snapif
Rust CLI and Claude Code PreToolUse hook that scores one tool call as Auto, Review or Escalate using a typed decision backend.
Overview
Snapif scores a single tool call and returns one of three words: auto (the call may proceed, exit 0), review (a person should look first, exit 10) or escalate (do not run it, exit 11). It is a Rust crate and CLI; a call is described as JSON with an action id, tool name, arguments and trusted versus untrusted context. Live scoring uses a typesafe or compatible System One backend, and a scripted fake backend supports tests and examples.
snapif hook works as a Claude Code PreToolUse hook: it reads the tool call on stdin and prints a permission decision, and it fails closed, denying on a malformed body or missing tool name even in shadow mode. A print-settings option emits a hook block that runs in shadow mode with logging. Policy rows map actions such as bash.rm or git push to a harm class and confidence floors, and the matching is deliberately thorough, recognising rm or git push behind sudo, env, timeout, xargs, bash -c, Windows .exe suffixes, heredocs and similar wrappers.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | What harm class does this tool call have (e.g. read, exec)?(inferred) | — |
| Choice | Should this tool call be auto-approved, reviewed or escalated? | auto · review · escalate |
How it works
- Describe a tool call as JSON (or receive it from the hook)
- Match it to a policy row (e.g. bash.rm)
- Score harm and confidence with the decision backend
- Map to auto, review or escalate with exit codes; fail closed on errors
Strengths
- Simple three-way verdict with exit codes
- Fails closed in the hook
- Thorough command matching across wrappers
Caveats
- Policy rows need maintenance
- Live scoring requires a decision-model key
Getting started
cargo install snapif --features cli, then SNAPIF_BACKEND=fake snapif gate --call call.json.At a glance
- Type
- Project
- Status
- beta
- Language
- Rust
- Runtime
- CLI + Claude Code hook
- Has code
- yes
- Has tests
- yes
- License
- MIT OR Apache-2.0
Use cases and integrations
How curated lists describe it
Snapif scores one tool call and returns Auto, Review, or Escalate.
hellogumbo/awesome-jev
Frequently asked questions
What does Snapif decide?
Whether a tool call is auto-approved, sent for review or escalated.
What if the hook input is malformed?
It denies the call rather than letting it through.
Can I test without a key?
Yes, SNAPIF_BACKEND=fake uses scripted scores.
Related projects
Claude Code plugin adding Jev judgments to Bash, Write and Edit calls and their outputs; a semantic guardrail, not a sandbox.
PluginbetaLocal guard layer for coding agents that blocks dangerous tool calls by deterministic rules, with optional Jev judgments.
CLIbetaTypeScriptAgent-ergonomic Jev CLI and PreToolUse hook that scores shell commands for hazards and screens fetched text for injection.
PluginbetaTypeScriptPreToolUse firewall for Claude Code and Codex: shell-aware rules first, then Jev returns allow, ask or block, failing closed.
HookbetaTypeScriptSafety gate plugin for Claude Code, Codex CLI and Antigravity: local sensitive-file checks, then Jev judges blast radius.
PluginbetaTypeScriptSecurity hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScript