Rules, guardrails, skills and MCP config — written once, compiled for thirteen agents, and delivered to every repository as a pull request you review.
How it works
Nothing runs at execution time. A rule travels as a file, through a review, into the agent that was going to read that file anyway — and the last step is the part nobody else gives you: a measured answer to what is running where.
The problem
Teams copy-paste instructions between tools and the copies drift. And the instruction that matters most — what an agent may run, read and edit — is usually not written down anywhere at all.
Claude Code
Edited last week. Has the new error-handling rule.
the source of truth, unofficially
Codex
Pasted across in July, then edited separately.
4 rules behind
Cursor
Split into per-rule files by hand. Twice, by two people.
1 duplicate, 2 stale
GitHub Copilot
Added when the repository was created. Never revisited.
last touched 6 months ago
+ nine more agents, each with its own file
Which rules is this repository actually running?
Who approved the skill that agent just loaded?
What is that agent allowed to run on a developer’s machine?
Safety
A guardrail says what an agent must never do, must ask about first, or may do without asking — over shell commands, the files it reads, the files it edits, and the MCP servers it connects to.
Guardrails on this ruleset
9 presets| Action | Applies to | Pattern | Claude Code | Cursor CLI | Cursor IDE | Gemini CLI |
|---|---|---|---|---|---|---|
| never | reads a file | **/.env | · | |||
| never | runs a command | git push --force* | · | |||
| never | runs a command | sudo * | · | |||
| ask first | runs a command | terraform apply* | · | |||
| ask first | edits a file | .github/workflows/** | · | |||
| allow | MCP server | aidoscope |
Those files usually hold your own entries. Aidoscope adds its own beside them and, on the next deploy, removes only the ones it added. A settings file that is not plain JSON is left alone, and the deploy says why.
The same hook that reports what agents do refuses a denied command locally, so enforcement never waits on the network — and never depends on an agent choosing to comply.
secrets masked before anything leaves the laptop
Instruction overrides, safety bypasses, exfiltration, decode-then-execute and hidden text, each finding linked to the line it names. A heuristic, and the product says so.
agents propose · owners approve · no agent deploys
Generated regions carry a marker. A file without one is reported as a conflict you confirm first, and the sections a ruleset does not cover are carried through untouched.
checked in the API, not only in the UI
Control
Add an agent to a ruleset and its files appear in the next deploy. Nothing is re-entered by hand, and nothing is left to whoever set up that repository last year.
A managed policy can make a repository’s own skills, commands, subagents, hooks and MCP config invisible. Paste yours — it is read in your browser, nothing uploaded — and Aidoscope names exactly what it switches off, builds the policy file for Claude Code, Codex and Gemini CLI, and lists what a policy cannot express rather than approximating it.
Health checks are a real JSON-RPC handshake, not a ping. Deploy server config merged into what is already there, or route a server through Aidoscope with a tool policy and a credential nobody’s laptop holds.
Subagents, commands and hooks written once, delivered in each agent’s own format. Skills import at a pinned commit, scanned before you adopt them.
An organisation marketplace that still reaches Claude Code when a managed policy ignores the repository’s own files.
Owner, admin and member roles. Teams that group people and repositories, so a ruleset can be aimed at one. Single sign-on through OIDC, SCIM provisioning, and API keys for CI.
An append-only audit trail of every change and every deploy — which ruleset version went where, as which pull request. Filterable, exportable to CSV, and the same source the Slack and Teams updates come from, so the channel and the log cannot disagree.
The library
A few dozen that hold whatever you build, and the rest that only hold on one stack — the mechanical ones that actually change what an agent writes.
Some advice inverts at a release. Pick a version and watch which rules apply.
stack selectionangular:22a bare stack shows every version’s rules
Two rules with disjoint version ranges, never one with a caveat — so no version can ever be handed both.
Log identifiers, not identities. A user id, order id or request id lets someone follow an event; an email address, name, phone number, postal address, IP address or free-text field turns every log line into personal data that now needs a retention period, access control and a place in the erasure process. Never log passwords, tokens, session cookies, API keys or card numbers.
Rests on
OWASP Top 10 2025OWASP Cheat SheetsCWEGDPRePrivacyPCI DSSRFC 9457WCAG 2.2 AACore Web Vitals
Security and privacy rules carry the article or requirement they rest on. “Keep pull requests small” is unenforceable; a threshold is not.
Coverage per stack is enforced, not aspirational: every stack carries at least twelve rules. And once rules are running, rule health tells you which have stopped earning their place.
Security and data handling
Aidoscope runs no model inference. The compilers are pure functions: the same rules always produce the same files, and you can read them before they ship.
Nothing is sent to a model. The compilers are deterministic, so a preview and a deploy cannot disagree.
Git credentials are encrypted with AES-256-GCM. Session, invitation and agent tokens are stored only as hashes.
Each agent token is bound to the one resource it was issued for. Every live connection is listed with who approved it.
Everything is scoped to an organisation: one guard resolves the session, the other checks the role.
Removing a member ends their sessions and revokes their agent grants in the same transaction.
Only the fields you choose, secrets masked on the machine. Prompts are off by default and need their own confirmation.
Aidoscope names all nine SOC 2 Common Criteria, says which of them it observes and which are outside the product entirely, and exports the audit trail for a period with each row tagged by the criteria it bears on.
It deliberately shows no score. SOC 2 is an auditor’s opinion after an observation period — a page of green ticks would read as readiness, and it would be wrong.
There is no SOC 2 report and no ISO certification yet, and nothing here implies one. Repository contents are read to compile and compare, and imported skills are stored: we will not tell you we never see your code.
Common Criteria
Exportable for any period, as CSV.
Pricing
Every plan is quoted for your organization and counted per contributing developer: a person with a commit in the last 90 days to a repository an Aidoscope deploy has merged into. Not everyone with a login — one admin can deploy to everything — and not repositories, which a monorepo makes meaningless.
For a team putting its rules everywhere it works.
Priced for your organization
Includes
For organizations that need control and proof.
Priced for your organization
Everything in Team, plus
For large organizations with their own requirements.
Priced for your organization
Everything in Business, plus
Bots are never counted
Dependabot, GitHub Actions and the agents’ own commit identities are excluded before anyone is counted.
Nothing stores a name
A contributor is a hash of the commit author plus a repository and two dates. That is the whole record.
Checked before you pay
The billing page shows the count repository by repository before anything is charged.
