Questions

A linter grades the file. It tells you whether your CLAUDE.md is tidy, well-ordered and not too long. Enforcee grades what the model did with it. Those are different questions, and the second one is the one nobody could answer before — you can have a perfect rules file that the agent ignored on turn forty.

Because mostly it does not. About four fifths of a hand-written ruleset is settled by plain code — forbidden words, required literals, length limits, JSON validity, citation presence — with no model call at all. For the remainder, a judged verdict is thrown out unless the quote it cites is found literally in your output, character for character. That makes it impossible to pass an audit by inventing a sentence. Where nothing can be established, the answer is "unverifiable", which is a real answer here rather than a failure.

The auditing does. It reads the rules as text, so CLAUDE.md, AGENTS.md, .cursor/rules and a pasted system prompt all work the same way, and a rule keeps the same identity if you move it between files. The guard currently hooks into Claude Code specifically, because that is where the hook API exists.

No, deliberately. The free tier is the same engine, the same verdicts and the same evidence quotes a subscriber gets — so a trial would be showing you something you can already see. Paying is for the parts that persist, block and gate, not for finding out whether it works.

The guard stops when your licence expires, and auditing keeps working exactly as before, because it never needed an account. Cancel from a link in any receipt. Your stored receipts can be exported or deleted the same day you ask.

Your email, your subscription state, and the receipts from audits you ran while signed in — verdicts and rule text. Never your source code.

Only on the free tier, and only for the judged fifth; four fifths runs on your machine with no key at all. On the paid plans there is no key to manage, rotate or leak.

Yes, and we keep a page listing exactly which parts, with links to Anthropic’s own documentation. Two features were cut from this product the week they went native, one of them a headline item on the pricing page. If you only want to block a dangerous command, the hook to do that is free and you should go and write it.

No, and the name does most of the damage. It pulls activity events, chat data and file content out of an organisation for eDiscovery and retention — a record of what was said. It says nothing about rules, nothing about CLAUDE.md, and nothing about whether an instruction was followed. It is also Enterprise-only.

Very few. It launched in August 2026 and the npm download numbers are almost entirely registry mirrors and security scanners rather than people — every published version shows a near-identical weekly count, including versions nobody would install, which is the signature of automated crawling and not of adoption. We would rather say that than quote a number we know is not real.