Paveo
Checks every shell command and file write your coding agent makes against your policy first.
Paveo sits in front of Claude Code, Codex and Cursor's hooks, and any MCP server over stdio, and checks each tool call against your policy before it runs — refusing things like rm -rf, git push --force or DROP TABLE and writing every decision to a hash-chained audit log, with nothing sent off your machine. For model calls it holds the worst-case cost against a budget before the request goes out, then settles it against the real cost once the model answers. It's free for one developer, $15 per developer a month for a team.
What holds up
- +Runs entirely on your machine — the policy check and audit log never leave your laptop.
- +paveo replay shows what it would have refused in sessions you already had, before you trust it.
- +Hash-chained audit log — each line's hash covers itself and the one before, so tampering shows.
Mind the limits
- −Free tier covers one developer only — a team rollout costs $15 per developer a month.
- −You still write the policy file yourself — Paveo enforces rules, it doesn't invent them.
Picked here? Add the badge
Put it on your site. It links back to this page. Free for every listed product.
<a href="https://stillworks.dev/products/p/paveo/"><img src="https://stillworks.dev/badge/paveo.svg" alt="Picked by StillWorks" width="230" height="54"></a>