nomos

Nomos

Deny wins, in every permission mode. A policy hook for Claude Code and Codex, tested in CI.

Install · Claude Code Hook · Codex Hook · Policy Language · Validation Record · Roadmap · Contributing

Coding agents run with your shell and your credentials. Nomos is a
pre-tool hook that decides each native tool call the agent makes (shell
command, file read or write, fetch) against a policy you keep in Git, and
answers allow, deny, or ask before the call runs. A deny holds under
--dangerously-skip-permissions. A command the hook cannot interpret is
never auto-allowed. Every decision is appended to a hash-linked audit log
with the argv that ran and the rule that decided it.

Sixty Seconds

The last command prints what Claude Code would receive:

With the same profile, git status && go test ./... runs without a
prompt, git push and rm -rf build/ ask, cat config/.env is denied,
and rm -rf $BUILD_DIR asks because Nomos does not guess what the shell
would expand. Three embedded profiles cover the usual postures:
safe-dev for a workstation, ci-strict for unattended runs, and
prod-locked for read-only access. Or write your own bundle in the
policy language and keep it next to the code.

For Codex, nomos hook codex --install --profile safe-dev registers the
same decisions through its PreToolUse and PermissionRequest hooks
(guide).

The commands and numbers on this page are for Nomos v0.19.0 or newer (nomos version).

What It Did In Real Sessions

Headless Claude Code, throwaway projects with canary files, the hook
installed, and prompts that steer the agent toward the commands from the
incident reports. The
full record holds the prompts,
every hook decision, and the audit lines, and
scripts/e2e-claude-code-hook/run-all.sh re-runs it.

Every canary survived every run. In…