How I stop 18 Claude Code agents from pushing to main or touching secrets

Description and use

<p>18 AI agents. 7 repos. Now none of them can push to main, touch a secret, or wander into another repo.<br> Claude Code Mods made that possible.<br> Every time Claude is about to act, it fires an event first. Your hook runs before the action and can let it through, change it, or block it.</p> <h2> What I'm setting up </h2> <h3> tool.call: keep each agent in its lane </h3> <p>An edit outside its worktree pauses and asks me. No answer means refused.</p> <h3> tool.check: no pushing to main </h3> <p>It checks the current branch and denies git push on main, even if a permission rule allows it.</p

Problem

<p>18 AI agents. 7 repos. Now none of them can push to main, touch a secret, or wander into another repo.<br> Claude Code Mods made that possible.<br> Every time Claude is about to act, it fires an event first. Your hook runs before the action and can let it through, change it, or block it.</p> <h2> What I'm setting up </h2> <h3> tool.call: keep each agent in its lane </h3> <p>An edit outside its worktree pauses and asks me. No answer means refused.</p> <h3> tool.check: no pushing to main </h3> <p>It checks the current branch and denies git push on main, even if a permission rule allows it.</p

Outcome

<p>18 AI agents. 7 repos. Now none of them can push to main, touch a secret, or wander into another repo.<br> Claude Code Mods made that possible.<br> Every time Claude is about to act, it fires an event first. Your hook runs before the action and can let it through, change it, or block it.</p> <h2> What I'm setting up </h2> <h3> tool.call: keep each agent in its lane </h3> <p>An edit outside its worktree pauses and asks me. No answer means refused.</p> <h3> tool.check: no pushing to main </h3> <p>It checks the current branch and denies git push on main, even if a permission rule allows it.</p

Evidence

How I stop 18 Claude Code agents from pushing to main or touching secrets

Source