@golproductions/check 3.2.8 → 3.2.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +106 -106
- package/package.json +45 -45
- package/src/index.js +910 -897
- package/src/mcp.js +171 -171
package/README.md
CHANGED
|
@@ -1,106 +1,106 @@
|
|
|
1
|
-
# Check
|
|
2
|
-
|
|
3
|
-
**
|
|
4
|
-
|
|
5
|
-
**This is the one location.** Everything integrates from here:
|
|
6
|
-
|
|
7
|
-
```
|
|
8
|
-
npx @golproductions/check --install # Windows, macOS, Linux
|
|
9
|
-
curl check.golproductions.com | sh # Unix shells
|
|
10
|
-
```
|
|
11
|
-
|
|
12
|
-
Installing mints a free key bound to your machine. No signup, 120 free checks per day, then $0.0068 AUD each from a prepaid balance, and the same key is shared by every Check tool on the machine. Need more? Get a paid GOL API Key at [the console](https://www.golproductions.com/console.html).
|
|
13
|
-
|
|
14
|
-
---
|
|
15
|
-
|
|
16
|
-
## Integrate it into anything
|
|
17
|
-
|
|
18
|
-
Check is one primitive with four faces. Pick the one your environment speaks.
|
|
19
|
-
|
|
20
|
-
### 1. Hook mode: blocks bad commands before they run
|
|
21
|
-
|
|
22
|
-
For any tool with pre-execution hooks. `--install` wires these automatically for **Claude Code, Cursor, and Gemini CLI**; wire anything else yourself: pipe the hook JSON to the script, read the verdict.
|
|
23
|
-
|
|
24
|
-
```
|
|
25
|
-
echo '{"tool_input":{"command":"some command"}}' | node ~/.check/check.mjs
|
|
26
|
-
→ {"hookSpecificOutput":{"permissionDecision":"allow"}} # runnable
|
|
27
|
-
→ {"hookSpecificOutput":{"permissionDecision":"deny", ...}} # hallucinated
|
|
28
|
-
```
|
|
29
|
-
|
|
30
|
-
The script auto-detects Claude Code, Cursor, and Gemini hook formats and answers in each tool's own dialect.
|
|
31
|
-
|
|
32
|
-
### 2. MCP server: for anything that speaks Model Context Protocol
|
|
33
|
-
|
|
34
|
-
Windsurf, Antigravity, Continue, Amazon Q, Roo Code, Claude Desktop, or your own agent:
|
|
35
|
-
|
|
36
|
-
```json
|
|
37
|
-
{
|
|
38
|
-
"mcpServers": {
|
|
39
|
-
"check": {
|
|
40
|
-
"command": "npx",
|
|
41
|
-
"args": ["@golproductions/check", "--mcp"],
|
|
42
|
-
"env": { "GOL_CLIENT_ID": "your_key" }
|
|
43
|
-
}
|
|
44
|
-
}
|
|
45
|
-
}
|
|
46
|
-
```
|
|
47
|
-
|
|
48
|
-
Exposes two tools: `Check` (verdict only) and `CheckAndExecute` (validate, then run if clean). MCP is advisory: the agent calls it when its rules say to. Add one line to your agent's rules: *"Before running any shell command, validate it with the `check` tool."*
|
|
49
|
-
|
|
50
|
-
### 3. CLI: for scripts, CI, git hooks, anything with a shell
|
|
51
|
-
|
|
52
|
-
```
|
|
53
|
-
curl check.golproductions.com | sh # installs the `check` command (Unix)
|
|
54
|
-
check "netlify-cli deploy --prod" # → invalid (exit 1)
|
|
55
|
-
check "netlify deploy --prod" # → runnable (exit 0)
|
|
56
|
-
echo "some command" | check # pipe mode
|
|
57
|
-
```
|
|
58
|
-
|
|
59
|
-
Exit codes make it composable: gate a CI step, a git pre-push hook, a Docker entrypoint, a cron job.
|
|
60
|
-
|
|
61
|
-
### 4. HTTP: for everything else, in any language
|
|
62
|
-
|
|
63
|
-
```
|
|
64
|
-
POST https://triage.golproductions.com/preflight
|
|
65
|
-
Header: X-GOL-CLIENT-ID: your_key
|
|
66
|
-
Body: {"command": "the command to validate"}
|
|
67
|
-
|
|
68
|
-
→ {"verdict": "runnable" | "invalid", "reason": "...", "daily_remaining": 119}
|
|
69
|
-
```
|
|
70
|
-
|
|
71
|
-
That is the whole contract. Rate limit 60/min. A `402` means the free tier is spent and the balance is empty. Treat it as allow-with-warning, never as a verdict.
|
|
72
|
-
|
|
73
|
-
---
|
|
74
|
-
|
|
75
|
-
## Keys
|
|
76
|
-
|
|
77
|
-
| Tier | What | Where |
|
|
78
|
-
|------|------|-------|
|
|
79
|
-
| **GOL Client ID** (free) | Minted automatically on install, bound to the machine, shared by every tool on it. 120 checks/day, forever. | Nowhere. It just happens |
|
|
80
|
-
| **GOL API Key** (paid) | Prepaid balance ($0.0068 AUD/check after the daily 120), spend caps, dashboard, 2FA. | [Console](https://www.golproductions.com/console.html) |
|
|
81
|
-
|
|
82
|
-
Same header, same API. The tier is just what the key can do.
|
|
83
|
-
|
|
84
|
-
## Manage
|
|
85
|
-
|
|
86
|
-
```
|
|
87
|
-
npx @golproductions/check --status Your key + where Check is installed
|
|
88
|
-
npx @golproductions/check --credits Balance and free checks remaining
|
|
89
|
-
npx @golproductions/check --uninstall Remove from every tool
|
|
90
|
-
```
|
|
91
|
-
|
|
92
|
-
## Editor extensions
|
|
93
|
-
|
|
94
|
-
Thin wrappers over this same API exist on the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=golproductions.gol-check), [Open VSX](https://open-vsx.org/extension/golproductions/gol-check) (also used by Antigravity), and the [JetBrains Marketplace](https://plugins.jetbrains.com/plugin/32408). They validate on demand; the hook and MCP faces above are the real-time gate.
|
|
95
|
-
|
|
96
|
-
## Links
|
|
97
|
-
|
|
98
|
-
[Product](https://www.golproductions.com/check.html) · [Pricing](https://www.golproductions.com/pricing.html) · [Console](https://www.golproductions.com/console.html) · [Updates](https://www.golproductions.com/updates.html) · [Blog](https://www.golproductions.com/blog/)
|
|
99
|
-
|
|
100
|
-
## Terms
|
|
101
|
-
|
|
102
|
-
By installing or using Check you agree to the [Terms of Service](https://www.golproductions.com/terms.html) and [Privacy Policy](https://www.golproductions.com/privacy.html). The service is provided as is; see the Terms for the full picture, including your Australian Consumer Law rights.
|
|
103
|
-
|
|
104
|
-
## License
|
|
105
|
-
|
|
106
|
-
Copyright (c) 2026 GOL Productions. All rights reserved.
|
|
1
|
+
# Check
|
|
2
|
+
|
|
3
|
+
**Less hallucinations.** Check is a command firewall for AI coding agents: it validates commands, packages, and URLs before they run in your project. What isn't real gets denied, what is real passes through. Deterministic, no AI inside.
|
|
4
|
+
|
|
5
|
+
**This is the one location.** Everything integrates from here:
|
|
6
|
+
|
|
7
|
+
```
|
|
8
|
+
npx @golproductions/check --install # Windows, macOS, Linux
|
|
9
|
+
curl check.golproductions.com | sh # Unix shells
|
|
10
|
+
```
|
|
11
|
+
|
|
12
|
+
Installing mints a free key bound to your machine. No signup, 120 free checks per day, then $0.0068 AUD each from a prepaid balance, and the same key is shared by every Check tool on the machine. Need more? Get a paid GOL API Key at [the console](https://www.golproductions.com/console.html).
|
|
13
|
+
|
|
14
|
+
---
|
|
15
|
+
|
|
16
|
+
## Integrate it into anything
|
|
17
|
+
|
|
18
|
+
Check is one primitive with four faces. Pick the one your environment speaks.
|
|
19
|
+
|
|
20
|
+
### 1. Hook mode: blocks bad commands before they run
|
|
21
|
+
|
|
22
|
+
For any tool with pre-execution hooks. `--install` wires these automatically for **Claude Code, Cursor, and Gemini CLI**; wire anything else yourself: pipe the hook JSON to the script, read the verdict.
|
|
23
|
+
|
|
24
|
+
```
|
|
25
|
+
echo '{"tool_input":{"command":"some command"}}' | node ~/.check/check.mjs
|
|
26
|
+
→ {"hookSpecificOutput":{"permissionDecision":"allow"}} # runnable
|
|
27
|
+
→ {"hookSpecificOutput":{"permissionDecision":"deny", ...}} # hallucinated
|
|
28
|
+
```
|
|
29
|
+
|
|
30
|
+
The script auto-detects Claude Code, Cursor, and Gemini hook formats and answers in each tool's own dialect.
|
|
31
|
+
|
|
32
|
+
### 2. MCP server: for anything that speaks Model Context Protocol
|
|
33
|
+
|
|
34
|
+
Windsurf, Antigravity, Continue, Amazon Q, Roo Code, Claude Desktop, or your own agent:
|
|
35
|
+
|
|
36
|
+
```json
|
|
37
|
+
{
|
|
38
|
+
"mcpServers": {
|
|
39
|
+
"check": {
|
|
40
|
+
"command": "npx",
|
|
41
|
+
"args": ["@golproductions/check", "--mcp"],
|
|
42
|
+
"env": { "GOL_CLIENT_ID": "your_key" }
|
|
43
|
+
}
|
|
44
|
+
}
|
|
45
|
+
}
|
|
46
|
+
```
|
|
47
|
+
|
|
48
|
+
Exposes two tools: `Check` (verdict only) and `CheckAndExecute` (validate, then run if clean). MCP is advisory: the agent calls it when its rules say to. Add one line to your agent's rules: *"Before running any shell command, validate it with the `check` tool."*
|
|
49
|
+
|
|
50
|
+
### 3. CLI: for scripts, CI, git hooks, anything with a shell
|
|
51
|
+
|
|
52
|
+
```
|
|
53
|
+
curl check.golproductions.com | sh # installs the `check` command (Unix)
|
|
54
|
+
check "netlify-cli deploy --prod" # → invalid (exit 1)
|
|
55
|
+
check "netlify deploy --prod" # → runnable (exit 0)
|
|
56
|
+
echo "some command" | check # pipe mode
|
|
57
|
+
```
|
|
58
|
+
|
|
59
|
+
Exit codes make it composable: gate a CI step, a git pre-push hook, a Docker entrypoint, a cron job.
|
|
60
|
+
|
|
61
|
+
### 4. HTTP: for everything else, in any language
|
|
62
|
+
|
|
63
|
+
```
|
|
64
|
+
POST https://triage.golproductions.com/preflight
|
|
65
|
+
Header: X-GOL-CLIENT-ID: your_key
|
|
66
|
+
Body: {"command": "the command to validate"}
|
|
67
|
+
|
|
68
|
+
→ {"verdict": "runnable" | "invalid", "reason": "...", "daily_remaining": 119}
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
That is the whole contract. Rate limit 60/min. A `402` means the free tier is spent and the balance is empty. Treat it as allow-with-warning, never as a verdict.
|
|
72
|
+
|
|
73
|
+
---
|
|
74
|
+
|
|
75
|
+
## Keys
|
|
76
|
+
|
|
77
|
+
| Tier | What | Where |
|
|
78
|
+
|------|------|-------|
|
|
79
|
+
| **GOL Client ID** (free) | Minted automatically on install, bound to the machine, shared by every tool on it. 120 checks/day, forever. | Nowhere. It just happens |
|
|
80
|
+
| **GOL API Key** (paid) | Prepaid balance ($0.0068 AUD/check after the daily 120), spend caps, dashboard, 2FA. | [Console](https://www.golproductions.com/console.html) |
|
|
81
|
+
|
|
82
|
+
Same header, same API. The tier is just what the key can do.
|
|
83
|
+
|
|
84
|
+
## Manage
|
|
85
|
+
|
|
86
|
+
```
|
|
87
|
+
npx @golproductions/check --status Your key + where Check is installed
|
|
88
|
+
npx @golproductions/check --credits Balance and free checks remaining
|
|
89
|
+
npx @golproductions/check --uninstall Remove from every tool
|
|
90
|
+
```
|
|
91
|
+
|
|
92
|
+
## Editor extensions
|
|
93
|
+
|
|
94
|
+
Thin wrappers over this same API exist on the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=golproductions.gol-check), [Open VSX](https://open-vsx.org/extension/golproductions/gol-check) (also used by Antigravity), and the [JetBrains Marketplace](https://plugins.jetbrains.com/plugin/32408). They validate on demand; the hook and MCP faces above are the real-time gate.
|
|
95
|
+
|
|
96
|
+
## Links
|
|
97
|
+
|
|
98
|
+
[Product](https://www.golproductions.com/check.html) · [Pricing](https://www.golproductions.com/pricing.html) · [Console](https://www.golproductions.com/console.html) · [Updates](https://www.golproductions.com/updates.html) · [Blog](https://www.golproductions.com/blog/)
|
|
99
|
+
|
|
100
|
+
## Terms
|
|
101
|
+
|
|
102
|
+
By installing or using Check you agree to the [Terms of Service](https://www.golproductions.com/terms.html) and [Privacy Policy](https://www.golproductions.com/privacy.html). The service is provided as is; see the Terms for the full picture, including your Australian Consumer Law rights.
|
|
103
|
+
|
|
104
|
+
## License
|
|
105
|
+
|
|
106
|
+
Copyright (c) 2026 GOL Productions. All rights reserved.
|
package/package.json
CHANGED
|
@@ -1,45 +1,45 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "@golproductions/check",
|
|
3
|
-
"version": "3.2.
|
|
4
|
-
"description": "
|
|
5
|
-
"bin": {
|
|
6
|
-
"check": "src/index.js",
|
|
7
|
-
"check-mcp": "src/mcp.js"
|
|
8
|
-
},
|
|
9
|
-
"type": "module",
|
|
10
|
-
"engines": {
|
|
11
|
-
"node": ">=18"
|
|
12
|
-
},
|
|
13
|
-
"files": [
|
|
14
|
-
"src/",
|
|
15
|
-
"LICENSE",
|
|
16
|
-
"README.md"
|
|
17
|
-
],
|
|
18
|
-
"keywords": [
|
|
19
|
-
"anti-hallucination",
|
|
20
|
-
"ai-hallucination",
|
|
21
|
-
"ai-agents",
|
|
22
|
-
"ai-coding-agent",
|
|
23
|
-
"claude-code",
|
|
24
|
-
"cursor",
|
|
25
|
-
"windsurf",
|
|
26
|
-
"gemini-cli",
|
|
27
|
-
"amazon-q",
|
|
28
|
-
"continue-dev",
|
|
29
|
-
"roo-code",
|
|
30
|
-
"mcp",
|
|
31
|
-
"model-context-protocol",
|
|
32
|
-
"ai-safety",
|
|
33
|
-
"developer-tools"
|
|
34
|
-
],
|
|
35
|
-
"dependencies": {
|
|
36
|
-
"@modelcontextprotocol/sdk": "^1.12.0",
|
|
37
|
-
"zod": "^3.24.0"
|
|
38
|
-
},
|
|
39
|
-
"license": "SEE LICENSE IN LICENSE",
|
|
40
|
-
"repository": {
|
|
41
|
-
"type": "git",
|
|
42
|
-
"url": "git+https://github.com/golproductions/check.git"
|
|
43
|
-
},
|
|
44
|
-
"homepage": "https://golproductions.com/check"
|
|
45
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "@golproductions/check",
|
|
3
|
+
"version": "3.2.10",
|
|
4
|
+
"description": "Less hallucinations. A command firewall for AI agents: validates every shell command before execution, so fabricated commands are denied before they run.",
|
|
5
|
+
"bin": {
|
|
6
|
+
"check": "src/index.js",
|
|
7
|
+
"check-mcp": "src/mcp.js"
|
|
8
|
+
},
|
|
9
|
+
"type": "module",
|
|
10
|
+
"engines": {
|
|
11
|
+
"node": ">=18"
|
|
12
|
+
},
|
|
13
|
+
"files": [
|
|
14
|
+
"src/",
|
|
15
|
+
"LICENSE",
|
|
16
|
+
"README.md"
|
|
17
|
+
],
|
|
18
|
+
"keywords": [
|
|
19
|
+
"anti-hallucination",
|
|
20
|
+
"ai-hallucination",
|
|
21
|
+
"ai-agents",
|
|
22
|
+
"ai-coding-agent",
|
|
23
|
+
"claude-code",
|
|
24
|
+
"cursor",
|
|
25
|
+
"windsurf",
|
|
26
|
+
"gemini-cli",
|
|
27
|
+
"amazon-q",
|
|
28
|
+
"continue-dev",
|
|
29
|
+
"roo-code",
|
|
30
|
+
"mcp",
|
|
31
|
+
"model-context-protocol",
|
|
32
|
+
"ai-safety",
|
|
33
|
+
"developer-tools"
|
|
34
|
+
],
|
|
35
|
+
"dependencies": {
|
|
36
|
+
"@modelcontextprotocol/sdk": "^1.12.0",
|
|
37
|
+
"zod": "^3.24.0"
|
|
38
|
+
},
|
|
39
|
+
"license": "SEE LICENSE IN LICENSE",
|
|
40
|
+
"repository": {
|
|
41
|
+
"type": "git",
|
|
42
|
+
"url": "git+https://github.com/golproductions/check.git"
|
|
43
|
+
},
|
|
44
|
+
"homepage": "https://golproductions.com/check"
|
|
45
|
+
}
|