signet-eval: Instructions file for Claude Code

signet-eval

Deterministic policy enforcement for AI agent tool calls. Rust. Single binary.

Quick Reference

cargo build --release          # build
cargo test                     # 231 tests (unit, integration, adversarial, self-protection, inject)
cargo install --path .         # install to ~/.cargo/bin

# Hook mode (default — reads stdin, writes stdout)
echo '{"tool_name":"Bash","tool_input":{"command":"rm foo"}}' | signet-eval
echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm foo"}}' | signet-eval --adapter codex
echo '{"hook_event_name":"PermissionRequest","tool_name":"Bash","tool_input":{"command":"rm foo"}}' | signet-eval --adapter codex-permission
echo '{"toolCall":{"name":"run_command","args":{"CommandLine":"rm foo","Cwd":"/tmp"}}}' | signet-eval --adapter antigravity

# CLI
signet-eval init               # write system policy + sample.yaml (never touches rules.yaml)
signet-eval rules              # show merged rules (LOCKED/USER/SYSTEM tagged)
signet-eval validate           # check policy
signet-eval validate --fix     # auto-fix clampable issues
signet-eval validate --fix --dry-run  # preview fixes
signet-eval test '<json>'      # test a tool call
signet-eval setup              # create vault
signet-eval unlock             # refresh session
signet-eval status             # vault info + enforcement state
signet-eval store <n> <v>      # store credential
signet-eval delete <n>         # delete credential
signet-eval log                # action log
signet-eval reset-session      # clear spending
signet-eval sign               # HMAC-sign policy + user rules
signet-eval injections         # recent inject fires
signet-eval inject-test <rule> # force-fire one inject rule for testing
signet-eval serve              # MCP management server (17 tools)
signet-eval proxy              # MCP proxy

Structure

src/
  embedded_checks.rs — trusted ENSURE scripts installed atomically on first use
  main.rs          — CLI entry point (clap), 24 subcommands
  policy.rs        — Policy engine, condition functions, first-match-wins auth + advisory inject pass
  vault.rs         — Encrypted vault (Argon2id + AES-256-GCM), 3-tier, spending ledger, scoped credentials
  hook.rs          — Claude/Codex/Antigravity/OpenCode hook I/O adapters (stdin JSON → stdout JSON)
  mcp_server.rs    — MCP management server (17 tools, rmcp), locked-rule guards, auto-sign
  mcp_proxy.rs     — MCP proxy for upstream servers (rmcp), hot-reload policy
tests/
  integration_hook.rs  — End-to-end hook subprocess tests (including self-protection)
  integration_cli.rs   — CLI subcommand integration tests
examples/
  basic_policy.yaml       — Simple deny/ask rules
  spending_limits.yaml    — Cumulative spending with vault
  enterprise_policy.yaml  — Strict controls for regulated environments
  inject_examples.yaml    — INJECT trigger/payload examples