guardrailslisted

# AgentGuards — self-hosted, hooks-only This variant bundles no MCP server, so there is no `check_input`/`authorize_action` to reach for — do not `ToolSearch` for them, they are not installed here. That is not reduced protection. The three hooks in `hooks/hooks.json` enforce deterministically, on every request, regardless of anything the model does: - **`UserPromptSubmit`** screens every prompt before you see it. A block or escalate exits non-zero and you never receive the message. - **`PreToolUse`** authorizes every `Bash` command before it runs. - **`PostToolUse`** scans content from `WebFetch`, `WebSearch`, and any `Bash` command that invokes `curl`/`wget`/`http`/`fetch`/`aria2c` — redacting or withholding it before you read it. Nothing here requires you to call a tool, check a decision, or format a block message — the hook has already acted by the time you see (or don't see) the result. If a hook blocks something, its message appears as the tool result or the reason a prompt was rejected; reply with that message rather than composing your own. **Why no MCP server:** Claude Code's plugin `.mcp.json` cannot substitute an environment variable into its `url` field, so a URL baked in at publish time cannot be made to point at each installer's own appliance — it would either be fixed to one instance or, worse, silently fall back to AgentGuards' hosted service. Rather than ship that, this variant relies entirely on the hooks, which read `AGENTGUARDS_URL` correctly per