block-no-verify

A security tool that blocks ways AI agents can bypass local git hooks. It flags the --no-verify flag, core.hooksPath overrides, GitHub MCP tool calls that write through the GitHub API, and hook-manager disable env vars (Husky, Lefthook, Overcommit, pre-commit).

Powered by @polyhook/sdk — write the hook once, run it everywhere.

Why?

When using AI coding assistants like Claude Code, Cursor, Windsurf, Cline, or Amp, you might have git hooks (pre-commit, pre-push) that enforce code quality, run tests, or perform security checks. Agents can side-step those hooks in several common ways:

• passing --no-verify to a git command,
• overriding core.hooksPath in any letter case (e.g. git -c core.hookspath=/dev/null ...),
• calling GitHub MCP tools such as mcp__github__push_files that commit or merge directly through the GitHub API, skipping the local hook chain entirely,
• setting a hook manager's own disable environment variable, e.g. HUSKY=0, LEFTHOOK=0, OVERCOMMIT_DISABLE=1, or a non-empty SKIP= (pre-commit framework),
• hiding any of the above in a git alias (git -c alias.ci="commit --no-verify" ci),
• wrapping any of the above in a shell command string (bash -c "...", sh -c '...'),
• running any of the above from a string in code passed to an interpreter (python3 -c, node -e, perl -e, an awk program) or fed to one on stdin, from an echo/printf script piped into a shell, or from a pwsh -EncodedCommand value.

This package provides a CLI that blocks all of these, working with any AI tool that supports command / tool-use hooks. Text that only mentions a bypass inside a commit or PR message is allowed. A command it cannot parse (for example an unterminated ${) is blocked, because it cannot confirm that the command is safe.

Used By

Supported Agents

See polyhook's supported tools list.

Installation

Add as a dev dependency to ensure a consistent, pinned version:

pnpm add -D block-no-verify
# or
npm install --save-dev block-no-verify

Then use it with pnpm exec block-no-verify or npm exec block-no-verify.

Platform Integration

Claude Code

Add to your .claude/settings.json. The first matcher handles shell commands (--no-verify, core.hooksPath); the second matches any GitHub MCP tool so direct-to-API writes are also blocked:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "pnpm exec block-no-verify"
          }
        ]
      },
      {
        "matcher": "mcp__github__.*",
        "hooks": [
          {
            "type": "command",
            "command": "pnpm exec block-no-verify"
          }
        ]
      }
    ]
  }
}

Cursor

Cursor 1.7+ supports hooks via .cursor/hooks.json. The beforeShellExecution hook runs before any shell command.

Create .cursor/hooks.json in your project root:

{
  "version": 1,
  "hooks": {
    "beforeShellExecution": [
      {
        "command": "pnpm exec block-no-verify"
      }
    ]
  }
}

Note: Cursor hooks are in beta. See Cursor Hooks Documentation for the latest information.

Windsurf

Add to your .windsurf/settings.json:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": ".*",
        "hooks": [
          {
            "type": "command",
            "command": "pnpm exec block-no-verify"
          }
        ]
      }
    ]
  }
}

Gemini CLI

Add to your .gemini/settings.json:

{
  "hooks": {
    "BeforeTool": [
      {
        "matcher": "run_shell_command",
        "hooks": [
          {
            "name": "block-no-verify",
            "type": "command",
            "command": "pnpm exec block-no-verify",
            "timeout": 5000
          }
        ]
      }
    ]
  }
}

Note: Hooks are disabled by default in Gemini CLI. See Gemini CLI Hooks Documentation for details.

Supported Git Commands

The following git commands are monitored for --no-verify:

• git commit
• git push
• git merge
• git cherry-pick
• git rebase
• git am

Blocked GitHub MCP Tools

The following GitHub MCP tools are blocked because they write through the GitHub API and therefore skip local git hooks:

• mcp__github__create_or_update_file
• mcp__github__delete_file
• mcp__github__push_files
• mcp__github__merge_pull_request
• mcp__github__update_pull_request_branch

Read-only GitHub MCP tools (e.g. mcp__github__get_file_contents, mcp__github__list_pull_requests) are not blocked.

Hook Manager Bypasses

Some hook managers ship their own escape hatch, separate from git --no-verify. These are detected and blocked when present alongside a monitored git command:

Behavior

Testing

This package is end-to-end tested daily via the moadim.io tool.

Contributing

See CONTRIBUTING.md for development setup and guidelines.

License

MIT

References

• polyhook SDK
• Claude Code Hooks
• Gemini CLI Hooks
• Cursor Hooks