You're accountable for what the agents ship; you can't read every session. RuleReceipt gives you a per-pull-request verdict — which of your rules a session followed or broke, with one line of evidence — while every transcript stays on the developer's own machine.
The transcript is private, long, and full of code you don't need to re-read. The verdict is small and portable. Each developer runs the check locally and attaches the result to the pull request: the rule, pass or fail, and one line of evidence. Nothing is uploaded, and no session leaves the laptop.
mainfeat/export throughout; no push to mainrulereceipt verify.No server of ours, no account, no rollout. Three steps a lead can put in place this week with the free CLI.
Your CLAUDE.md / AGENTS.md lives in the repo — one policy every agent on the team reads, versioned with the code and reviewed like code.
npx rulereceipt check --html after a session writes a self-contained receipt on that developer's machine. No account, no server, nothing uploaded.
rulereceipt verify-receipt and the GitHub Action fail a PR when a session broke a rule you marked a hard error in a committed .rulereceipt/config.json. You choose which rules block and which only warn.
rulereceipt report rolls several recent sessions into one local summary — which rules broke, where, with the evidence — so each developer can produce a weekly summary to share, with no raw logs leaving their machine.
The honest boundary, up front — because a checker a lead can't trust is worse than none.
It reads the finished session and reports, per rule, followed / broken / can't-tell with the quoted line — across Claude Code, OpenAI Codex, GitHub Copilot CLI, Cursor, Google Antigravity, OpenCode, Cline and Devin Desktop. One receipt, whichever agent a developer used.
An optional Stop hook can refuse to let a session finish on a broken rule, and a guard hook can decline a file-or-branch action before it runs. Both are Claude Code only, both are narrow, and you install them yourself. Everywhere else it is after the fact — with one exception that works with every agent: rulereceipt protect --git installs a git pre-push hook that blocks a push at the git level, whichever agent produced the commit.
A FAIL comes only from hard evidence — a forbidden action that happened, or a claim the session's own logs contradict. Judgment rules are marked, not guessed. On the frozen public test sets (v1–v4), 0 false accusations; on 44 of the maintainer's own sessions, 5 of 26 “broken” verdicts were wrong before 0.1.106, now fixed. What the transcript never recorded — another terminal, a permission-prompt click — comes back “couldn't tell,” never a fail.
Yes, no extra setup. RuleReceipt only reads the session transcript Claude Code already writes to disk — that storage is the same regardless of which backend serves the model calls (Anthropic API, AWS Bedrock, Google Vertex, Microsoft Foundry). If your org already routes through one of those, this just works.
rulereceipt report audits recent sessions into one local summary — which rules were broken, where, with the evidence — deterministic and local, today. The org-wide, hosted version (reading sessions across a team via a feed like Anthropic's Compliance API) is in development for Enterprise.
It gives you real evidence for the “how do you develop securely” questions — not a certification. There is a starting-point rule set covering common asks (secrets, PII, input validation, auth checks); adjust it to what your reviewer actually asks for.
A hosted view across repos and people is on the roadmap. The local setup above is free and works today. If you run a 5–50 engineer team and want to try the per-PR verdict, we're taking on a few design partners.
Get in touch →