EEnforceeRun an audit

rule checking for AI coding agents

Did it actually follow your rules?

You wrote a CLAUDE.md. You’ve rewritten it twice since. Nobody has ever told you whether it worked.

Enforcee checks your output against your rules, one rule at a time, and shows you the exact line that proves each answer.

Try it on your own rules

free · no account · about 20 seconds

$ npx enforcee audit CLAUDE.md answer.md

or run it here in the browser, if you’d rather not install anything

What you get back

A verdict for every rule. Four possible answers, and we’re strict about the difference between them.

Followed

It complied. Here’s the sentence that shows it.

Violated

It broke this rule. Here’s the sentence that shows it.

?
Unverifiable

We couldn’t tell. We won’t invent a verdict to look thorough.

Not applicable

The rule only applies sometimes, and this wasn’t one of those times.

Plus one number: Coverage. It’s the share of your rules that left any trace at all. A rule that leaves none was probably never read.

Three places it runs

Same engine, same verdicts, same receipt. Pick whichever fits how you work.

On your machine
npx enforcee audit

A command. No account, no key, and it never touches the network.

Start here
In your pipeline
GitHub Action

Fails the pull request when a rule was broken, so the standard is actually enforced.

Add to CI
While you work
editor hook

Stops a dangerous command before it runs, and puts your rules back after a compaction.

See what it blocks

You’re not imagining it

Researchers followed 1,650 real coding sessions. Agents obeyed a CLAUDE.md about two thirds of the time, and got worse with every function they wrote.

File size didn’t matter. Instruction order didn’t matter. Neither did structure. So no, you can’t fix this by writing a better rules file. arXiv 2605.10039

The rewrite spiral

Every few weeks you rewrite the ruleset, longer each time, with no way to tell if it helped.

The canary emoji

You hide a silly instruction in the file and watch for the turn it stops appearing. This is the state of the art.

The silent skip

It never says "I ignored rule 11." It writes something confident and slightly wrong.

The 3am command

It ran a migration against production, because that rule was on line 47 of a file it had stopped weighting.

Where it goes wrong

Six steps sit between your prompt and your output. You can see three of them.

What actually happens to your rules

prompt → output, and the part nobody shows you
  1. 1
    You write the rules

    CLAUDE.md, a system prompt, custom instructions, skills, MCP config. Hours of your life.

  2. 2
    The session loads them

    Your rules join the system prompt, alongside tool schemas, memory, skill listings and file contents.

  3. 3
    You ask for something

    Your actual prompt is a rounding error next to everything already in the window.

  4. 4
    Attention gets divided

    Every rule now competes with every other token for finite attention. Some win. Some do not.

  5. 5
    It acts

    Tool calls run. Files are written. Commands execute. Rules either held here or they did not.

  6. 6
    You get an output

    It looks fine. It usually is fine. You have no way to tell which rules survived the trip.

Steps 4 and 5 are the whole problem. You cannot see them, and neither can any tool you currently own. The model does not error when it skips rule 11. It just quietly writes something slightly wrong, and you find out three commits later.

where enforcee sits
before step 1
Learn

Reads what you already said and turns it into rules. Flags contradictions, duplicates and rules too vague to ever check.

during step 4
Enforce

A hook that denies a forbidden tool call before it runs, and puts your rules back into context the moment compaction drops them.

after step 6
Verify

A receipt: every rule, a verdict, the exact quote. Plus the rules that left no trace at all.

why this one

Everyone else grades the file. We grade what the model did.

It won’t guess

If a verdict comes from a model, it has to quote your text, and we go and find that quote. No quote, no verdict. Across 48 verdicts on three models: zero false accusations.

It checks the claim, not the story

Other tools read the transcript, and a false claim sits inside the transcript looking perfectly normal. We check the filesystem instead. It said it wrote the file; the file isn’t there.

It blocks, not just reports

Most tools tell you what already happened. Enforcee refuses the dangerous command before it runs, and quotes your own rule as the reason.

Most of it needs no model

About four fifths of a normal ruleset is settled by plain code. That part is instant, reproducible offline, and free forever.

How it compares to tools you may already have
ToolAnswersNever answers
CLAUDE.md lintersIs my rules file tidy?Did the model follow it?
LangSmith, LangfuseWhat did this call cost?Which of my rules broke?
Ruler, rulesyncAre my rule files in sync?Was any of it honoured?
Editor hooksCan I block this command?Which rules are decaying?

not testimonials

We launched this week, so here’s evidence instead.

No logos, no five-star quotes. Just people describing this problem in public, dated and linked so you can read the whole thing.

Agents can ignore or forget about what AGENTS.md says, and this becomes more and more apparent as a repo grows.
aleqs · Hacker News
I regularly have to stop an agent and remind it to use p4 edit, despite the first paragraph of Claude.md being 'this is a project using perforce'.
maccard · Hacker News
Agents lose rule details over long horizons, and report compliance they did not achieve.
HANDBOOK.md benchmark · arXiv

That last one is a benchmark, not a bad day: 65 tasks, 824 graded criteria. The best of thirty frontier setups passed 36.2%. The failure it names by title is a model reporting compliance it never achieved.

Find out what your rules are doing.

Paste a ruleset and an answer. You’ll know inside a minute.