block-no-verify
A security tool that blocks ways AI agents can bypass local git hooks. It flags the --no-verify flag, core.hooksPath overrides, GitHub MCP tool calls that write through the GitHub API, and hook-manager disable env vars (Husky, Lefthook, Overcommit, pre-commit).
Powered by @polyhook/sdk — write the hook once, run it everywhere.
Why?
When using AI coding assistants like Claude Code, Cursor, Windsurf, Cline, or Amp, you might have git hooks (pre-commit, pre-push) that enforce code quality, run tests, or perform security checks. Agents can side-step those hooks in several common ways:
- passing --no-verify to a git command,
- overriding core.hooksPath (e.g. git -c core.hooksPath=/dev/null ...),
- calling GitHub MCP tools such as mcpgithubpushfiles that commit or merge directly through the GitHub API, skipping the local hook chain entirely,
- setting a hook manager's own disable environment variable, e.g. HUSKY=0, LEFTHOOK=0, OVERCOMMITDISABLE=1, or a non-empty SKIP= (pre-commit framework).
This package provides a CLI that blocks all of these, working with any AI tool that supports command / tool-use hooks.
Used By
<a href="https://github.com/langgenius/dify" <img src="https://github.com/langgenius.png" width="50" height="50" alt="Dify" title="Dify - Open-source LLM app development platform (133k★)" </a <a href="https://github.com/nicolargo/glances" <img src="https://raw.githubusercontent.com/nicolargo/glances/develop/docs/static/Glances%20Text%20Logo.svg" width="50" height="50" alt="Glances" title="Glances - Cross-platform system monitoring tool (32k★)" </a <a href="https://github.com/pubkey/rxdb" <img src="https://raw.githubusercontent.com/pubkey/rxdb/master/docs-src/static/files/logo/rxdbmini.svg" width="50" height="50" alt="RxDB" title="RxDB - Local-first database for JavaScript applications (23k★)" </a <a href="https://github.com/promptfoo/promptfoo" <img src="https://github.com/promptfoo.png" width="50" height="50" alt="Promptfoo" title="Promptfoo - LLM testing and evaluation framework (18k★)" </a <a href="https://github.com/YFGaia/dify-plus" <img src="https://github.com/YFGaia.png" width="50" height="50" alt="Dify Plus" title="Dify Plus - Enhanced Dify distribution (2k★)" </a <a href="https://github.com/forcedotcom/salesforcedx-vscode" <img src="https://github.com/forcedotcom.png" width="50" height="50" alt="Salesforce Extensions for VS Code" title="Salesforce Extensions for VS Code (1k★)" </a <a href="https://centy.io" <img src="https://github.com/centy-io.png" width="50" height="50" alt="Centy" title="Centy" </a <a href="https://worktree.io" <img src="https://github.com/worktree-io.png" width="50" height="50" alt="Worktree" title="Worktree" </a
Supported Agents
See polyhook's supported tools list.
Installation
Add as a dev dependency to ensure a consistent, pinned version:
pnpm add -D block-no-verify
# or
npm install --save-dev block-no-verifyThen use it with pnpm exec block-no-verify or npm exec block-no-verify.
Platform Integration
Claude Code
Add to your .claude/settings.json. The first matcher handles shell commands (--no-verify, core.hooksPath); the second matches any GitHub MCP tool so direct-to-API writes are also blocked: