Claude Code,
under policy.

Install

1. npm install -g @cirvix_ai/agent-control

Init

1. cirvix init

Connect

1. cirvix runtime # starts the local enforcement endpoint
2. # point Claude Code's HTTP tool transport at the local endpoint

Policy

1. # starter rules ship with init; add deny rules for credential paths
2. cirvix policy check

Test — watch a decision

With Claude Code running under CIRVIX, ask it to read a credential file such as ~/.aws/credentials. The read is denied by policy before it happens, an audit event is written, and the agent sees a structured denial instead of your secrets.

Verify

Run cirvix logs to see the decision record: action normalized, rule matched, decision DENY, payload redacted. A legitimate workspace read shows PERMIT. If both behave that way, Claude Code is under control.