One .policyctl.yml, enforced inside Claude Code, Codex, and Cursor at tool-call time — and again as a hard gate in CI. Not prompt text. Not a vendor denylist.
$ policyctl check --from main
✓ PASS no-secrets-in-commits no secret patterns detected
⚠ WARN tests-for-source src/auth.ts changed without a test
✗ FAIL migrations-via-generator db/migrations/0004.sql lacks generator signature
2 blocking · 1 warning — build stopped
Claude ignores half of an over-specified CLAUDE.md. Agents treat workflow rules as suggestions. Teams waste weeks hand-rolling per-model plugins that still let migrations through without a generator signature. There is no shared, deterministic policy layer across Claude Code, Codex, and Cursor — until now.
Advisory only. Claude truncates over-long instructions. No exit code. No CI gate. No audit trail.
Hard within one provider. Useless in a mixed-agent stack. Each vendor's API is different — you rebuild the same rules 3×.
The CLI is local-first and offline. The hosted control plane (optional) adds cross-repo policy versioning and an audit trail.
Start from a template that encodes procedural rules, not opinions.
policyctl init --template fullWrite the exact glue for each provider — no hand-rolled per-model plugin.
policyctl gen claude
policyctl gen codex
policyctl gen cursorFail CI on violations and stream them to the dashboard feed.
policyctl check
policyctl check --reportWrite a rule once in .policyctl.yml and it enforces identically inside Claude Code's PreToolUse hooks, Codex's exec-policy, Cursor's hooks.json, and your GitHub Actions CI.
Hooks fire on every tool call. Exit-2 blocks the call before it happens.
Starlark rules gate commands before execution. Policyctl generates the rules file.
Command hooks on preToolUse. One config for the whole team.
Fail the build on any blocking rule. Same engine, same YAML, same verdict.
Stream violations to the hosted dashboard. Local CLI works fully offline.
Prompt files and vendor denylists are advisory. policyctl exits with a real error code that blocks the tool call and fails CI. Here's the difference:
| Prompt files CLAUDE.md / .cursorrules |
Vendor denylists Claude permissions / Codex exec |
policyctl This file + hooks + CI |
|
|---|---|---|---|
| Cross-agent | Partial | Locked-in | Yes |
| Deterministic (not advisory) | No | Yes | Yes |
| CI integration | No | No | Yes |
| Audit trail | No | No | Yes |
| Exit code on violation | No | One vendor | Every agent + CI |
| Procedural rules | No | No | Yes |
A rule is a matcher set + an enforce level + a scope. Compose them, allowlist reviewed exceptions, and tag them. Hook-time and CI-time share the same engine.
Block any migration file that lacks the generator signature — at hook time and in CI.
Prevent agents from touching README, package.json, or any path you choose.
Regex-detect AWS keys, GitHub tokens, and OpenAI keys in the diff, then fail the build.
Warn when a src/ change ships without a matching test file.
policyctl is the only thing that stopped our agent from rewriting migrations by hand. Now we have one rule file across Claude Code, Codex, and Cursor — and CI fails if any agent tries to cheat.
The local CLI is free, open-source, and fully featured. The hosted control plane adds policy versioning, audit logs, and a live dashboard — only when you need it.
Complete local-first experience. Hooks, CI gate, and procedural rules. MIT licensed.
.policyctl.ymlHosted control plane with cross-repo policy management and live violation feed.
Run the control plane behind your firewall. Includes support and custom integrations.
The CLI is free and open-source (MIT). The hosted control plane is $5/month with a 14-day free trial. No credit card required for local use.
Yes. policyctl check is a single binary that exits non-zero on violations. Works with GitHub Actions, GitLab CI, CircleCI, Bazel, and any shell-based CI.
Yes. Use the match.agents field in your YAML to scope rules per provider (claude, codex, cursor) or to ci.
No. The CLI runs entirely locally. The optional control plane only receives violation metadata (file paths, rule IDs, agent) — never source code or secrets.
One file, every agent, every repo. The CLI is free forever.