How do I verify Claude Code actions with Provely?

Claude Code connects to Provely through the MCP server, the CLI, the REST API. The agent does the action. Provely verifies the outcome and signs a receipt. Claude Code never holds the verifier credentials.

Which surfaces does Claude Code use?

Which guidance files does Claude Code read?

Provely ships one Agent Skill for this host, so the agent knows to verify an outcome before it claims done. The renderer writes Agent Skills SKILL.md, CLAUDE.md fragment from one source. A new agent needs a profile, not core code.

How is a false completion claim blocked?

Guidance asks. A hook and the CI gate enforce. A host with neither still receives the verdict, and a person reads it before the work ships.

How do I connect Claude Code?

What else does the profile state?

• Verified 2026-09-08 against Claude Code 2.1.263: the host loaded the appended CLAUDE.md block, listed the skill provely-outcome-verification from .claude/skills/, connected the .mcp.json server, and ran both hooks. Read packages/integrations/test/claude-code-host.test.ts.
• Verified 2026-09-09: PreToolUse runs before the tool call and blocks it. The hook answers hookSpecificOutput.permissionDecision deny, and permissionDecisionReason reaches the agent. Source: https://code.claude.com/docs/en/hooks.
• Verified 2026-09-09: a PreToolUse matcher is a regular expression, and mcp__.* matches every MCP tool. The default timeout is 600 seconds, so the snippet states 10. Source: https://code.claude.com/docs/en/hooks.
• Verified 2026-09-12 against Claude Code 2.1.170: the host states 30 hook events, and this profile names all 30. The list comes from the host itself, and not from a memory of a list.
• Verified 2026-09-12: the earlier count of 33 was wrong. It named DirectoryAdded, PreModelSwitch and PostModelSwitch, and the host states none of the three. Read docs/reports/session-registration.md.
• Verified 2026-09-09: the host fails open by itself. A hook that times out, and a hook command that does not start, both let the tool call proceed. Source: https://code.claude.com/docs/en/hooks.
• The PreToolUse hook is the one point that stops a call before the provider sees it. It reads the confirmed plan of PROVELY_CONFIRMATION_ID, and it refuses a tool that the plan does not name.
• A call outside the confirmed plan is always refused. The guard posture of the organization decides the outage case only, and it holds the words fail_open and fail_closed.
• The hook reads the posture from .provely/guard/posture, because an outage stops the control plane from stating it. provely guard check --posture-cache writes the word on each answer.
• Fail closed needs one good read on each machine. A machine that never reached the control plane holds no word, and it runs the call under fail open. A fresh checkout and a new CI runner both start there.
• Verified 2026-09-05: hook events PostToolUse and Stop; exit 2 blocks a Stop and returns stderr to the agent; PostToolUse returns hookSpecificOutput.additionalContext. Source: https://code.claude.com/docs/en/hooks.
• Verified 2026-09-05: hooks live in .claude/settings.json, .claude/settings.local.json, or ~/.claude/settings.json. The Stop input carries stop_hook_active. Claude Code ends the turn after 8 consecutive blocks. Source: https://code.claude.com/docs/en/hooks.md.
• Verified 2026-09-05: skills live in .claude/skills/<name>/SKILL.md and MCP servers in .mcp.json. Source: https://code.claude.com/docs/en (skills, mcp).
• Register the three hook scripts by hand with the snippet in .provely/hooks/claude-settings.md. init writes no .claude/settings.json, so enforcement stays off until a person merges the snippet.
• The host holds a .mcp.json server at "Pending approval" until a person accepts it or a settings file lists it in enabledMcpjsonServers. The snippet states the key.
• The hooks fail open on an outage. A control plane that does not answer turns enforcement off, and the hook prints the reason in a systemMessage. Read the guard case in claude-code-host.test.ts. The PreToolUse hook fails closed on a refusal: a call outside the confirmed plan is denied.
• The hooks see only operations that called begin, and the open list holds every operation of the account. An action that never opened an operation is invisible to them. The scanner and the CI gate cover that case.
• Headless runs (claude -p) use the CI gate in .provely/ci/github-actions.yml like every other pipeline.
• Verified 2026-09-12: the host emits 33 hook events. This profile names the 11 that this repository drives. The other 22 are read about and not exercised, so they stay out of this list. Source: https://code.claude.com/docs/en/hooks.md, read 2026-09-12.
• Verified 2026-09-12: SessionStart, UserPromptSubmit, PostToolUseFailure, PermissionDenied, PreCompact, SubagentStart, SubagentStop and SessionEnd all exist, and every payload carries session_id. Source: https://code.claude.com/docs/en/hooks.md, read 2026-09-12.
• The dogfood hooks were driven with those eight payloads on 2026-09-12. A live run opened a session, recorded a prompt and two tool calls, and ended the session on the control plane. Read docs/reports/session-registration.md.
• The host itself was observed to fire PreToolUse and PostToolUse only. Read the note of 2026-09-08. The nine other events rest on the published reference and on a driven run of the hook scripts. Treat them as documented, and not as observed.
• Observe each documented event against the installed binary before a customer surface depends on it. A driven run proves that our hook reads the payload. It does not prove that the host sends one.
• Verified 2026-09-12: a subagent runs the configured hooks, and every payload inside a subagent carries agent_id and agent_type. A tool call of a subagent is attributable to that subagent. Source: https://code.claude.com/docs/en/hooks.md, read 2026-09-12.
• Verified 2026-09-12: Stop fires after every answer of the agent, many times in one run. A hook must never end a session there. That would state that the run was over after the first answer. SessionEnd fires once, when the run is over.
• Verified 2026-09-12: SessionEnd cannot block, exit code 2 is not honoured there, and its stdout is discarded. Its hooks share a budget of 1.5 seconds, and a longer per-hook timeout raises that budget. Source: https://code.claude.com/docs/en/hooks.md.
• Verified 2026-09-12: a matcher of an asterisk, an empty string, or no matcher at all fires on every occurrence of the event. Any character outside letters, digits and separators makes the matcher a JavaScript regular expression.
• The templates render three hooks: pre_tool_use, post_tool_use and stop. The eight other events are driven by the dogfood hooks under scripts/dogfood/claude-hooks/. Do not read the event list as the set of files that init writes.
• The profile holds one support value for the whole hooks capability, and none for one event. A page that must separate an observed event from a documented one reads these notes. A support value for each event would make that distinction data.

Claude Code keeps its action credentials, and no surface returns the verifier credentials to it. Read the credential boundary. An operation outlives the session that opened it. Read the API reference.