Not in the top 1,000 by GitHub stars
batrapulkit/squidbrake
Agents propose. People approve. Change control for AI agents: everyday work runs on its own, anything an agent can't take back waits for a teammate's sign-off, every action on a tamper-evident record. Open source.
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
skills/squidbrake/SKILL.md
Week of Nov 2, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → f53ec5129445
No earlier version was observed for comparison.
View on GitHubAdd to my skills
Verified commit f53ec5129445c3dd023d59851d81b7fa2e1a1b9f
git clone --filter=blob:none --no-checkout https://github.com/batrapulkit/squidbrake.git .hotskills/batrapulkit-squidbrake && git -C .hotskills/batrapulkit-squidbrake checkout --detach f53ec5129445c3dd023d59851d81b7fa2e1a1b9f
# Copy each selected skill directory from .hotskills/batrapulkit-squidbrake into .claude/skills/<skill-name>/18GitHub stars
2stars in 7 days
1skill in this repository
272commits in 30 days
Heat
3.9- Star growth, last 7 daysNot available
- Star growth, last 24 hoursNot available
- Rank movement, last 7 daysNot available
- Commits, last 30 daysNot available
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekNot available
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
- squidbrake
skills/squidbrake
How it works
squidbrake
When your agent uses it
Set up Squidbrake, which checks every command and tool call an AI agent makes against rules (risky ones wait for a person, rm -rf ~/ never runs), and respond correctly when Squidbrake blocks or holds an action. Use when the user wants guardrails, approvals or an audit trail for their coding agents, or when a tool call comes back blocked or waiting for approval from Squidbrake.
What it loads into context
Frontmatter
94 tokensAlways available to the agent
SKILL.md
640 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Setting it up for the user
- When Squidbrake blocks or holds one of your actions
Files
../../.claude-plugin/marketplace.jsonasset600 bytes../../plugin/.claude-plugin/plugin.jsonasset1,254 bytes../../plugin/hooks/hooks.jsonasset787 bytesSKILL.mdcore2,557 bytes
Read SKILL.md
# Squidbrake
Squidbrake is a gateway between AI agents and the machine. Every command, file edit, read and MCP tool call is
checked against `rules.yaml` before it runs: safe ones run, dangerous ones are blocked, and risky ones wait until
a person approves them in the dashboard, on their phone or in Slack. Everything is recorded in a tamper-evident
audit trail. Source: https://github.com/batrapulkit/squidbrake
## Setting it up for the user
Ask before running these: `connect all` changes the user's agent configs (each one is backed up first).
1. Install: `pipx install squidbrake` (or `pip install squidbrake`).
2. Connect every agent on this computer: `squidbrake connect all`. It finds Claude Code, Cursor, Codex, Gemini CLI,
VS Code Copilot and Antigravity, plus the MCP servers they use. The first time, it prints the dashboard's adminSkills included
- squidbrake
Repository facts
- License
- Apache-2.0
- Created
- Sep 29, 2026
- Last pushed
- Nov 5, 2026
- Forks
- 30
- Open issues
- 21
- Project activity
- Active
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 6, 2026
- No broad tool permissions
- 2 dangerous shell commandsin 1 file: squidbrake/SKILL.md:3
- 19 network referencesin 3 files: plugin/.claude-plugin/plugin.json:4 .claude-plugin/marketplace.json:2 squidbrake/SKILL.md:9
- No hidden or obfuscated text
- No instruction overrides
- No executable scripts
- 1 reference to secretsin 1 file: plugin/.claude-plugin/plugin.json:18
- No requests to vote in Hot
Show all 22 signals by file
.claude-plugin/marketplace.json
- Network accessline 2
"name": "squidbrake", "description": "Squidbrake: change control for AI agents. A record of every change an agent makes; risky ones wait for a person to sign off.", "owner": { "name": "Pulkit Batra", "url": "https://github.com/batrapulk - Network accessline 3
"description": "Squidbrake: change control for AI agents. A record of every change an agent makes; risky ones wait for a person to sign off.", "owner": { "name": "Pulkit Batra", "url": "https://github.com/batrapulkit" }, "plugins": [ - Network accessline 4
"owner": { "name": "Pulkit Batra", "url": "https://github.com/batrapulkit" }, - Network accessline 8
"source": "./plugin", "description": "Change control for Claude Code: every command and edit on the record, risky ones wait for a person to sign off, destructive ones keep an undo.", "homepage": "https://github.com/batrapulkit/s - Network accessline 9
"description": "Change control for Claude Code: every command and edit on the record, risky ones wait for a person to sign off, destructive ones keep an undo.", "homepage": "https://github.com/batrapulkit/squidbrake", "license": - Network accessline 10
"homepage": "https://github.com/batrapulkit/squidbrake",
plugin/.claude-plugin/plugin.json
- Network accessline 4
"version": "0.14.17", "description": "Change control for Claude Code: every command and edit goes on a tamper-evident record (which agent, what changed, who approved it). Risky ones wait for a person to sign off (dashboard, phone or Slack - Network accessline 5
"description": "Change control for Claude Code: every command and edit goes on a tamper-evident record (which agent, what changed, who approved it). Risky ones wait for a person to sign off (dashboard, phone or Slack), destructive ones keep - Network accessline 6
"author": { "name": "Pulkit Batra", "url": "https://github.com/batrapulkit" }, - Network accessline 7
"homepage": "https://github.com/batrapulkit/squidbrake", - Network accessline 8
"repository": "https://github.com/batrapulkit/squidbrake", - Network accessline 14
"title": "Squidbrake URL", "description": "Where your Squidbrake gateway runs (start one with: pipx install squidbrake && squidbrake)", "default": "http://localhost:8080" - Network accessline 15
"description": "Where your Squidbrake gateway runs (start one with: pipx install squidbrake && squidbrake)", "default": "http://localhost:8080" }, - Network accessline 16
"default": "http://localhost:8080" - Access to secretsline 18
[Credential-related source omitted]
skills/squidbrake/SKILL.md
- Dangerous shell operationline 3
description: Set up Squidbrake, which checks every command and tool call an AI agent makes against rules (risky ones wait for a person, rm -rf ~/ never runs), and respond correctly when Squidbrake blocks or holds an action. Use when the use - Network accessline 9
checked against `rules.yaml` before it runs: safe ones run, dangerous ones are blocked, and risky ones wait until a person approves them in the dashboard, on their phone or in Slack. Everything is recorded in a tamper-evident audit trail. S - Network accessline 11
audit trail. Source: https://github.com/batrapulkit/squidbrake - Network accessline 19
VS Code Copilot and Antigravity, plus the MCP servers they use. The first time, it prints the dashboard's admin key. Tell the user to save it, and don't repeat the key back in chat. 3. Start the gateway: `squidbrake` (opens `http://local - Network accessline 20
key. Tell the user to save it, and don't repeat the key back in chat. 3. Start the gateway: `squidbrake` (opens `http://localhost:8080/dashboard`). For it to keep protecting them it must stay running. A 24/7 server option is in the READM - Network accessline 21
3. Start the gateway: `squidbrake` (opens `http://localhost:8080/dashboard`). For it to keep protecting them it must - Dangerous shell operationline 24
5. Check: an agent asked to run `rm -rf ~/` should be refused with the reason.
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Signal confidence: 7 facts
- Dangerous shell operation in the frontmatter of the SKILL.mdsquidbrake/SKILL.md:3Low confidence
- Network access in prose of the SKILL.mdsquidbrake/SKILL.md:9Low confidence
- Network access in prose of the SKILL.mdsquidbrake/SKILL.md:11Low confidence
- Network access in prose of the SKILL.mdsquidbrake/SKILL.md:19Low confidence
- Network access in prose of the SKILL.mdsquidbrake/SKILL.md:20Low confidence
- Network access in prose of the SKILL.mdsquidbrake/SKILL.md:21Low confidence
- Dangerous shell operation in prose of the SKILL.mdsquidbrake/SKILL.md:24Low confidence
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Native | Manifest .claude-plugin/marketplace.json | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md skills/squidbrake/SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md skills/squidbrake/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md skills/squidbrake/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md skills/squidbrake/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md skills/squidbrake/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
