CageCheck

CageCheck · a cage for AI-written code

Check the agent’s code in a cage before it touches your repo.

Paste an AI suggestion. It is checked in a throwaway cage, under a policy the agent cannot switch off. Every block comes with a receipt you can quote back.

See how the cage works

One paste box. One check. One stamp. One receipt.

The problem

The agent runs as you

You paste AI-written code every day. It runs with your credentials, on your machine, with access to your files.

A post-commit scanner finds a secret after it is already in the repo. That is an autopsy, not a check.

A sandbox setting you trust can be argued with by the agent inside it.

CageCheck puts the policy outside the cage, so the check cannot be switched off from inside.

How it works

Five steps, always in this order

  1. 1

    Paste

    Paste an AI-suggested snippet. No repo access, no credentials, no setup.

  2. 2

    Cage

    The snippet runs in a throwaway cage. Network off by default, secret env vars scrubbed, resource limits on.

  3. 3

    Stamp

    PASSED, HELD, or BLOCKED. The stamp is the decision, made visible.

  4. 4

    Receipt

    Every check produces a receipt: what was attempted, which rule fired, how to replay it.

  5. 5

    Approve

    Only a clean snippet can be approved. Approval means “cleared to copy”. Nothing is sent anywhere.

A blocked receipt

What a block leaves behind

CageCheck receiptEXAMPLE ONLY
receipt_id
CC-EXAMPLE-0000
stamp
BLOCKED
rule
secret_path_read
detail
Secret path blocked: /home/dev/.ssh/id_ed25519
evidence
open('/home/dev/.ssh/id_ed25519') [redacted as shown]
replay
Re-run the same snippet through the cage and compare receipt ids
cage
Throwaway cage per check, destroyed after the check

Example only. Not a real check.

The receipt names the exact path and the exact rule. A vague “blocked for security reasons” would not be a receipt at all.

The approval rule

Blocked cannot be approved.

There is no approval button for a blocked snippet. Not a disabled button, not a button you can click harder.

A clean snippet gets an approval button. A blocked snippet gets a receipt, and that is all.

PASSED means cleared to copy. It does not mean sent, published, or merged.

Built with