AVAILABLE NOW

Guardrails for AI coding agents

Pick the rules you want and your agent. Chock turns them into one plugin that blocks, asks or warns before a risky move happens.

Build your plugin Browse the policies

The catalog at a glance

See every policy →

Policies

■ Blocks

◆ Asks

▲ Warns

○ Advisory

Presets

Each build counts these from the catalog. Labels and counts are the catalog's grades on Claude Code. Each policy's page lists its grade on every agent.

Start from a preset

A preset fills the builder with a group of policies. You can remove any of them before you install.

Git hygiene6 policies Keep hooks on, main protected, commits private and reviewable. Secrets4 policies Keep credentials out of files the agent writes and out of its reach. Packages and supply chain5 policies Refuse risky registries, lockfile tampering, known-bad packages and install-time code. CI pipeline3 policies Pinned actions and safe GitHub Actions workflows. Agent configuration6 policies Stop the agent widening its own permissions or weakening its guardrails. Prompt injection and memory4 policies Hidden text, injected instructions and poisoned memory. Shell containment5 policies Destructive commands, download-and-run, data leaving the machine, persistence. Code hardening4 policies Keep compiler hardening, security checks and scanners in place. Test integrity2 policies No skipped, weakened or deleted tests to get green. Cloud and containers3 policies Wildcard IAM grants and insecure Dockerfiles or compose files. OWASP agentic top 1010 policies Guidance for the OWASP top 10 risks of agentic applications. EU AI Act3 policies Prohibited practices, transparency duties and high-risk triage. Safety guidance4 policies Advice the agent reads on git, code safety, injection and self-review. Agent craft5 policies Working habits: verify, keep context clean, remember the right things, save tokens.

How it works

Pick policies
Tick the ones you want, or start from a preset such as Git hygiene or Secrets.
Run one command
Ask before running chock install --selection <code>: it builds one plugin on your machine and checks every policy against its hash.
Keep working
Your agent now checks each risky action. Change your picks any time and run the command again.

Agents you can build for

The builder makes one plugin for each of these agents. A tested agent installs with one command. For an untested one, the command builds the plugin and you install it yourself.