Teach your AI agent what not to do.
Blocks your coding agent's wrong moves before they land. This template is a working adoption you can read end to end: one policy per layer.
chock · chock-catalog · chock-quickstart · chock.sh (launching soon)
chock-example is a GitHub template repository: a repo where Chock is already adopted, with three artifacts installed so every moving part fits in one sitting. Chock is open-source application security for code written by AI coding agents. Each check is a deterministic local script, with no model and no upload, and it refuses known vulnerability classes before they are committed. This is a demo repository; questions and issues belong on the framework repo.
Application security for the code your agents write
Coding agents already ask before they run a shell command. What they do not check is the code they write: SQL injection in a Spring repository, an IAM grant on *, an MCP server at @latest, a bidi override hiding in a source file, a secret written into agent memory. Chock checks that code as the agent writes it, at commit and in CI. This repo installs two guardrails and one skill so you can see each layer work. The catalog holds the application-security policies you would add next.
| Area | What gets refused | Policy | Tier |
|---|
| Java & Kotlin | injection, XXE, SSRF, unsafe deserialization, weak crypto, dependencies below a known fix | java-security | commit |
| Unsafe code, IAM | eval, shell=True, os.system, pickle; IAM Action: * | block-unsafe-code-execution, block-wildcard-iam | commit |
| Supply chain | dependencies off an allowlist, Actions on a mutable tag, MCP servers and images at @latest | verify-dependency-exists, pin-github-actions, block-unpinned-agent-components | commit |
| Agent code | host execution, approvals switched off, credential leaks | agentic-code-security | commit |
| Accessibility | a stripped alt, aria-label, label or lang | no-a11y-regression | commit |
| Prompt injection, memory | bidi and tag characters; secrets written into agent memory | block-invisible-unicode, guard-memory-writes | commit |
| Test integrity | deleted tests, lost assertions, new skips | protect-test-integrity | commit |
| Also included | secrets, destructive commands, agent self-protection | scan-secrets, block-destructive-commands, protect-agent-config | commit, in-agent |
Tiers: commit is a git hook or CI gate that exits non-zero. in-agent is the agent's pre-tool hook: best-effort, and it fails open. advisory is rule text the agent reads. No agent reaches enforced today.
Install
chock 1.1.0 is on PyPI (pip install chock==1.1.0), and its tag v1.1.0 is the engine commit this page describes. To install that exact commit instead (Python 3.11 or newer):
pip install "chock @ git+https://github.com/open-coder-ai/chock@2f3be6d04349a7ec433657e16a294efc62b51d4f"
Two ways to adopt it
- In your repository, for teams. Run
chock init ., then chock add <id> --ref <catalog commit> --verify-sha <sha256> --skip-compile for each policy, then chock sync --repo . --ci. Commit the result. Every clone runs chock sync --repo . once, because git never clones hooks. The commit gates are enforced at commit and in CI.
- In your coding agent, as plugins. Best-effort, and they fail open. One repo per client: Claude Code, Cursor, Copilot, Codex, Devin. Each README has the install line for its client.
- One Claude Code plugin from a selection. The chock.sh builder (launching soon) gives a
chock install --selection '…' --apply command.
| In your repository (for teams) | In your coding agent, as plugins |
|---|
| Where it runs | Your agent's hook where its client has one, at commit, and in CI | The client's pre-tool hook only |
| Strength | The commit gates are enforced at commit and in CI | Best-effort: the client's hook fails open, and it does not run in CI |
This repo is a result of the repository route.
Use this template
Click Use this template, clone your copy, then run chock sync --repo . once. Git never clones hooks, so every clone does this.
How it works
One policy per layer
| Layer | Policy | Tier in the catalog | Mechanism here |
|---|
| Hook | protect-main-branch | Enforced at commit | A compiled gate in .chock/compiled/protect-main-branch/git-hook/: commits, merges and pushes to main fail (pre-commit, pre-merge-commit, pre-push), plus a CI gate step |
| Rule | block-no-verify | Best-effort (in the agent, fails open) | Ambient text in AGENTS.md and every agent wrapper, plus a compiled pre-tool guard that refuses --no-verify and -n where the client has a hook: wired here for Claude Code, Gemini CLI and VS Code Copilot |
| Skill | commit-message-style | Invoked, not gated | Runs when the agent's task matches; its evals/suite.yaml defines what "working" means |
Tiers are from the catalog's registry.yaml at commit f25f5a3 (policies unchanged since 9a64623). The two policies here are local copies (chock.lock records source: local) and may be older than the catalog's versions. No agent reaches "enforced" today.
The recording below shows chock refusing unsafe commits and accepting the fixed ones. This repo installs only the policies in the table.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
