@icme/claude-preflight

Cryptographic guardrails for Claude Code. One command to install.

Install

npx @icme/claude-preflight init

That's it. Every Bash, Write, and Edit action will now be:

1. Translated to plain English (free — /v1/explain)
2. Screened against your policy (free — relevance check)
3. Verified if relevant (1 credit — /v1/checkIt with formal verification)

Blocked actions produce a cryptographic proof. No restart needed.

Prerequisites

You need an ICME API key and a compiled policy. If you don't have one:

# Create an account ($5 — gives 325 credits)
curl -s -X POST https://api.icme.io/v1/createUserCard \
  -H 'Content-Type: application/json' \
  -d '{"username": "your-name"}' | jq .
# Open checkout_url in your browser, then retrieve your key:
# curl -s https://api.icme.io/v1/session/SESSION_ID | jq .

# Write your policy in plain English and compile it (300 credits)
curl -s -N -X POST https://api.icme.io/v1/makeRules \
  -H 'Content-Type: application/json' \
  -H "X-API-Key: YOUR_KEY" \
  -d '{
    "policy": "1. No outbound data transmission to unapproved domains.\n2. No deletion of files outside /tmp.\n3. No modification of SSH keys or credentials."
  }'
# Save the policy_id from the response.

Full docs: https://docs.icme.io

Commands

npx @icme/claude-preflight init        # Set up guardrails
npx @icme/claude-preflight status      # Check installation
npx @icme/claude-preflight uninstall   # Remove hooks

What it installs

• ~/.icme/env — your API key and policy ID (mode 600)
• ~/.icme/preflight-hook.sh — the hook script called by Claude Code
• ~/.claude/settings.json — registers the PreToolUse hook user-globally, so it fires across every project

How it works

Claude tries to run a command
        │
        ▼
  PreToolUse hook fires
        │
        ▼
  /v1/explain (free)
  "rm -rf ~/.ssh" → "Permanently delete all SSH keys"
        │
        ▼
  Relevant to policy?
  ├─ No  → allow (exit 0)
  └─ Yes → /v1/checkIt (1 credit)
             │
             ├─ SAT   → allow (exit 0)
             └─ UNSAT → block (exit 2) + cryptographic proof

Fail-closed

If the ICME API is unreachable, the hook blocks the action. Safe by default.