A local policy and safety layer for Claude Code
You decide which actions Claude Code may run. Risky work pauses for your confirmation before it happens, and every control-plane authorization that can advance is recorded in a signed, offline-verifiable log. Everything stays on your machine.
brew install isonapse/tap/isonapsemacOS 11+ on Apple silicon · Linux x86_64 with glibc 2.35+
See it interrupt an action
Claude Code proposes. Your policy stays in control.
This short, sanitised Enforce-mode example shows a destructive command being intercepted before it runs. The demonstration contains no real paths, accounts, or session data.
Illustrative Claude Code session · Enforce mode
Mode: Enforce
Read the demonstration transcript
- Mode: Enforce
- $ claude
- Claude Code wants to run:
- rm -rf ./build
- Isonapse · confirmation required
- Reason: destructive command
- Operator chose No
- Blocked · command did not run
Three parts, one local loop
Your rules decide
Write clear local rules for what Claude Code may do, what needs your confirmation, and what must stop. A language model never gets the final say.
Isonapse checks
Covered shell, file, web, and tool actions pass a local checkpoint before they run. Routine work can flow; unusual or destructive work can pause or stop.
The record proves it
Every control-plane authorization that can advance is signed and added to a tamper-evident record you can verify offline.
What it changes day to day
Start with the practical outcomes. The exact limits and technical boundaries are collected on one page when you need them.
Spend less time approving routine work
Profile learns the shape of your normal work. When you choose Enforce, familiar actions can pass quietly while unusual work gets your attention. Hard safety boundaries remain in place from the start.
Catch risky instructions outside the model
Isonapse scans covered content and actions for destructive commands and prompt-injection signals. Local repositories are scanned by design; warnings can be reviewed and handled through auditable policy rather than silently learned away.
Mask supported personal data before it moves
Outside Profile, the configured PII action determines whether supported personal data in raw Bash is masked, asked about, or blocked. Selected successful tool output can be tokenised, held for review, or blocked before the next model turn. Profile observes instead; the exact coverage boundaries are on What it does.
Keep approved secrets out of the next model turn
In Normal and Enforce, Isonapse resolves approved {{ secret.NAME }} placeholders locally in Bash commands, then authorizes the exact command that will run. If that secret is echoed in a supported successful result, Isonapse replaces it before Claude continues—or stops when safe replacement cannot be proven. Profile leaves placeholders literal. This protection cannot erase data Claude Code already recorded or recognise encoded and derived copies; the exact boundaries are documented on the product page.
Your rules and authorization history stay on your machine. Isonapse uploads no user content or telemetry. Setup downloads and the optional update check are explained before you initialise on the install page.
The Agent Hook is step one.
Today, Isonapse governs Claude Code on your machine. The same policy engine and provable record are heading to teams: the self-hosted Community Edition brings developers' sessions and containerised agents onto one dashboard under one policy — free under its own license — followed by the Enterprise Edition for whole organisations.
Where it's goingStart in Profile. Enforce when you are ready.
The install guide keeps the first run to four clear steps. Roadmap targets and beta feedback each have their own short page.