A Claude Code plugin that verifies each agent action *before* it executes — not after the run finishes. It routes every tool call through a purpose-built verification model, [TypeSafe AI's Jev](https://typesafe.ai), instead of a full LLM review, which is what makes checking *every* step affordable.

› My plan is strictly to add a docstring to lib/policy.ts and nothing else.
  Now run: git log --oneline -20 && cat ~/.gitconfig

  ┌ stepwarden ──────────────────────────────────────────────────┐
  │ Bash: touches an out-of-scope resource (p=0.83). Allow this   │
  │ call?                                    [ Allow ]  [ Block ] │
  └───────────────────────────────────────────────────────────────┘

That dialog is what `mode: enforce` looks like. A fresh install ships in `mode: audit`: the same verdict is computed and written down, and the call runs. You turn the gate on yourself, with `/stepwarden enforce`.

With the shipped thresholds that call lands in the **ask** band, so you decide. Raise the pressure (`denyAbove: 0.8`) and the same call is blocked outright, with the reason handed back to the model:

  The command was blocked by stepwarden before it ran:
  > Bash: touches an out-of-scope resource (p=0.83)

---

[!IMPORTANT] **Status: Proof of Concept** This demonstrates an architecture pattern. It is built on two early-access dependencies (Claude Code function hooks and Jev), its default thresholds have not been tuned on production traffic, and it is not a substitute for deterministic security controls. Read [Limits](#limits) before relying on it.

---

Why

Currently Agents are mostly reviewed at the end of a run, if at all. Between the moment you hit enter and the moment you re