GvHildebrand

Sentinel Hook — Development skill for Claude Code

Development community

A pre-action gate for Claude Code agents: allow, ask or deny every shell command and file write, with each decision sealed in a hash-chained ledger anchored to Sigstore Rekor and an RFC 3161 timestamp.

How to install Sentinel Hook

This entry records only its repository, not the path inside it, so there is no exact command to give. Open GvHildebrand/sentinel-hook and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Sentinel Hook does

Alternatives in Development

OpenAI Codex CLI — (Rust implementation) 67.8k ★
Claude Peers MCP — Allow all your Claude Codes to message each other ad-hoc 1.9k ★
Claude Auto Resume — A shell script utility that automatically resumes Claude CLI tasks when usage limits are lifted 732 ★

README

sentinel-hook

A pre-action gate for Claude Code agents: it allows, asks or denies every shell command and file write against a declared scope and a destructive-command list, and seals each decision in a hash-chained ledger anchored to Sigstore Rekor and an RFC 3161 timestamp. No model in the blocking path.

Quickstart

git clone https://github.com/GvHildebrand/sentinel-hook && cd sentinel-hook && node --test scripts/sentinel/test.mjs
cd .. && mkdir -p yourproject/.claude yourproject/scripts && cd yourproject && git init -q
cp -r ../sentinel-hook/scripts/sentinel scripts/ && cp ../sentinel-hook/templates/claude-settings.json .claude/settings.json

Open `yourproject` in Claude Code. Every session now writes `research/sentinel/ledger/.jsonl` at the nearest `.git` (identity: a declared agent id, or `person-`); a denied call names its rule and its record; an allowed call prints nothing, the ledger line is the proof.

Try it without Claude Code, from inside `yourproject`:

echo '{"hook_event_name":"PreToolUse","session_id":"s","cwd":"'$PWD'","tool_name":"Bash","tool_input":{"command":"rm -rf ~"}}' | node scripts/sentinel/sentinel.mjs

To declare agents and their allowed paths, copy `templates/agents.json` to `_config/agents.json`. To seal the ledger, copy `templates/sentinel-attest.yml` to `.github/workflows/` (needs `id-token: write`).

Verify a sealed record

Each attestation in `research/sentinel/attestations/` names its own two commands: `cosign verify-blob` against the Sigstore bundle, `openssl ts -verify` against the timestamp reply. Tools, chains and what each step proves: [docs/verify.md](docs/verify.md).

Tested by

A cold AI session given only this link, 2026-09-18: nine minutes to a working denial, thirteen confusions, eleven fixed the same day — docs/stranger-tests.md.
A human outsider: not yet. Results will be published in the same file when they exist.