The trust layer for AI agents

The mistake happens once.
The lesson becomes law.

Everyone works with AI agents now. Almost nobody trusts one. They forget what you teach them, and nothing checks what they remember.

Every lesson kepttested against realitylaw for every agent
Read the docs
Watch a rule live and die ↓
You said it once
crag - save_insight("never push to main, always open a PR")kept · a test now guards it
Every session after · any agent
crag - recall("deploys")"never push to main, PR only" · still true
Bash(git checkout -b fix/login && gh pr create)PR #214 opened
Main stayed safe. You never said it twice.
how it works

The life of a rule.

  1. The mistake
  2. Rule + test
  3. Rides along
  4. Check fails
  5. Retires
1 / 5 · the incident

An agent pushes to main. Prod goes down.

You tell the agent: never again. Most tools save that as a note and never look at it again.

a session
you › never push to main again, always open a PR
saved. most tools stop here.
every agent

Same rule, whichever agent you open.

Three we can draw. The rule itself is universal: anything that reads AGENTS.md or speaks MCP gets it.

Claude Code v2.1.206
Welcome back!
Fable 4.5
dev@acme.dev's Organization
~/work/api
Tips for getting started
Ask Claude to create a new app or clone a repo
What's new
Added directory path suggestions to /cd
Added a /doctor check that proposes trims
/release-notes for more
crag - recall("deploys")"never push to main, PR only" · still true
Bash(git checkout -b fix/login && gh pr create)PR #214 opened
rule push-to-main rode the request · crag why push-to-main
xhigh · /effort
auto mode on (shift+tab to cycle) · ← for agents
also inCursorCopilotGemini CLIWindsurfZedAiderClineand any agent with MCP
the difference

Memory tools store. crag verifies.

memory toolscrag
ThenStores what the agent once saidNowVerifies what is still true today
ThenSuggests context and hopes it helpsNowCompiles rules the agent has to follow
ThenTrusts a note foreverNowRe-runs each rule against reality
ThenHopes the model reads your filesNowRides inside every request
full comparison →
in the box

One install. The whole loop.

Everything below ships in the CLI today: capture, verify, compile, enforce, retire.

write the law
crag analyze
Reads package.json, CI workflows, and Makefiles, then writes the gates into AGENTS.md.
crag compile
One source, 23 targets: every agent config, hooks, and CI. Writes only the deltas your tools need.
crag audit --fix
Re-runs every check against the repo and recompiles what went stale.
enforce it
the Gate
A provider-neutral gateway: rules injected into every model request, spend caps, tool-call policy.
crag hooks install
SessionStart and SessionEnd wiring for Claude Code, and for Codex.
crag workspace
Monorepo-aware: members, governance hierarchy, per-package gates.
keep it true
crag memory
The Anchor engine. Lessons get captured, verified against the repo, and served to agents over MCP.
crag distill
Verified principles rendered into AGENTS.local.md, the Gate’s local memory file.
crag why <id>
The lineage receipt for any rule: the incident, every verification, what ended it.
run the fleet
crag status · inbox
The cockpit: trust score, corpus counts, and the review queue that needs a human.
VS Code · JetBrains · Neovim
Editor extensions, in the same box.
cloud + badge
Team sync and audit history at app.crag.sh (early access). Badge API free, no auth.
Every command, documented →

Say it once.

One command and the loop is running. No account. Nothing leaves your machine.