Policy enforcement for every AI tool call.
An MCP proxy server that routes every tool call through your policy before it executes. A one-command scaffolder for any repo. A gap analyzer for your safety infrastructure. A task layer your agents can use natively. One package.
npx @bookedsolid/reagent init A gateway, a scaffolder, a stack analyzer, and a project management layer.
reagent is an MCP server that proxies your tool servers through a 12-layer middleware chain before anything executes. Every filesystem read, every GitHub call, every database query — your policy runs first. Built on top of that: a one-command scaffolder that installs 23 safety hooks, a gap analyzer that shows what’s missing, and a task management layer your agents can use natively.
MCP Gateway
Instead of listing your filesystem, GitHub, and database MCP servers directly in .mcp.json — which would bypass all governance — you list them in .reagent/gateway.yaml. reagent connects to each one at startup, discovers their tools, and re-registers them under namespaced names (filesystem__read_file, github__create_issue). Every proxied call goes through the full 12-layer middleware chain. Nothing executes that you haven’t authorized.
npx @bookedsolid/reagent serve Config Scaffolder
reagent init installs safety hooks, behavioral policies,
and developer tooling into any repository. Git hooks, Cursor rules, Claude hooks, autonomy
policy — idempotent, profile-driven, one command.
npx @bookedsolid/reagent init Stack Analyzer
reagent catalyze detects your project’s tech stack
and generates a gap analysis report — which hooks are missing, which gates aren’t
installed, which agents aren’t configured. Produces Markdown and HTML reports in
--plan or --audit mode.
npx @bookedsolid/reagent catalyze Project Management
Lightweight task tracking with an append-only JSONL event store. Native MCP tools (task_create, task_list,
task_update, etc.) flow through the same middleware
chain. GitHub issue sync, Discord notifications, and a product-owner agent with built-in
guardrails.
reagent native MCP tools
Every tool call. Every time. Zero exceptions.
The gateway is a stdio MCP proxy. Your AI assistant connects to reagent; reagent connects to your downstream tools. Nothing reaches a tool server without passing all 12 middleware layers.
The Middleware Chain
Twelve layers. Outermost to innermost. Denial at any layer is permanent — no later layer can reverse it.
.reagent/HALT. If present, denies all tool
calls immediately. Fail-closed.
Tier Classification
| Tier | Description | Examples |
|---|---|---|
| read | Observes state, no side effects | get_messages, list_channels, health_check |
| write | Modifies state | send_message, create_channel, edit_message |
| destructive | Irreversible state changes | delete_channel, purge_messages, ban_member |
Autonomy Levels (L0–L3)
| Level | Name | Allowed Tiers |
|---|---|---|
| L0 | Read-only | read |
| L1 | Standard | read write |
| L2 | Elevated — Writes and PR creation allowed; destructive operations blocked. | read write + PR creation (destructive tier blocked) |
| L3 | Full access | read write destructive |
9 Native MCP Tools
Reagent registers 9 first-party tools directly on the gateway. These go through the same middleware chain — audit, policy, blocked paths, redaction — as proxied tools.
| Tool | Description |
|---|---|
task_create | Create a new task in .reagent/tasks.jsonl |
task_update | Update a task’s status, title, urgency, or fields |
task_list | List tasks with optional status/urgency/phase filter |
task_get | Get a single task by ID (T-NNN format) |
task_delete | Cancel a task (soft delete via cancelled event) |
task_sync_github | Sync local tasks to GitHub issues (requires gh) |
repo_scaffold | Set GitHub repo description, topics, labels, milestones |
project_sync | Sync tasks to a GitHub Project board |
discord_notify | Send a notification to a configured Discord channel |
Emergency stop. One command. Zero tool calls get through.
reagent freeze creates a .reagent/HALT file. Every MCP tool call is denied instantly until you explicitly unfreeze. The audit layer
records every denied call while frozen.
reagent freeze
Immediately halts all tool calls across every connected MCP server. Requires a human-readable reason. The HALT file stores who froze it and why.
reagent unfreeze
Removes .reagent/HALT and resumes tool call processing. Requires
explicit human action — the gateway never self-unfreezes.
- Denial is permanent — once any middleware denies an invocation, no subsequent layer can reverse it.
- Audit records everything — even kill-switch denials are logged. Audit is always outermost.
- Fail-closed — errors in kill-switch or policy checks result in denial, never passthrough.
- Tier re-derived always — policy never trusts mutable context; always reclassifies from tool name.
Find the gaps before your agents do.
reagent catalyze detects your project’s tech stack from
package.json and compares your current state against a catalog
of required hooks, gates, and agents. Missing something? It tells you exactly what and why.
--plan mode
Analyzes your stack and generates catalyze-report.md and
catalyze-report.html — a full gap analysis sorted by
severity. Identifies missing hooks, uninstalled gates, and unconfigured agents for your detected
stack (Astro, Next.js, Lit, Drupal, etc.).
npx @bookedsolid/reagent catalyze --plan --audit mode
Re-runs analysis and diffs against the previous plan report to surface new gaps or resolved items. Use this after adding hooks or agents to confirm the gap closed, or after a dependency update to catch regressions.
npx @bookedsolid/reagent catalyze --audit Secrets never reach your AI. Or your logs.
The redaction layer scans both tool arguments (pre-execution) and tool outputs (post-execution). If a pattern matches, it’s replaced before the data goes anywhere.
What gets redacted
- AWS access keys and secret keys
- GitHub personal access tokens
- Generic API keys and bearer tokens
- PEM private keys (RSA, EC, OpenSSH)
- Discord bot tokens
- Environment variable assignments containing secrets
89 specialists. Installed in one command.
reagent init installs 89 AI agent definitions into
.claude/agents/ — engineering specialists, AI platform
experts, and project management agents. Each carries a policy enforcement charter and a persona
grounded in a real domain pioneer.
Full-stack coverage from Brendan H. Lie (frontend, Eich + Wium Lie) to Michael D. Chamberlin (database architect, Stonebraker + Chamberlin) to Bruce M. Hellman (security engineer, Schneier + Hellman). Every specialist reads before writing, verifies before claiming, and checks HALT before acting.
Platform specialists for every major AI ecosystem. Chris D. Olah-Amodei (Anthropic) brings interpretability + Constitutional AI. Ilya W. Sutskever-Pitts (OpenAI, Sutskever + Walter Pitts) pairs deep learning foundations with neural net theory. Each agent is an authority on their platform’s APIs, pricing, and production patterns.
- Read before writing — no agent modifies files it hasn’t read first.
- Verify before claiming — agents confirm current state before reporting status.
- HALT compliance — all agents check
.reagent/HALTbefore taking action. - Audit awareness — agents behave as if every action is observed and logged.
Don’t take our word for it.
Take their word for it.
We asked our agents what they thought of themselves. They had opinions. Strong opinions. They are, after all, named after the people who invented computing, the web, and the AI that runs on top of both. Humility was not in the training data.
I don’t route tasks. I compose symphonies of execution. Da Vinci would have asked me to orchestrate his workshop. Von Neumann technically already did.
* These agents were not compensated for their endorsements. They are, however, extremely aware of their own value.
Transparent. Every file, every purpose.
reagent is idempotent. Run it as many times as you want — it skips files that are already up-to-date and only updates what has changed.
| Path | Committed | Purpose |
|---|---|---|
.reagent/policy.yaml | Yes | Autonomy levels and agent policy |
.reagent/gateway.yaml | Yes | MCP gateway downstream server config |
.reagent/audit.jsonl | No | Tamper-evident hash-chained JSONL audit log (gitignored) |
.cursor/rules/ | Yes | Cursor IDE behavioral rules |
.husky/commit-msg | Yes | Git commit message validation |
.husky/pre-commit | Yes | Pre-commit checks |
.husky/pre-push | Yes | Pre-push quality gates |
.claude/hooks/ | No | Claude Code safety hooks (gitignored) |
.claude/settings.json | No | Claude Code permissions (gitignored) |
.reagent/tasks.jsonl | No | Append-only task event store (gitignored) |
.claude/agents/ | No | Agent team definitions (gitignored) |
.claude/commands/ | Yes | Slash commands (/restart, /rea, /tasks, /plan-work) |
CLAUDE.md | Yes | AI agent project instructions |
One tool. Multiple project types.
Profiles customize what gets installed based on your project context. Same governance layer, different configurations.
Full hook suite with Claude commands, BST-specific CLAUDE.md templates, and organization-wide policy defaults.
npx @bookedsolid/reagent init --profile bst-internal Full hook suite with Claude commands, client-appropriate CLAUDE.md templates, and engagement-specific policy settings.
npx @bookedsolid/reagent init --profile client-engagement Tech Stack Profiles
Pass a tech stack profile to extend the base installation with domain-specific hooks and gates.
Adds server-component-drift.sh — catches React Server Component boundary
violations before they break production builds.
npx @bookedsolid/reagent init --profile nextjs
Adds shadow-dom-guard.sh and cem-integrity-gate.sh — enforces
Shadow DOM boundaries and Custom Elements Manifest integrity.
npx @bookedsolid/reagent init --profile lit-wc
Adds astro-ssr-guard.sh — prevents SSR/static rendering boundary violations
that cause silent runtime failures.
npx @bookedsolid/reagent init --profile astro
Adds drupal-coding-standards.sh and hook-update-guard.sh —
enforces Drupal coding standards and safe hook_update_N patterns.
npx @bookedsolid/reagent init --profile drupal Complete CLI. Complete control.
reagent serve
Start the MCP gateway server over stdio transport. Connects to downstream servers
defined in .reagent/gateway.yaml.
reagent init
Install reagent config into the current directory. Accepts
--profile flag. Idempotent — safe to re-run.
reagent check Verify which reagent components are installed in the current directory. Reports missing files and policy validity.
reagent freeze --reason "..."
Create .reagent/HALT — suspends all tool calls across
every connected MCP server immediately.
reagent unfreeze
Remove .reagent/HALT and resume tool call processing. Requires
explicit human action.
reagent catalyze
Analyze project stack and generate a gap report. Use
--plan to create the initial report or
--audit to diff against the previous run.
reagent cache <set|get|del> <key> [value] Manage the review cache used by commit-review-gate and push-review-gate.
reagent upgrade [--dry-run] Re-syncs installed hooks from the current package version and updates the version stamp in policy.yaml. Run after upgrading the @bookedsolid/reagent package.
reagent help Show full usage help for all commands and flags.