Your AI agent just broke production.
It didn't know.

mati gives you deterministic guardrails for AI coding agents. It blocks Claude Code from reading or editing critical files, and Codex from patch-editing them, until they've consulted the per-file constraints ("gotchas") that protect them, and records every enforcement decision in a tamper-evident local audit trail. mati runs on-prem with zero network calls and works without any LLM calls.

mati intercepts file reads at the hook level and denies access until the agent consults the verified knowledge record for that file. For example, before editing a payments file the agent must acknowledge a constraint such as keeping an idempotency check that was added after a fraud incident, so it cannot silently remove safeguards.

The read gate is the lightest option. mati can also seal a file (chmod 000, unreadable to every process until it is consulted), compile crown-jewel rules into OS-level Seatbelt or bubblewrap sandbox deny rules that block the shell and every subprocess it spawns, and guard a sensitive path or a destructive command like rm or terraform destroy behind a required consult with mati protect and mati guard. You choose how hard each file pushes back.

Yes. mati policy add authors trigger-then-consult rules that fire on file paths or shell commands, with a shadow mode to observe before you enforce. It is local and needs no license. The org-wide signed policy floor that governs a whole team, across files, commands, and network egress, is the Enterprise layer.

No. Everything runs locally. No network calls, no telemetry. That's the point for teams handling HIPAA or other compliance-scoped code.

Memory and ADRs are passive. Nothing stops an agent from ignoring them. mati hard-blocks the read until the agent proves it consulted the rule, produces an audit trail, and scores each gotcha by confidence. Enforcement, not documentation.

Apache 2.0. The enforcement engine, import resolution, and local audit log are free with no feature gates. Paid plans add signed audit export and governance for teams.

mati enforces at the hook level with Claude Code and Codex (mati hooks --claude or --codex), so it intercepts file operations before the agent acts. It also exposes its knowledge to any MCP client via mati serve (MCP over stdio). One honest gap: Claude Code's native read tool is gated, but Codex has no read hook, so mati gates its shell reads and apply_patch edits instead.

A gotcha is a confirmed, structured rule attached to a specific file: what an agent must do or avoid there, like "never remove the idempotency key." When an agent touches a file that has a confirmed gotcha, mati's hook surfaces it and can block the operation until it has been consulted.

No, and not always by you. On mati init, the Layer 0 scan proposes candidates from your code and git history with zero LLM calls: tree-sitter parsing, the import graph, and co-change clusters. mati suggest imports more from your CODEOWNERS file and inline markers. You can also just tell your agent to capture one as you work ("add a gotcha to charges.rs: never drop the idempotency key") and it records the rule with mati gotcha add. You confirm what matters instead of writing from a blank page, and confirmed gotchas activate hook enforcement.

Every actor independently. When your agent spawns subagents, each one must consult a file's gotcha before it can read or edit that file. A subagent can't coast on what the main thread already read. On Enterprise, the signed audit attributes each consultation to the actor that made it.