Provider-agnostic policy runtime

Make your coding agents obey the rules.

One .policyctl.yml, enforced inside Claude Code, Codex, and Cursor at tool-call time — and again as a hard gate in CI. Not prompt text. Not a vendor denylist.

$ npm i -g @policyctl/cli Read the docs →

Free · MIT · local-first · optional hosted control plane

policyctl check

$ policyctl check --from main

✓ PASS  no-secrets-in-commits      no secret patterns detected
⚠ WARN  tests-for-source           src/auth.ts changed without a test
✗ FAIL  migrations-via-generator   db/migrations/0004.sql lacks generator signature

2 blocking · 1 warning — build stopped

CLI commands

agent providers

rule matchers

∞

custom rules

How it works

Three commands. One file. No backend required.

The CLI is local-first and offline. The hosted control plane (optional) adds cross-repo policy versioning and an audit trail.

01 · INIT

Scaffold

Start from a template that encodes procedural rules, not opinions.

policyctl init --template full

02 · WIRE

Generate hooks

Write the exact glue for each provider — no hand-rolled per-model plugin.

policyctl gen claude
policyctl gen codex
policyctl gen cursor

03 · CHECK

Gate the diff

Fail CI on violations and stream them to the dashboard feed.

policyctl check
policyctl check --report

What you can enforce

Encode the rules prompts can't.

A rule is a matcher set + an enforce level + a scope. Compose them, allowlist reviewed exceptions, and tag them. Hook-time and CI-time share the same engine.

Migrations via generator

block · both

Block any migration file that lacks the generator signature — at hook time and in CI.

No protected edits

block · hook

Prevent agents from touching README, package.json, or any path you choose.

No secrets in commits

fail · ci

Regex-detect AWS keys, GitHub tokens, and OpenAI keys in the diff, then fail the build.

Tests for source

warn · ci

Warn when a src/ change ships without a matching test file.