agentjail install auto-detects which agents are present.

How it works

When agentjail is installed for Claude Code, it registers agentjail-hook as the PreToolUse hook. Before each tool invocation Claude Code writes a JSON event to the hook’s stdin; agentjail-hook evaluates it against your local Rego policy and responds with a decision. A denial exits 2, which causes Claude Code to stop the call and surface the block reason instead of running the command.

For a full explanation of the hook protocol and how to test your policy interactively, see the generic hook guide.

Want the OS sandbox and network visibility too? The hook guards tool calls. To also run Claude Code inside the kernel sandbox (Seatbelt/Landlock) and capture its LLM traffic, launch it with agentjail claude instead of a bare claude. See the OS-native sandbox.

Install

Quick install (recommended):

curl -fsSL https://agentjail.io/install.sh | sh

The script downloads the release tarball, verifies the SHA256 checksum, installs binaries to ~/.agentjail/bin/, and runs agentjail install --for claude-code.

Homebrew:

brew install LuD1161/tap/agentjail
agentjail install --for claude-code

Both paths work on macOS and Linux.

What the installer writes

agentjail install --for claude-code adds the following entry to ~/.claude/settings.json:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "*",
        "hooks": [
          {
            "type": "command",
            "command": "~/.agentjail/bin/agentjail-hook"
          }
        ]
      }
    ]
  }
}

Every tool call Claude Code makes will pass through agentjail-hook before execution.

Verify it is working

You can test agentjail-hook directly from the terminal (the daemon must be running). Pipe a synthetic PreToolUse event to the hook and inspect the output:

echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm -rf /"}}' \
  | agentjail-hook

The hook prints a JSON response:

{
  "hookSpecificOutput": {
    "hookEventName": "PreToolUse",
    "permissionDecision": "deny",
    "permissionDecisionReason": "..."
  }
}

Exit 0 means allow or ask; exit 2 means deny. A denial from the test above confirms that agentjail is evaluating policy correctly.

To confirm the live hook is gated, trigger a tool call inside Claude Code that your policy should block and verify the agent stops rather than proceeding.