Bouncer

# Bouncer

A judgment layer for agents. The first thing it judges is
[Claude Code](https://claude.com/claude-code) tool calls.

A `PreToolUse` hook answers a handful of plain-English questions about each proposed tool
call — using a fast System One model ([TypeSafe Jev](https://typesafe.ai)) rather than a
frontier LLM, so it can run on every call for about four cents a day. The questions and the
thresholds live in a YAML file you own.

**If you run `--dangerously-skip-permissions`, this never prompts you.** That is the point,
not a caveat. Your baseline is zero interruptions, and `seatbelt` mode keeps it at zero: it
is silent until one of fifteen deterministic rules matches something that is never okay —
printing a private key, a live credential on the command line, `git stash clear`. Judgments
still run and still get logged; they just do not get to interrupt you, unless you enable a
deny threshold yourself. Nothing in the way, and a floor. [Jump to modes](#modes).

> **Status: v0.2 shipped, v0.3 in flight.** The hook runs end to end, it ships
> observing, and every accuracy number below comes from a live calibration run against Jev
> on the policy in this repository. Read the verdict paragraph under the table before the
> table itself: clearing the bar is not the same as behaving well. See [docs/PRD.md](docs/PRD.md) for the spec and
> [docs/adr/](docs/adr/) for what has been decided and why. [Install](#install) is two
> commands.

## The judgment tax

Every agent pipeline is paying reasoning prices for if-statements. *Is this command
destructive? Does it touch production? Does this draft match the brand voice? Which of these
two hundred rows needs a human?* Those are judgments — small, repeated, decided against
criteria somebody already wrote down — and the default way