signet-eval

signet-eval

Deterministic policy enforcement for AI agent tool calls. Integrated tool calls pass through user-defined rules before execution. No LLM in the authorization path. Advisory nudges are separate from authorization.

Install

# crates.io

cargo install signet-eval

from source

git clone https://github.com/wandercom/signet-eval cd signet-eval cargo install --path .

There is no npm or PyPI package for signet-eval. The public distribution path is crates.io plus source install from GitHub. The MCP Registry listing points at the repository metadata; the runtime is the local signet-eval serve stdio server.

Quick Start

The command-hook adapters below remain supported and independent. For Claude Code's optional early-access function hooks, see the function adapter. It is disabled by default; installing/building this package does not activate it or change user settings.

1. Hook into Claude Code — add to ~/.claude/settings.json:

{

"hooks": { "PreToolUse": [{ "matcher": "", "hooks": [{"type": "command", "command": "signet-eval", "timeout": 2000}] }] } }

For Codex, enable hooks in ~/.codex/config.toml or /.codex/config.toml:

[features]

codex_hooks = true

Then add ~/.codex/hooks.json or /.codex/hooks.json:

{

"hooks": { "PreToolUse": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "signet-eval --adapter codex", "timeout": 30000, "statusMessage": "Checking Signet policy" }] }], "PermissionRequest": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "signet-eval --adapter codex-permission", "timeout": 30000, "statusMessage": "Checking Signet approval policy" }] }] } }

For Antigravity, add this block to ~/.gemini/config/hooks.json (merge it with any existing hook groups):

{

"signet": { "enabled": true, "PreToolUse": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "/bin/bash -lc 'source ~/.profile >/dev/null 2>&1 || true; exec signet-eval --adapter antigravity'", "timeout": 30, "statusMessage": "Checking Signet policy" }] }] } }

The same configuration is available at hooks/antigravity-hooks.json.

For Cursor, add to ~/.cursor/hooks.json (user) or /.cursor/hooks.json (project), merging with any existing events:

{

"version": 1, "hooks": { "preToolUse": [{ "command": "/bin/bash -lc 'source ~/.profile >/dev/null 2>&1 || true; exec signet-eval --adapter cursor'", "matcher": "^(?!Shell$|MCP:)", "timeout": 30, "failClosed": true }], "beforeShellExecution": [{ "command": "/bin/bash -lc 'source ~/.profile >/dev/null 2>&1 || true; exec signet-eval --adapter cursor'", "timeout": 30, "failClosed": true }], "beforeMCPExecution": [{ "command": "/bin/bash -lc 'source ~/.profile >/dev/null 2>&1 || true; exec signet-eval --adapter cursor'", "timeout": 30, "failClosed": true }] } }

The same configuration is available at hooks/cursor-hooks.json. The preToolUse matcher skips shell and MCP calls because the two dedicated events evaluate them; without it, each such call is evaluated and logged twice.

For Muse Code, add a top-level hooks member to ~/.config/muse/settings.json (user scope; keep schema_version and your other settings), or save the file as /.muse/hooks.json (project scope, which Muse enables only for trusted workspaces):

{

"hooks": { "PreToolUse": [{ "matcher": "*", "hooks": [{"type": "command", "command": "signet-eval --adapter muse"}] }] } }

The same configuration is available at hooks/muse-hooks.json.

2. Done. Every tool call now passes through policy evaluation. The default policy blocks destructive operations, protects its own configuration, and allows everything else.

3. (Optional) Customize — talk to Claude with the MCP server:

claude mcp add --scope user --transport stdio signet -- signet-eval serve

Then say: *"Add a $50 limit for amazon orders"* or *"Block all rm commands"*.

Default Policy

Self-protection rules are locked — they cannot be removed, edited, or reordered by the AI agent, even through the MCP management server. This prevents the agent from disabling its own guardrails.

Custom Policy

signet-eval init       # write default policy to ~/.signet/policy.yaml

signet-eval validate # check policy for errors signet-eval rules # show current rules

Edit ~/.signet/policy.yaml:

version: 1

default_action: ALLOW rules:

• name: block_rm tool_pattern: ".*" conditions: ["contains(parameters, 'rm ')"] action: DENY reason: "File deletion blocked"

• name: books_limit tool_pattern: ".*purchase.*" conditions:
• "param_eq(category, 'books')"
• "spend_plus_amount_gt('books', amount, 200)" action: DENY reason: "Books spending limit ($200) exceeded"

• name: protect_my_config tool_pattern: ".*" conditions: ["contains(parameters, '/etc/')"] action: ASK locked: true reason: "System config changes require confirmation"

Rules are evaluated in order — first match wins. Multiple conditions on a rule are AND'd. Rules with locked: true cannot be modified through the MCP management server.

ENSURE check context

User-managed ENSURE scripts receive the original normalized tool name and input on stdin. SIGNET_TOOL_COMMAND carries the first non-empty string among the normalized command and cmd fields as a literal environment value. It is empty when neither field holds one. The forwarding mechanism does not interpret that value as shell code.

SIGNET_TOOL_CWD uses the normalized tool cwd/workdir, then the host envelope's cwd, then the hook process's working directory. Empty values are skipped. SIGNET_TOOL_CWD_SOURCE says which one was used: tool_input, host, or process. SIGNET_HOST_CWD carries the host envelope's cwd on its own, or is empty when the host sent none. A tool_input directory is where the host will run the command, but the model wrote it. The process fallback is not an independently verified execution directory. None of these is a trusted location attestation, and a check that authorizes on location should look at the source before relying on the value. Signet does not interpret the command, so a cd inside it does not change SIGNET_TOOL_CWD. All of these environment values replace inherited ones, and stdin remains unchanged.

A missing or unresolvable check script denies the call with a reason naming the check, for user rules as well as locked ones. Signet installs no check scripts, so copy ~/.signet/checks/ along with any rules.yaml that refers to it.

Older releases shipped a github_identity_guard system rule. A copy of it left in policy.yaml is ignored, and signet-eval validate reports it as a warning. To keep an identity check, put the rule in rules.yaml with a script you maintain.

From the repository root after cargo build --release, run the independent local acceptance checks with:

SIGNET_EVAL_BINARY="$(pwd)/target/release/signet-eval" python3 tests/test_ensure_behavior.py

These Python acceptance checks can run locally and are also collected by hosted CI on Linux and macOS against the release binary, alongside Rust and packaging checks.

Advisory Injection

INJECT rules probabilistically add advisory context near the tool call that triggered them. They are nudges, not authorization: the normal ALLOW/DENY/ASK/GATE/ENSURE pass remains first-match-wins and deterministic. Injection runs afterward and only emits context when a matching inject rule fires.

rules:

• name: maybe_remind_kindex_on_git tool_pattern: "^Bash$" conditions: ["contains(parameters, 'git ')"] action: INJECT inject: trigger: mode: exponential peak: 0.35 cooldown_seconds: 300 peak_after_seconds: 1800 max_per_session: 3 payload: text: "Before committing, check whether project .kin files should be included."

Trigger modes:

Payload sources:

Template substitutions are enabled by default: {tool_name}, {cwd}, {date}, and {matched_param.X}. See examples/inject_examples.yaml.

Condition Functions

Model-scoped rules

Hook-mode calls can carry an agent_model field naming the model that issued the tool call. Only the host may supply it: Signet reads the hook envelope's model (a string, or an ob