The exact install we ran
This was tested from a fresh clone at commit be20a76a24e073270b95f6cd93993577412a7442 with Claude Code 2.1.220 and the published spend SDK 0.15.13.
The project-level .claude/settings.json points both Claude hook events at the local gate:
What the real run returned
For the cap test, the fixture used a five-cent session budget and a three-cent Bash estimate. These are the hook decisions and signed ledger records from that run.
Offline verification
The keypair and ledger stay in .agentguard/. AgentGuard is not a hosted control plane. Claude still sends the prompts you ask it to send to Anthropic; the guard itself receives none of them.
The honest limit
Claude Code does not give this hook exact token cost, so the hook charges a documented flat estimate by tool. It maps tools to capability metadata, but the current policy floor is read_only, so it does not refuse a generic read_only versus payment_execute mismatch. It can refuse configured destructive patterns before execution. That is useful enforcement, but it is not the same capability ceiling the SDK wrappers enforce.
We also could not run an authenticated model turn in this environment. The installed CLI returned Not logged in ยท Please run /login. The hook protocol, denial behavior, persistent spend store, signatures, and offline verifier were exercised directly.
- pre-tool enforcement
- yes
- spend source
- local estimate
- generic capability ceiling
- no
- signed offline receipts
- yes, 6 of 6 valid
The captured test names the Claude Code integration repository, but its external repository status was not checked in this local audit. For exact provider spend and a real capability tier, use a guarded provider client as shown in the OpenRouter post.