Does AgentGuard bound Claude Code?

Partly, through a mandatory local hook.

A brake on your agents that only you control: verifiable, no third party, no data leaves your machine for AgentGuard. The Claude Code hook really stops guarded tool calls before they run, signs every decision locally, and needs no AgentGuard service. Its spend math is an estimate per tool call, and its action ceiling is a list of destructive patterns, not a generic capability tier.

Install the current Claude Code hook

The older project-level hook is retired in favour of Burn.

npm i -g @agentguard-run/burn && agentguard-burn init claude --write

The current Burn package is v0.2.6. See the Burn guide for its session limits and setup.

Historical project-level hook evidence

The results below describe the retired hook at commit be20a76a24e073270b95f6cd93993577412a7442, tested with Claude Code 2.1.220 and spend SDK 0.15.13. They are not a test of Burn.

That project-level .claude/settings.json pointed both Claude hook events at the local gate:

{ "hooks": { "PreToolUse": [{ "matcher": "*", "hooks": [ { "type": "command", "command": "node ./hooks/agentguard-gate.mjs" } ] }], "PostToolUse": [{ "matcher": "*", "hooks": [ { "type": "command", "command": "node ./hooks/agentguard-gate.mjs" } ] }] } }

What the real run returned

For the cap test, the fixture used a five-cent session budget and a three-cent Bash estimate. These are the hook decisions and signed ledger records from that run.

ALLOWED · Bash under budget
hook: {"continue":true,"suppressOutput":true}
receipt: action=allow projected=3c seq=1 entryHash=2e2bcd78048d4180a77b00f9dc5b47d557947355db0af46957071f898735d927
REFUSED · spend cap
AgentGuard blocked Bash: Cap 'per_day=5c' exceeded (spent=3c, +call=3c, total=6c) to block
receipt: action=block seq=3 signature prefix=01f1cc8af72f8839295807e0
REFUSED · named destructive action
AgentGuard blocked a high-risk action: blocked: destructive tool matched drop table
receipt: action=block seq=5 signature prefix=fa6792085cd1de4fbd8ce77f

Offline verification

npx agentguard-cc verify Verified 6/6 receipts (Ed25519 signature + hash chain + signer). Signer fingerprint: 34214d6371e67535 ALL RECEIPTS VALID. The ledger is authentic and untampered.

The keypair and ledger stay in .agentguard/. AgentGuard is not a hosted control plane. Claude still sends the prompts you ask it to send to Anthropic; the guard itself receives none of them.

The honest limit

Claude Code does not give this hook exact token cost, so the hook charges a documented flat estimate by tool. It maps tools to capability metadata, but the current policy floor is read_only, so it does not refuse a generic read_only versus payment_execute mismatch. It can refuse configured destructive patterns before execution. That is useful enforcement, but it is not the same capability ceiling the SDK wrappers enforce.

We also could not run an authenticated model turn in this environment. The installed CLI returned Not logged in ยท Please run /login. The hook protocol, denial behavior, persistent spend store, signatures, and offline verifier were exercised directly.

Claude Code integration verdictpartial
pre-tool enforcement
yes
spend source
local estimate
generic capability ceiling
no
signed offline receipts
yes, 6 of 6 valid

The captured test used the retired project-level hook; its external repository status was not checked in this local audit. Current installs use Burn. For exact provider spend and a real capability tier, use a guarded provider client as shown in the OpenRouter post.