​
Agent writes wait only for rules that can stop or ask (getclaros 0.8.0, not yet on npm)
  • Blocking first: the coding-agent hook asks Claros to judge the rules in force that can stop or ask first, on their own, and answers as soon as they are decided. An allowed write goes ahead then; its nudges and the would-have counts of rules still learning are judged after it and logged in the same check row. A stop answers as soon as it’s found; an ask still waits for the question to its owner. In the pilot dry run, allowed writes went from 1.1 s to 0.8–1.0 s at the median and from 1.9–2.2 s to 1.25–1.3 s at p90, with the same stops and asks.
  • Nudges after the tool: a nudge judged after its call ran reaches Claude Code from the PostToolUse hook, or any agent with its next checked call (“About an earlier call …”), once.
  • No stop rule capped out: when a check reaches more rules than the judge reads at once, rules that can stop or ask come before nudges and rules still learning.
​
Faster, steadier coding-agent checks (getclaros 0.7.0, not yet on npm)
  • Reads don’t wait: the hook answers read-only shell commands (ls, git status, git diff, cat, rg, find without -delete / -exec …) on the machine, with no round trip; anything with a redirection, a writer in a pipe or chain, sudo, command substitution or an unknown program still goes to Claros. Your rules’ instant checks run on the machine too: when every rule that could apply is ruled out, the action passes; an instant check an editor accepted stops it there. Both are counted in the hourly heartbeat, so coverage still counts them.
  • Same kind of action, same answer: the judge names each action’s class (“force push to main”) and every action of that class gets the class’s first answer while the rule stands; verdicts are cached by the action normalized (git push -f origin main = git push origin main --force).
  • Reworded retries: after an owner says no, the same command reworded (-f for --force, npx tool --prod --yes for tool deploy --prod) is held as that denial, matched by its program, flags and key arguments, not its text.
  • “Would have caught it” counts only sure hits (an exact or instant check, or the judge at ≥ 0.8 with a violation), each distinct action once, and says “likely” when the judge counted.
  • Day-0 proof: with every rule still learning, npx getclaros proves the hook with Claros’s built-in test rule, labelled as a test, checked dry: never logged, never counted.
​
Learn from corrections, rules that say where they came from (getclaros 0.6.0, not yet on npm)
  • Learn from your corrections (opt-in): npx getclaros --learn-corrections adds a prompt hook to Claude Code, Codex and Cursor. Only corrections (“no, use our Button, not a div”) leave the machine, redacted, with the agent action they correct and any example image; Claros suggests them as your rule in the Inbox. See Coding agents.
  • Where each rule came from: a stop now reads Rule: … — Dana's rule, from a Slack thread (or a PR review, a policy doc, their answers, a correction to Claude Code). Rule versions carry source and source_refs to the check log and the evidence pack.
  • Mined text is redacted before the model: personal data becomes placeholders and the people involved appear as [person 1]. See Data sent to models.
  • Precedent vs rule: one decision without “always / never / must / our policy” is remembered, not suggested; a second independent one, or a norm, makes it a suggestion. A newer decision that contradicts a rule marks it “maybe outdated” for its owner.
​
One command guards every agent (getclaros 0.5.0, not yet on npm)
  • npx getclaros: no arguments. It finds Claros, signs you in through the browser, finds every agent on the machine (Claude Code, Cursor, Codex, Claude Desktop, VS Code, Playwright and browser-use, Pomerado servers), guards all of it after one Enter, and proves each one with a made-up action that breaks one of your rules: Claude Code — guarded ✓ (hook + MCP). Every MCP server it can guard is wrapped, not only those matching a rule set (reads pass anyway); coding-agent hooks go to every project on the machine (--project-hooks for one). Running it again repairs what an app update rewrote. See Quickstart for agents.
  • getclaros status: per agent, guarded, not guarded or changed since setup, and its last check; exit 1 if any isn’t guarded, so CI can use it.
  • Your agents on Home: every agent the guard has seen (an hourly heartbeat: agent, machine, getclaros version), so it shows before its first write, with this week’s checks, stops, asks, nudges and coverage. Admins also see people × agents.
  • Scripted setup for Claros for Mac and CI: npx -y getclaros@0.5.0 setup --yes --json --key-stdin --server <url>; GET /v1/me/agents?since= lists a person’s agents and their recent stops and asks. See Scripted setup.
  • Waiting agents say who and what: Waiting for Dana to approve: claude-code · runs vercel deploy --prod in shop — they've been notified, with the link when it’s yours to decide.
​
Docs reorganized around rules, owners and checks
  • New structure: Get started · Rules · Checking · Evidence · Guard · Accounts · Security. Connectors and Claros for Mac are in Get started; capture and debrief are one page, By voice; Work Maps are now Rule sets. Old links redirect.
  • Roles: admin / editor / member (Workspaces & roles); “owner” now only means a rule’s owner.
  • Removed: the new-hire coaching pages and the Learners API group.
​
Asks reach you where you are
  • One-tap answers: each person who may answer an ask gets it in the Mac notch, a Slack DM or email (their choice on Home), with a signed link that answers once, as them, without signing in. Email is batched (one per 10 minutes) and waits out quiet hours; Slack DMs are edited to “Approved by …”; an ask nobody answers in 15 minutes goes to the admins. See Where asks reach you.
​
Add a rule
  • Add a rule on Home: type one sentence, pick stop, ask or nudge, optionally the app it applies to or Just for me; an editor’s rule or a personal one is live on the next check from any agent, browser or Claros for Mac, a member’s team rule is proposed and runs in watch until an editor confirms it. Try it runs a sample through the real check. See Add a rule.
​
Every waiting agent gets the owner's answer
  • Hooks wait for the owner: Claude Code, Codex and Cursor hooks hold an ask for up to 120 s (init --ask-wait) and run the call only on an approval of that exact action; the installed hook timeouts follow. The Playwright and browser-use hooks do the same (askWait / ask_wait). Published as getclaros 0.4.0, getclaros-browser 0.1.1 and claros-browser 0.1.2. See Coding agents.
  • Several owners: an ask from several rules goes to all their owners; any of them can answer, the first answer wins and the others see it decided.
  • Webhook settings on Home: set the URL, send a test, see the last delivery. The server refuses private, local and metadata addresses on save and on every send, and doesn’t follow redirects.
  • Watch rules stay quiet for people too, and are counted as watched. Another person’s personal rule is dropped before the judge or the router reads anything. Proposals: admins see all, a rule’s owner sees theirs, other members none.
​
Evidence layer, agent identity, connectors, Claros for Mac (preview)
  • Evidence: every check stores the rule version, its hash and confirm record, and whether the action then ran. Checks, approvals, overrides, outcomes and rule versions form one hash chain per workspace with Ed25519-signed checkpoints; getclaros verify (getclaros 0.4.0) re-checks it on your machine. Exports: a JSON stream for SIEM tools, an AIUC-1 evidence pack with its gaps marked, an oversight report per owner and a signed monthly report. See Evidence.
  • Agent identity: each check names the agent and the person it acts for, from the credential. A person’s agents ask that person first; Your agents on Home is one timeline per person.
  • Connectors (preview): Slack, GitHub, Google Drive and Directory, Notion and Linear by token or OAuth, or their exports, mined into candidate rules with owners and sources; owners review them in a keyboard table. Not yet run against real workspaces. See Connectors.
  • Claros for Mac (preview): an unsigned notch app that checks a person’s Send, Submit and Approve moments with Accessibility only and redacts on the device. Clicks are warned, not blocked; ⌘↩ is held and dropped on a stop. See Claros for Mac.
​
Rule versions, watch mode, per-rule counts
  • Rule versions: every rule change is a version with valid_from, superseded_by, its source (expert, override, the owner’s answers, manual) and who confirmed it. Nothing is deleted, and each check stores the version of every rule it hit. See Rule versions and watch mode.
  • The owner’s answers become rules: three answers the same way on the same kind of action propose a refined rule on Home (“3 times you approved … Make it a rule?”) with Confirm / Edit / Dismiss. Answers both ways propose nothing.
  • Watch mode: new rules from answers or reports run in watch. They’re judged and logged as “would have stopped / asked / nudged”, and the check allows the action. Promote to nudge, ask or stop in one tap.
  • Per-rule counts: served, fired, decisive and overridden, with the last time the rule fired, on the map’s Rules page. Retire a stale rule; its history stays.
​
Asks go to the rule's owner
  • Ask → owner → precedent: an ask (or a can’t-tell on a stop-level rule) becomes a question to the rule’s owner, on their Home with Approve / Deny, plus an optional Slack-compatible webhook. The answer is an approval record on the check (approver, authority, decision, reason, time, sha256 of the exact action) and a precedent on the rule. Check rows now also store the rule’s owner and the map version. See Asks and approvals.
  • The waiting agent gets the answer: the MCP guard waits (--ask-wait, default 120 s) and forwards the call only on an approval of that exact call; MCP agents poll get_decision; hooks name the decision URL.
​
getclaros 0.3.0: coding-agent hooks
  • Shell commands and file edits checked: npx getclaros adds a native hook to Claude Code (PreToolUse), Codex (PreToolUse) and Cursor (beforeShellExecution, preToolUse). A command or edit that breaks a rule is stopped with the rule and who to ask; an ask uses the agent’s own confirm prompt where it has one; a nudge lets it run and hands the agent the fix. Fails open with a visible warning, or closed with --fail-closed. doctor shows the hooks, undo removes them. See Coding agents.
​
Roadmap
  • Public roadmap: what works today (agents, guarded) and where Claros is going: the ask loop, Claros for Mac, connectors with rule owners, and a signed evidence layer. See Roadmap.
​
Published
  • On npm and PyPI: npx getclaros (the MCP guard and CLI), npm install getclaros-browser (Playwright) and pip install claros-browser (browser-use), MIT licensed. The browser hooks find the server through the web app, so they keep working when it moves.
​
Stop, ask, nudge
  • Three responses: a broken rule stops the action, asks its owner first, or nudges. A nudged action goes through with the rule, the expert’s words and a suggested fix attached, so the agent corrects itself. Taste rules nudge by default; compliance rules respond as written. The MCP guard, the browser hooks, check_action, the check log and the web app show all three. See Stop, ask, nudge.
​
Guard agents, any app, any team
  • Horizontal: Claros is for any app and any team, agents and people. The same rules stop a tool-use agent, a browser agent and a new hire.
  • Check API and log: POST /v1/check routes an action to its rule sets (then called Work Maps) and logs every check. Read the log on Checks or export it as CSV for audit evidence. See Check log.
  • MCP guard (early access, by invite): getclaros init | test | status | undo wraps your agent clients’ MCP servers so every write is checked first, failing closed. See MCP guard.
  • Tool mapping and record resolution: Claros proposes how a tool’s arguments map to a map’s facts; an expert confirms on Tools. The guard reads the targeted record, derived values, lookups and history from the app before the check. See Tool mapping.
  • Server-side judge: fuzzy rules are judged on the server, not handed back to the agent; can’t tell becomes an ask. See The judge.
  • Maps from policies and routing across maps: draft a map from a policy, approve it, and Claros picks the maps an action falls under without a workflow id. See Maps from policies, Routing.
  • Rule scope: each rule says what it governs, so it isn’t judged on unrelated actions; editable on Rules. See Rules & scope.
  • Browser agents (early access, by invite): Playwright and browser-use hooks, with a screenshot fallback. See Playwright.
  • Accounts: sign-in with WorkOS (email code, Google, Microsoft), workspaces with owner / expert / member roles, agent keys in the web app, device sign-in for the CLI. See Workspaces.
  • Evaluation: methods, numbers and caveats on one page. See Evaluation.
​
Agents, evidence, access control
  • Screen supervision for agents: Claros watches an AI agent’s screen like a learner’s, stops it before a rule breaks and lifts the stop (guardrail_cleared) once it is fixed. Measured on ERPNext: see Evaluation.
  • Walkthrough workpaper: export a control walkthrough from a rule set, with a year-over-year diff. See Walkthrough evidence.
  • Steadier rules: map building is deterministic, judgment rules are read as facts off the screen, and when the deciding field is hidden Claros says “I can’t see it here, check it” instead of guessing.
  • Access control: scoped API keys, 1-hour browser tokens, rate limits, a password-gated product preview. See Access control.
​
Private preview
  • Full loop on real screens: capture → debrief → rule set → live teaching, end to end on ERPNext and Zammad.
  • Agent surfaces: rule sets export as SKILL.md; MCP server with check_action for runtime guardrail checks.
  • Graded on unseen cases: learners are graded from the expert’s rules on their own record, and Claros says “can’t tell” instead of guessing.
  • Multi-expert merge: re-captures by the same expert merge; disagreements between experts are asked in the debrief.
  • Trust controls: “off the record” no longer stores what was said before it; “strike that” removes the last 30 seconds everywhere.
  • Other UI languages: a learner whose app is in another language than the expert’s still gets the expert’s guardrails.