signet-eval

cargo install signet-eval

Three Steps

1. Install: cargo install signet-eval

2. Hook into Claude Code:

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "",
      "hooks": [{"type": "command", "command": "signet-eval", "timeout": 2000}]
    }]
  }
}

3. Done. Every tool call now passes through policy evaluation.

Default Policy

Self-protection rules are LOCKED — the agent cannot remove, edit, or reorder them, even through the MCP management server.

Custom Rules

# ~/.signet/policy.yaml
version: 1
default_action: ALLOW
rules:
  - name: books_limit
    tool_pattern: ".*purchase.*"
    conditions:
      - "param_eq(category, 'books')"
      - "spend_plus_amount_gt('books', amount, 200)"
    action: DENY
    reason: "Books spending limit ($200) exceeded"

  - name: protect_prod
    tool_pattern: ".*"
    conditions: ["contains(parameters, 'production')"]
    action: ASK
    locked: true
    reason: "Production access requires confirmation"

Condition Functions

Features

Architecture

Part of the Signet personal sovereign agent stack. The core principle: the authorization layer must not be an LLM. It processes structured data only. No natural language, no context window, no persuasion surface. A rule either matches or it doesn't.

Agent proposes action  ->  signet-eval evaluates policy  ->  allow / deny / ask
                           (deterministic, 25ms, no NLP)

Security Model

signet-eval is a seatbelt, not a cage. It enforces policy within a cooperative protocol — Claude Code calls signet-eval before every tool use and respects the response. This reliably blocks destructive commands, enforces spending limits, and gates credential access during normal operation.

It does not protect against an adversarial agent with shell access. Any process at the same privilege level can use shell indirection (alias, eval, base64 | sh) to evade string matching, read the session key, or replace the binary. No amount of pattern matching fixes this — it's an infinite regress.

True containment requires OS-level controls: separate user accounts, containers, stripped $PATH, seccomp/AppArmor, or sandboxed environments. signet-eval is the policy engine inside such a perimeter. The OS enforces the perimeter. Neither replaces the other.

All Commands