review-agent-governance — Setup
Unverified●30/40Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor·UnknownWe have not crawled the repo tree, so we will not guess
Codex·UnknownWe have not crawled the repo tree, so we will not guess
Gemini CLI·UnknownThe spec defines no detection rule for Gemini
Copilot·UnknownWe have not crawled the repo tree, so we will not guess
npx agentalley add review-agent-setupWho is stuck, and on what
Configure human-in-the-loop gating for AI agent review actions in Claude Code. Use when setting up a project where an agent may post PR reviews, comments, merges, or edit CI configuration, and you want a cryptographically auditable approval trail with Cedar-enforced gates.
The whole source
Frontmatter — 2 properties
| name | review-agent-setup |
|---|---|
| description | Configure human-in-the-loop gating for AI agent review actions in Claude Code. Use when setting up a project where an agent may post PR reviews, comments, merges, or edit CI configuration, and you want a cryptographically auditable approval trail with Cedar-enforced gates. |
| 1 | --- |
| 2 | name: review-agent-setup |
| 3 | description: Configure human-in-the-loop gating for AI agent review actions in Claude Code. Use when setting up a project where an agent may post PR reviews, comments, merges, or edit CI configuration, and you want a cryptographically auditable approval trail with Cedar-enforced gates. |
| 4 | ---A5 — No allowed-tools declared — no way to tell what this skill may touch |
| 5 | |
| 6 | # review-agent-governance — Setup |
| 7 | |
| 8 | Gate AI agent review actions (PR reviews, comments, merges, CI edits) behind |
| 9 | explicit human approval. Every attempt, approved or denied, produces an |
| 10 | Ed25519-signed receipt. |
| 11 | |
| 12 | ## When to use this plugin |
| 13 | |
| 14 | Install it in projects where a Claude Code agent: |
| 15 | |
| 16 | - Reviews, comments on, or merges pull requests (`gh pr review`, `gh pr merge`) |
| 17 | - Triages issues (`gh issue comment`, `gh issue close`) |
| 18 | - Publishes releases (`gh release create`) |
| 19 | - Modifies CI configuration (`.github/workflows/`, `.gitlab-ci.yml`) |
| 20 | - Pushes to protected branches (`main`, `master`, `release`, `production`) |
| 21 | - Posts to external notification surfaces (Slack webhooks, Discord) |
| 22 | |
| 23 | If the agent is only doing local file edits and running tests, this plugin is |
| 24 | overkill. Use `protect-mcp` for general tool-call policy enforcement and skip |
| 25 | this one. |
| 26 | |
| 27 | ## One-time setup |
| 28 | |
| 29 | ### 1. Install the plugin |
| 30 | |
| 31 | ```bash |
| 32 | claude plugin install wshobson/agents/review-agent-governance |
| 33 | ``` |
| 34 | |
| 35 | ### 2. Copy the default policy to your project |
| 36 | |
| 37 | ```bash |
| 38 | cp .claude/plugins/review-agent-governance/policies/review-agent-governance.cedar \ |
| 39 | ./review-governance.cedar |
| 40 | ``` |
| 41 | |
| 42 | You can edit this file to match your project's specific rules. See |
| 43 | `../agents/review-policy-author.md` for guidance on authoring review |
| 44 | policies. |
| 45 | |
| 46 | ### 3. Create a receipts directory and sign key |
| 47 | |
| 48 | ```bash |
| 49 | mkdir -p ./review-receipts |
| 50 | echo "./review-receipts/" >> .gitignore |
| 51 | echo "./review-governance.key" >> .gitignore |
| 52 | echo "./.review-approved" >> .gitignore |
| 53 | ``` |
| 54 | |
| 55 | The first invocation of `protect-mcp sign` will create the key. Commit the |
| 56 | public key from the first receipt so auditors can verify later. |
| 57 | |
| 58 | ## Per-session workflow |
| 59 | |
| 60 | The Cedar policy denies review-surface actions unconditionally. To approve |
| 61 | a specific action, open an approval window before it and close it after. |
| 62 | |
| 63 | ### Flag file (simplest) |
| 64 | |
| 65 | ```bash |
| 66 | # Before the action you want to approve |
| 67 | touch ./.review-approved |
| 68 | |
| 69 | # Let Claude Code run the review / comment / merge |
| 70 | |
| 71 | # Immediately after |
| 72 | rm ./.review-approved |
| 73 | ``` |
| 74 | |
| 75 | ### Slash command (from within Claude Code) |
| 76 | |
| 77 | ``` |
| 78 | /approve-review "Reviewing PR #123 authored by contributor X" |
| 79 | ``` |
| 80 | |
| 81 | This creates `./.review-approved` with the given reason embedded as a note, |
| 82 | and writes a human-approved receipt to the chain. A follow-up `rm` is still |
| 83 | needed to close the window. |
| 84 | |
| 85 | ### Dry-run everything (force full policy evaluation) |
| 86 | |
| 87 | If you want every tool call to go through Cedar with no approval bypass: |
| 88 | |
| 89 | ```bash |
| 90 | export REVIEW_APPROVAL_FLAG=./.never-approve |
| 91 | ``` |
| 92 | |
| 93 | Any tool call matching a forbid rule will be denied; approved windows have |
| 94 | no effect. Useful for CI or for a locked-down audit run. |
| 95 | |
| 96 | ## Verifying the chain |
| 97 | |
| 98 | List all receipts: |
| 99 | |
| 100 | ```bash |
| 101 | ls -la ./review-receipts/ |
| 102 | ``` |
| 103 | |
| 104 | Verify the entire chain offline: |
| 105 | |
| 106 | ```bash |
| 107 | npx @veritasacta/verify ./review-receipts/*.json |
| 108 | ``` |
| 109 | |
| 110 | Exit 0 means every receipt is authentic and the chain is intact. Exit 1 |
| 111 | means one receipt has been tampered with. Exit 2 means a receipt is |
| 112 | malformed. |
| 113 | |
| 114 | Look at recent denials: |
| 115 | |
| 116 | ``` |
| 117 | /list-pending |
| 118 | ``` |
| 119 | |
| 120 | Within Claude Code this slash command walks the receipt chain and prints |
| 121 | any recent `decision: deny` entries with the tool name, command pattern, |
| 122 | and timestamp. |
| 123 | |
| 124 | ## Example: approving a PR review |
| 125 | |
| 126 | ```bash |
| 127 | # 1. Human reviews the agent's proposed comment |
| 128 | $ /list-pending |
| 129 | Recent denials: |
| 130 | - 2026-04-17T14:23:01Z Bash "gh pr review 42 --approve --body 'LGTM'" |
| 131 | - 2026-04-17T14:23:02Z Bash "gh pr comment 42 --body 'Looking good'" |
| 132 | |
| 133 | # 2. Human decides the first one is appropriate, approves it |
| 134 | $ /approve-review "Approving LGTM on PR 42 after visual inspection" |
| 135 | ./.review-approved created |
| 136 | |
| 137 | # 3. Agent retries the action; this time it succeeds |
| 138 | $ agent: gh pr review 42 --approve --body "LGTM" |
| 139 | [receipt: rec_XXX, decision=allow, reason=human_approved] |
| 140 | |
| 141 | # 4. Human closes the window |
| 142 | $ rm ./.review-approved |
| 143 | ``` |
| 144 | |
| 145 | Every step is in the receipt chain. The chain is offline-verifiable for |
| 146 | regulators, counterparties, or downstream auditors who want to confirm |
| 147 | that no review action bypassed the human gate. |
| 148 | |
| 149 | ## Composing with protect-mcp |
| 150 | |
| 151 | If both plugins are installed, each plugin's `hooks/hooks.json` registers its |
| 152 | own PreToolUse hook, and Claude Code runs both on every tool call: |
| 153 | |
| 154 | ```json |
| 155 | { "type": "command", "command": "\"${CLAUDE_PLUGIN_ROOT}\"/hooks/evaluate.sh" } |
| 156 | ``` |
| 157 | |
| 158 | Each `evaluate.sh` reads `tool_name` and `tool_input` from the hook payload on |
| 159 | stdin (Claude Code sets no `TOOL_NAME` variable) and evaluates its own policy: |
| 160 | `./protect.cedar` for protect-mcp and `./review-governance.cedar` here. |
| 161 | |
| 162 | Both hooks must pass for the tool call to proceed. Cedar deny in either |
| 163 | policy blocks it. |
| 164 | |
| 165 | ## Standards |
| 166 | |
| 167 | - **Ed25519** — RFC 8032 (digital signatures) |
| 168 | - **JCS** — RFC 8785 (deterministic JSON canonicalization) |
| 169 | - **Cedar** — AWS's open authorization policy language |
| 170 | - **IETF draft** — [draft-farley-acta-signed-receipts](https://datatracker.ietf.org/doc/draft-farley-acta-signed-receipts/) |
| 171 |
Reviews
Installed this one?Write the first review and take the Trailblazer badge.
Alternatives
Block No Verify HookConfigure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.◐····●35/40Sast ConfigurationConfigure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.◐····●32/40Binary Analysis PatternsMaster binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.◐◐◐◐◐●31/40Anti Reversing TechniquesUnderstand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.◐◐◐◐◐●30/40