Teach your agents the house rules.
Your team has a way of doing things. How a page gets made, what a ticket needs, how a bucket is set up. paws puts those rules where an AI coding agent can’t miss them, and checks them before every action.
npx paws init- agent$ aws s3 mb s3://acme-exports
- pawsHold on. Buckets need tags here.Load skill aws-tagging-standards, then retry.
- skillaws-tagging-standards loaded
- retry$ aws s3 mb s3://acme-exportsOwner=data-engEnv=prodpublic access: blocked
- doneBucket created.
Claude CodeSupported now
CursorComing next
ClineComing nextYour agents reach for everything.
Docs, tickets, cloud, code, chat, secrets. Each one has a way it is supposed to be done on your team. paws holds the rule for each, and checks it at the moment the agent reaches.
Rules that stick, not suggestions that drift.
You can write instructions in CLAUDE.md and the agent will mostly follow them. Mostly is fine for formatting. It is not fine for a production bucket or a customer-facing page. paws checks the rule before the action, every single time.
Creating a Confluence page
It uses the team template and lands under the right parent. No orphan pages.
before: confluence.create_page
Filing a ticket
Priority, owner and component are filled in before the ticket exists.
before: linear.create_issue
Creating an S3 bucket
It is tagged, private, and named to convention before the CLI runs.
before: aws s3 mb
How it works
Three steps. If you have ever used a git hook, you already know the model.
- 1
Write the rule
One Markdown file per rule in a .paws/ folder. The top says when it applies and what to do. The rest explains why, for whoever reads it next.
- 2
Run paws once
It turns your rules into the agent's own hooks. Nothing runs in the background, and the output is a file you can read and commit.
- 3
The agent checks before it acts
When it reaches for a matching action, the rule fires first. The agent is told what to load or fix, then tries again. Every time, not most times.
---
name: aws-tagging
event: pre-tool
matcher:
tool: Bash
command_regex: ^aws s3 mb
action:
type: require-skill
skill: aws-tagging-standards
deny_message: Buckets need tags here. Load aws-tagging-standards, then retry.
---
# AWS tagging
Every bucket carries Owner and Environment tags and
blocks public access. The skill explains how. This
hook makes sure it is read before the bucket exists.Why we built it
We kept writing the same instructions into CLAUDE.md and watching agents follow them most of the time. Most of the time is not good enough for a production bucket or a page a customer will read. A check that runs before the action is. So we built one, and we are giving it away.
paws is free, and it will stay that way. If your team adopts it, tell us which rules you wrote. They become the next presets.
Raj Srinivasan · Founder, Unbound
Start from a preset.
Most rules are the same across teams. Extend a published preset instead of writing from scratch. Unbound ships the first ten, with more on the way.
@paws/aws-taggingTags and locks down every new AWS resource
@paws/secret-scanStops commits that contain credentials
@paws/migration-safetyRequires the checklist before schema changes
@paws/confluence-pageTemplate and parent for every new page
@paws/ticket-fieldsRequired fields on every new ticket
@paws/dependency-vettingVets a package before it is added
One repo is easy. Two hundred is where Unbound comes in.
paws works on its own, forever, with no account. When you need the same rules across every repo, Unbound writes them once, ships them to every machine, and tells you when one drifts.