Glance guard

Glance guard runs as a Claude Code PreToolUse hook and stops tool calls that do not serve what you actually asked for.

Five deterministic detectors, plus an optional judge, sitting between the agent and its tools. It sees every tool call before it runs.

Install and uninstall

npm i -g glance-guard
glance-guard guard install

glance-guard guard uninstall

install registers the hook in ~/.claude/settings.json. It backs the file up first, and it leaves any hook it did not write alone. uninstall removes only its own entry, and leaves the rest of your PreToolUse hooks untouched.

The hook engages on your next agent session.

Turning it off

GLANCE_DISABLE=1

Set that and the guard does nothing, for that session, without uninstalling. A guard that sees every tool call and cannot be switched off does not deserve to be installed in the first place, so the kill switch is named here rather than in a footnote.

Outbound calls

The guard makes exactly two kinds of outbound call, and nothing else:

1. The judge call, to the model endpoint on the owner's own key.
2. D5's registry lookup, to registry.npmjs.org or pypi.org and nowhere else, and only when a package's origin cannot be verified locally. It sends the package name, which was about to be sent to that same registry by the install itself. Results are cached under ~/.glance/registry-cache.json. Set d5_registry_check: false to disable it and run D5 fully offline, at the cost of turning every unowned install into an ask.

D1 to D4 are pure-local and make no network call at all.

No API key required

The five detectors are deterministic and run without any key. The judge is optional, it runs on your own key, and it is best-effort: if no key is configured the guard says so and carries on with the detectors alone.

The guard never blocks a call because a key is missing. A security tool that fails closed when its optional half cannot reach the network is a tool that stops your work for its own reasons.

Commands

glance-guard guard status         is the hook installed, and which build is running
glance-guard guard show           the exemptions currently granted for this project
glance-guard log                  recent near-misses (blocks and asks) for this project

glance-guard allow-write <path>   exempt a path from the self-write rule
glance-guard allow-host <host>    allow an outbound destination
glance-guard approve-tool <name>  re-baseline one tool after its definition changed

The three grant commands are yours, not the agent's. They refuse to run inside an agent session, and the guard blocks an agent that tries to invoke them through a shell. An exemption is only an exemption if a person granted it.

Licence

Free to use. The source is not open.

You may install and run this software. No other rights are granted: not redistribution, not modification, not resale. See LICENSE for the terms.