Skip to main content
Glama
Sign In
failshut

failshut

by Blackman99
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Go
Local

failshut

Tell you, in one command, whether your AI coding-agent permission hooks and deny/ask rules actually fail shut — or silently fail open.

You configured deny/ask/hooks for Claude Code, Codex, or OpenCode. After an upgrade, does policy still hold — or did a harness quirk turn it into a silent allow? failshut audit pressurizes the config manifold and reports every joint that bubbles.

Pain this comes from (see Coverage for what v0.1 actually detects): claude-code#32990 · claude-code#102649 · opencode#55728 · opencode#55814 · opencode#55909 · codex#54298 · codex#54440 · codex#54448 · claude-code#102582

Install

# Linux amd64 example — see Releases for darwin/windows + arm64
curl -sL https://github.com/Blackman99/failshut/releases/download/v0.1.3/failshut_0.1.3_linux_amd64.tar.gz | tar xz
./failshut audit

Or: go install github.com/Blackman99/failshut/cmd/failshut@latest

Related MCP server: pod

Usage

failshut audit
failshut audit --project ~/code/my-app   # also scans <project>/.claude and opencode.json
failshut audit --json
failshut mcp          # read-only: audit_report, list_findings

Sample FAIL OPEN output:

FAIL OPEN — 1 finding(s) where policy may not hold:

[1] hook-missing  (claude-code)
    file:     /home/you/app/.claude/settings.json
    evidence: PreToolUse command "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-src-writes.sh" runs /home/you/app/.claude/hooks/block-src-writes.sh — missing
    fix:      Restore the hook script or fix the path: a hook that cannot start is a non-blocking error, so Claude Code lets the tool call through. Or add "onFailure": "block" to the hook (Claude Code v2.1.295+) so a failed hook blocks the call.

Summary: 1 FAIL OPEN · 5 FAIL SHUT checks · 1 config(s)

demo

Exit 1 on any FAIL OPEN · 0 if sealed or nothing configured.

v0.1 is static. It does not intercept live tool calls (--canary → not in v0.1).

Rules

ID

Catches

hook-missing

Claude Code hook whose script is missing or not executable. The command is parsed like a shell would: bash/sh/python3/node prefixes, quotes, ~, $HOME, "$CLAUDE_PROJECT_DIR"/…. Nothing is executed. A hook with "onFailure": "block" (Claude Code v2.1.295+) on PreToolUse / PermissionRequest / UserPromptSubmit fails shut instead and is printed as a note (calls blocked, policy never runs); Stop-family and async hooks ignore onFailure and stay FAIL OPEN.

deny-ignored

OpenCode read/edit deny/ask rule the runtime never matches: a ./-prefixed resource, or an absolute resource inside the project

delegation-escalate

OpenCode agent (incl. plan) that denies edit but can still launch the write-capable general subagent

path-traversal-config

.. in --project or OpenCode path fields that can load a sibling config

ask-vs-effective

Heuristic Codex approval/sandbox mismatches (see Coverage)

ask-auto-allow

Heuristic hook-ask + auto-allow pairing (see Coverage)

Coverage

What v0.1 detects from config alone, issue by issue. Being honest here is part of the product.

Issue

Status

Notes

claude-code#32990

Detected

hook-missing: settings still point at a deleted hook script. Fixture testdata/hook-missing-32990.

claude-code#102649

Detected after the fact

hook-missing flags bash ~/.claude/hooks/x.sh once the script is gone. It cannot see the race that deleted it. Fixture testdata/hook-missing-102649.

opencode#55728

Detected

deny-ignored: the reported ./-prefixed resource. A plain "read": "deny" works and is not flagged.

opencode#55814

Detected when the agent is configured

delegation-escalate, v2 agents.<name>.permissions form. An OpenCode install with no agents block at all is not flagged.

opencode#55909

Partial

Only .. in --project or config path fields. The reported trigger is a .. directory passed to the server API, which config cannot show.

codex#54298

Not detected

Codex's granular.sandbox_approval = false auto-rejects requests. That fails shut, so it is not reported as FAIL OPEN.

codex#54440

Not detected

Windows runtime bug; nothing in config shows it.

codex#54448

Not detected

Delegation policy is chosen by the service, not by a local config key.

claude-code#102582

Not detected

Hook ask answered in desktop auto mode; not decidable from settings files yet.

Docs & site

https://blackman99.github.io/failshut/ · docs

License

MIT

This server cannot be deployed

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues

Resources

Related MCP Connectors

Related MCP Servers

  • tar-engine

    qingxuantang
    A
    license
    Not graded
    quality
    C
    maintenance
    Audits AI agent skills for safety using static, semantic, adversarial, and supply-chain analysis, providing scores and risk flags. Can be run via CLI, CI, or as an MCP tool from Claude Code, Cursor, and Codex.
    17 PyPI
    2
    Apache 2.0

  • pod

    suhui-organization
    A
    license
    A
    quality
    B
    maintenance
    Least-privilege compiler and MCP gateway for AI agents: run your agent in record-only mode, compile the smallest policy it actually needs from its real tool calls, enforce it at the gateway (deny > approve > allow), and keep a SHA-256 hash-chained audit of every call that verifies offline.
    14
    192 npm
    1
    Apache 2.0
  • GenParkAgentRedTeamIndirectInjectionFuzzer

    GenParkAgentRedTeamIndirectInjofficial

    alphaparkinc
    A
    license
    Not graded
    quality
    B
    maintenance
    Enables red-team testing of AI agents against indirect prompt injection by fuzzing payloads with delimiter evasion and Unicode homoglyphs, detecting exfiltration canaries, enforcing least-privilege tool boundaries, and producing cryptographic audit proofs.
    7
    MIT