agentrigs
+ submit rig
~ / rigs / hanygheit / ai-agent-on-call

hanygheit/ai-agent-on-call

Starter repo for agentic software projects with guardrails built in: AGENTS.md, Claude Code hooks (kill switch, prod-guard, change freeze, audit log), plan-first specs, an agent offer letter, and 46 offline guardrail tests. Companion to the

↗ GitHub ★ 3 MIT updated 14d ago project Claude CodeCodex
share on X
ARCHETYPE
Fort Knox
Deny lists, pre-tool hooks, sandboxing. Nothing touches prod without a signature.
CONTEXT TAX · EVERY TURN
~1.1k tokens
Featherweight · median rig: 2.3k · breakdown
GUARDRAILS
5/5
Blocks destructive commands · Protects secrets · Pre-tool screening hook · No YOLO mode · Sandbox or ask-first rules · details

Copy this rig

# review before running: this installs third-party code
$ npx degit hanygheit/ai-agent-on-call/.claude ./rig-ai-agent-on-call  # inspect, then merge into .claude/

MCP servers are added to Claude Code at local scope; env vars are shown as YOUR_… placeholders — we never store values. Files are fetched with degit into a separate folder so you can review before merging.

$ npx degit hanygheit/ai-agent-on-call/.claude/skills/plan-feature .claude/skills/plan-feature
$ curl -fsSL --create-dirs -o .claude/agents/oncall-triage.md https://raw.githubusercontent.com/hanygheit/ai-agent-on-call/main/.claude/agents/oncall-triage.md

Merge into .claude/settings.json (project) or ~/.claude/settings.json (user). Hook commands reference scripts in the source repo — copy those too.

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Read(**/*.pem)",
      "Read(**/*.tfstate)",
      "Bash(git push --force *)",
      "Bash(git push * main)",
      "Bash(terraform destroy *)"
    ],
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr create *)"
    ]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "*",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/kill-switch.sh"
          }
        ]
      },
      {
        "matcher": "Bash|Edit|Write|MultiEdit|NotebookEdit",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/change-freeze.sh"
          }
        ]
      },
      {
        "matcher": "Read|Edit|Write|MultiEdit|NotebookEdit",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/protect-files.sh"
          }
        ]
      },
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/prod-guard.sh"
          },
          {
            "type": "command",
            "command": "bash \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/action-budget.sh"
          }
        ]
      }
    ]
  }
}

Skills (1)

plan-feature

Subagents (1)

oncall-triageRead-only incident investigator. Use when an alert fires or something is broken in a running environment. Gathers evidence, finds the likely cause and PROPOSES a fix with a rollback plan. It never app

Hooks (7)

eventmatcherruns
PreToolUse*bash "$CLAUDE_PROJECT_DIR"/.claude/hooks/kill-switch.sh
PreToolUseBash|Edit|Write|MultiEdit|NotebookEditbash "$CLAUDE_PROJECT_DIR"/.claude/hooks/change-freeze.sh
PreToolUseRead|Edit|Write|MultiEdit|NotebookEditbash "$CLAUDE_PROJECT_DIR"/.claude/hooks/protect-files.sh
PreToolUseBashbash "$CLAUDE_PROJECT_DIR"/.claude/hooks/prod-guard.sh
PreToolUseBashbash "$CLAUDE_PROJECT_DIR"/.claude/hooks/action-budget.sh
PostToolUseBash|Edit|Write|MultiEdit|NotebookEditbash "$CLAUDE_PROJECT_DIR"/.claude/hooks/audit-log.sh
Notificationpermission_promptbash "$CLAUDE_PROJECT_DIR"/.claude/hooks/notify-oncall.sh

Permissions

deny (8)
Read(./.env)
Read(./.env.*)
Read(./secrets/**)
Read(**/*.pem)
Read(**/*.tfstate)
Bash(git push --force *)
Bash(git push * main)
Bash(terraform destroy *)
ask (2)
Bash(git push *)
Bash(gh pr create *)
allow (11)
Bash(npm test)
Bash(npm run test*)
Bash(npm run lint*)
Bash(git status)
Bash(git diff *)
Bash(git log *)
Bash(git switch -c agent/*)
Bash(kubectl get *)
Bash(kubectl describe *)
Bash(kubectl logs *)
Bash(bash scripts/test-hooks.sh)

Similar rigs

appleboy/skills
Agent Skills Collection
★ 23 collection Claude Code 7 skills 27d ago
Pragmatist 601 tok ·
az9713/youtube-transcript-to-skills
Extract Claude Code skills from AI workflow YouTube transcripts. 10 ready-to-use skills + a meta-skill that automates the extraction process. Built from John Kim's 50 Claude Code tips.
★ 0 project Claude Code 11 skills 8mo ago
Skill Collector 952 tok ·
Plaetorius/engineering-harness
Portable engineering workflows, architecture maps, role-aware reviews, and extensible packs for Codex and Claude Code.
★ 0 setup Codex 13 skills today
Skill Collector 1.3k tok ·
hunterinspanish07/dotfiles
Personal dotfiles - global Claude Code skills, slash commands & CLAUDE.md for the lit agent-native workflow
★ 0 setup Claude Code 13 skills 3d ago
Skill Collector 3.1k tok ·
copied ✓