Docs menu

Install git and IDE enforcement hooks

Wire commit-msg validation and beforeShellExecution denials so raw git commit cannot bypass MCP.

What you will learn

  • Install commit-msg hook
  • Sync Cursor hooks denying raw git commit
  • Prove illegal messages fail

Prerequisites

Surface

Imports@tmrxjd/agent-governance-system/commit-msg
MCPcommit_validate · sentinel_status
CLIgit config core.hooksPath .githooks
Config.githooks/commit-msg · .cursor/hooks.json

What this feature does

Hooks close the gap between MCP policy and shell reality. `validateAgentCommitMessage` rejects schema-illegal messages; IDE hooks deny `git commit` unless issued through `commit_checkpoint` (TOWER_MCP_COMMIT=1).

Configuration

Wire these surfaces first: .githooks/commit-msg, .cursor/hooks.json.. Treat them as the contract agents must not invent around.

.githooks/commit-msg javascript
#!/usr/bin/env node
import { readFileSync } from 'node:fs'
import { validateAgentCommitMessage } from '@tmrxjd/agent-governance-system/commit-msg'
const msg = readFileSync(process.argv[2], 'utf8')
const result = validateAgentCommitMessage(msg)
if (!result.ok) {
  console.error(result.errors.join('\n'))
  process.exit(1)
}

How to call it

Call these MCP tools through your AGS / tower-gov host — commit_validate, sentinel_status.. Prefer scan/get before validate/diff, and enforce only when the change set is ready.

  1. Write commit-msg hook
  2. git config core.hooksPath .githooks
  3. Sync .cursor/hooks.json
  4. Reload IDE window
MCP: commit_validate json
{ "message": "status/checkpoint(demo): add helper\n\nStatus: checkpoint\n…" }

What success looks like

One-line commit messages are rejected by the hook

Raw agent git commit is denied by beforeShellExecution

commit_checkpoint still works when CAP and attestations pass

Common failure modes

core.hooksPath unset

Agent uses --no-verify

Stale hooks.json after package upgrade

Related reference

AGS documentation