Check is an anti-hallucination layer for AI agents. Before the AI runs a command or writes a file, your actual machine checks it. No changes to your project, one install.
Claude Code writes commands from what it learned in training. It can look at your machine, but only when it decides to, and usually it doesn't: it assumes what is installed, which paths exist and which flags your tools accept. When it assumes wrong, it is just as confident.
The AI rarely checks whether a tool exists before running it. If the name sounds plausible, it runs it.
The AI often references paths without reading your file system. It infers them from convention.
The AI rarely verifies flags or syntax against your OS. It uses whatever it has seen most often in training.
When a command fails, the AI often tries another guess. With the same confidence.
Everything downstream of a guess is a guess. If the first command is fabricated, the reasoning that follows it is built on a fabrication.
The model is not lying. It is not checking. These are not the same problem, but they produce the same result.
Check is an anti-hallucination layer for AI agents. Before the AI acts, your machine checks what it is about to do. Its hooks are added to each supported AI coding agent's settings. Nothing is added to your project. Nothing is modified in your codebase.
Before a command runs, your own bash steps through it without executing anything and reports exactly which programs it would call. PowerShell commands are read by PowerShell's own parser. Because your shell does the reading, Check never mistakes a word inside a string or a comment for a program.
Without Check: the AI works from memory. It has seen thousands of machines in training. It does not know which one is yours.
With Check: your machine confirms the programs, scripts, git branches and packages the command relies on, wherever it can give a definite answer. Where it can't give a definite answer, Check lets the command through rather than guess.
We replayed 7,366 real commands from 68 of our own Claude Code sessions, on one Windows machine. Claude had tried to run a program that wasn't installed 17 separate times, in 11 of the 68 sessions: about one session in six. The gate blocked every one of them and nothing that exists; each was confirmed missing by four independent checks on the machine. The previous version, which interpreted commands with its own model of bash, had also blocked 18 perfectly good ones; letting the machine read the commands removed all 18.
We also gave paired sessions of Claude Haiku 4.5, Opus 5.5 and Sonnet 4.5 the same prompts (13, 12 and 11 of them), one session with Check and one without. Every session without Check fixed a bug by deleting or replacing the user's file; no session with Check did. In those runs the gate blocked nothing: the difference came from a standing rule the earlier version of Check placed in front of every prompt, which Check no longer has. The gate on its own has not yet been measured this way.
Before any command executes, Check verifies it against your actual system. If a program it calls isn't installed, the command doesn't run, and the AI is shown your machine's exact answer, so its next attempt is a correction instead of another guess.
The gate is deterministic. A program is either installed or it isn't. There is no probability and no model judgment involved, and on the same machine, in the same state, the same command gets the same verdict.
Intelligence makes models smarter. It does not make them trustworthy. What makes them trustworthy is a second check that the model does not perform itself.
Commands that call a tool your machine doesn't have, including the ones the AI assumes are there because they usually are, like jq, pkill or rg. Also inside $(...), backticks and bash -c, and after || or else.
A ./script that isn't in the folder, or a git branch, tag, commit or subcommand that your repository doesn't have.
Install commands are checked against the package registries (npm, PyPI, crates.io, RubyGems, Packagist, NuGet, Homebrew, Chocolatey and the PowerShell Gallery), so a package name the AI invented is stopped before anything is installed. The version asked for is checked too, and so is a package npx, pnpm dlx, bunx, uvx or pipx run would download and run, a Docker image or tag being pulled, a package a JavaScript or TypeScript file starts importing, and the module python -m would run.
Before a delete runs, Check works out which folder the shell would really remove, quotes and ~ included, and stops it if that is a whole drive, your home folder or anything above it, a system folder, or a folder above your project. This is how AI agents have wiped drives on Windows: a path quoted for one shell and passed through another, so rmdir receives \, the root of the drive. Ordinary deletes, inside your project or anywhere else, go ahead.
Before a folder is copied, Check measures how much it would write and how much space the destination has. A copy that would fill the disk and fail partway is stopped, with both numbers.
Shell, Python, PowerShell and JavaScript files, and package.json, are parsed on your machine before they're written, and so is code passed to node -e or python -c, or fed to node or python - through a heredoc, before it runs. JavaScript is judged by Node's own parser: .mjs and .cjs files always, and an existing .js file that parsed before, when an edit breaks it in a way no dialect explains, such as an unclosed bracket. A brand-new .js file is not judged, because JSX, Flow and bundler code are written as .js and Node can't read them. Files written with a heredoc, echo or printf are checked the same way. A TypeScript write that uses a function, method, export or option a library doesn't have is stopped too: the project's own TypeScript decides, against the library's own type definitions.
These are stated here because they are true.
If a hallucinated command name happens to correspond to an installed tool, the gate will pass it. The name is real. The intent is not.
A command can exist, have correct syntax, and still do the wrong thing. rm -rf on a real folder in your project is a real command, and Check lets it run: it does not judge intent. It stops a delete only when the folder that would really go is a drive, your home folder or above it, a system folder, or a folder above your project.
The gate operates on commands and file writes. If the AI produces a wrong answer in conversation that never becomes a command or a file, the gate does not see it.
Commands run through eval, env, xargs, sudo or a login shell; anything after a command changes folder or installs something; a script an earlier part of the same command may have made; a missing file a program only reads, like cat notes.txt; files written by echo or printf in more complex forms; and PowerShell commands that load a module, define a function or alias, or test for the program themselves. In each case Check lets the action through rather than guess.
Check is not a security tool. It verifies existence, not safety. You still need one.
Current installs never send your prompts. Before each command, Check sends the command text with some credential patterns redacted (not all: a secret in a PowerShell variable assignment is sent as written), plus the working folder with your username masked and the results of the checks your machine ran. File contents are not sent: file writes are parsed on your machine, and Check sends the file's name, size and whether it exists, plus the parser's one-line error message if it rejects the file, which can quote the word it stopped at, and for JavaScript or TypeScript the names of npm packages a write starts importing that aren't installed or declared in the project. Installs made before 24 September 2026 still send each prompt to an endpoint we retired that day; it discards the prompt unread, stores nothing and charges nothing. Reinstalling Check stops it being sent.
The text of your messages and the contents of your files never reach the server. It keeps your balance and payment history, usage and rate-limit counters, a record of each check (time, a one-way hash of your key, your network address, Check's version, the AI tool and the verdict), and account events such as install and top-up. For keys created from 14 October 2026, it also keeps improvement records by default: the command your AI was about to run (with credentials removed), the name of a file it was about to write, and the reason Check gave. You can switch them off at any time in the console; older keys have them off. The full list is in our privacy policy.
Command validation runs on the server. The two hook scripts, and the file checks, run on your machine in ~/.check. This is a trade-off: you are trusting the server with command strings in exchange for validation logic that is not published.
Earlier tests, and what they measured.
Withdrawn. The paired runs above replace it.
We had the AI score its own sessions. It concluded: no effect.
That study measured the prompt hook Check had then, at one run per arm, not the gate.
It also shows why a model is a poor judge of its own tools: the AI scored sessions it had taken part in.
The result is published, with its declared biases and pre-registered falsifiers.
14 days free, from the moment you create your GOL API Key at the console. Every check inside a message is included (a message covers up to 500 checks and 12 hours). No card. Nothing to cancel.
After 14 days: US$0.02 per message, never raised. Prepaid balance. No subscription. No auto-recharge. When your balance hits zero, Check fails open: commands run with a warning, so your balance never blocks your agent.
Windows or Linux, with an AI coding agent. Which agents: the guide.
npx @golproductions/check@latest --install
It needs Node.js 18 or newer: if you don't have it, install it from nodejs.org first.
It adds Check's hooks to every supported AI coding agent it finds, keeping your own hooks, and creates ~/.check with the hook script, using your GOL API Key, which it asks you for the first time (paste it yourself, never through your AI). Nothing goes into your project. The gate keeps itself current, checking for updates in the background at most once an hour; re-run the install only to update the installer itself.