SinkSeal: git-hook guardrails for AI coding agents

A developer created SinkSeal, a set of git hooks that act as guardrails for AI coding agents. The tool intercepts commits and pushes to catch risky code patterns, such as wiring demo features to production services, before they are merged. It is designed to work across agents like Claude Code, Cursor, and Codex, and is available as a free, MIT-licensed open-source project.

I built this after watching an AI-agent-built demo feature get wired straight to a live SMS/voice vendor — no guard, no synthetic-tenant check, just the same code path production used. A routine demo session produced real phone charges. SinkSeal is a set of git hooks bash, no runtime dependency beyond git + grep/sed that catch three things on every commit and push, regardless of which agent Claude Code, Cursor, Codex, or a human writes the code: CI catches a bad diff after it's already pushed. A git hook catches it before the commit even lands, regardless of which coding agent or human wrote the code — the enforcement lives in the hook, not in any one tool's configuration or system prompt. git clone https://github.com/kuro-tomo/sinkseal ./sinkseal/install.sh /path/to/your/repo This copies the hooks self-contained into <repo /.githooks/ , so it survives even if you later delete the sinkseal checkout, and it's inherited automatically by any git worktree of that repo. Free and MIT-licensed: https://github.com/kuro-tomo/sinkseal https://github.com/kuro-tomo/sinkseal Feedback especially welcome on the pattern-matching approach — it's inherently a probabilistic safety net regex-based , not a completeness guarantee, and I'd rather know where it's weak than oversell it.