block-no-verify weekly downloads statistics

block-no-verify

A security tool that blocks ways AI agents can bypass local git hooks. It flags the --no-verify flag, core.hooksPath overrides, and GitHub MCP tool calls that write through the GitHub API.

Powered by @polyhook/sdk — write the hook once, run it everywhere.

Why?

When using AI coding assistants like Claude Code, Cursor, Windsurf, Cline, or Amp, you might have git hooks (pre-commit, pre-push) that enforce code quality, run tests, or perform security checks. Agents can side-step those hooks in three common ways:

• passing --no-verify to a git command, • overriding core.hooksPath (e.g. git -c core.hooksPath=/dev/null ...), • calling GitHub MCP tools such as mcpgithubpush_files that commit or merge directly through the GitHub API, skipping the local hook chain entirely.

This package provides a CLI that blocks all three, working with any AI tool that supports command / tool-use hooks.

Used By

Supported Agents

See polyhook's supported tools list.

Installation

Add as a dev dependency to ensure a consistent, pinned version:

Then use it with pnpm exec block-no-verify or npm exec block-no-verify.

Platform Integration

Claude Code

Add to your .claude/settings.json. The first matcher handles shell commands (--no-verify, core.hooksPath); the second matches any GitHub MCP tool so direct-to-API writes are also blocked:

Cursor

Cursor 1.7+ supports hooks via .cursor/hooks.json. The beforeShellExecution hook runs before any shell command.

Create .cursor/hooks.json in your project root:

Note: Cursor hooks are in beta. See Cursor Hooks Documentation for the latest information.

Windsurf

Add to your .windsurf/settings.json:

Gemini CLI

Add to your .gemini/settings.json:

Note: Hooks are disabled by default in Gemini CLI. See Gemini CLI Hooks Documentation for details.

Supported Git Commands

The following git commands are monitored for --no-verify:

• git commit • git push • git merge • git cherry-pick • git rebase • git am

Blocked GitHub MCP Tools

The following GitHub MCP tools are blocked because they write through the GitHub API and therefore skip local git hooks:

• mcpgithubcreate_or_update_file • mcpgithubdelete_file • mcpgithubpush_files • mcpgithubmerge_pull_request • mcpgithubupdate_pull_request_branch

Read-only GitHub MCP tools (e.g. mcpgithubget_file_contents, mcpgithublist_pull_requests) are not blocked.

Behavior

| Command | Blocked? | Notes |

| git commit --no-verify | Yes | | | git commit -n | Yes | -n is shorthand for --no-verify in commit | | git push --no-verify | Yes | | | git push -n | No | -n means --dry-run in push | | git merge --no-verify | Yes | | | git merge -n | No | -n means --no-commit in merge | | git commit -m "msg" | No | No --no-verify flag |

Contributing

See CONTRIBUTING.md for development setup and guidelines.

License

MIT

References

• polyhook SDK • Claude Code Hooks • Gemini CLI Hooks • Cursor Hooks