vulkro guard

Scan each file as an AI coding agent writes it and feed findings back so the agent fixes them.

vulkro guard install --agent claude-code --scope project
vulkro guard status

guard install adds a hook so vulkro guard check runs on every file write. vulkro mcp serve offers the scanner as a tool the agent may call; guard makes the scan happen every time.

It runs offline with no token cost, but it is not instant: each check scans the whole project and then narrows to the one file, because a sink in that file may only be provable from a source elsewhere. On a large repository a check can take minutes. Time it on your repo before you install the hook.

guard check [FILE]

Returns one of three verdicts. It never calls a file clean or safe.

Verdict	When
Block	A proven finding at any severity, or any finding at High or Critical. The agent should regenerate.
Review	Something was found but nothing blocks (including Not checked findings), or the file was skipped.
Silent	The file was read and nothing was found.

--hook-format sets the protocol:

Value	Behaviour
generic (default)	JSON on stdout. Exit 0 silent, 2 block or review.
claude-code	Always exit 0. {"decision":"block",...} on a block. Reads the file from the hook's stdin when no path is given.
cursor	Always exit 0. {"permission":"deny",...} on a block. Reads the file from stdin when no path is given.

Without a licence, check does not scan or block: it returns a notice with the license_required marker.

guard install, uninstall, status

Flag	Description
--agent <AGENT>	claude-code (default), cursor, windsurf (best effort) or all.
--scope <SCOPE>	user (default, every project) or project (this repo, can be committed).

install merges into the existing config and is safe to re-run. uninstall removes only the Vulkro entry. status shows which agents are wired.

Exit codes

check uses the hook protocol above, and exits 2 on an operational error. install, uninstall and status: 0 success, 2 error.

See also: AI code audit.