The Operator Kit for Claude Code

How to stop Claude Code from sending email, posts and payments

A rule in CLAUDE.md is advice. A PreToolUse hook is a check that runs in code before the tool does. This guide covers the difference, what a gate can and cannot catch, and how to set one up.

Written by Kyle, who made the free send gate described here and also sells a paid kit built around it (the kit is optional and covered at the end). Independent project, not affiliated with Anthropic.

Why a prompt rule is not enough

"Always ask before sending" in your prompt or CLAUDE.md shapes what Claude tries to do. It does not change what Claude Code allows. If you run a mode that skips permission prompts, or you clicked "always allow" on a mail or chat tool, nothing outside the model's own judgment sits between a draft and a send.

What a PreToolUse hook does

Claude Code runs PreToolUse hooks before the permission prompt, for tool calls. The hook receives the tool name and input as JSON on stdin. It can allow, ask, or deny. A hook that returns permissionDecision: "deny", or exits with code 2, stops the call. Because the check is code, the model cannot talk its way past it.

Does it work in bypass permissions mode?

Yes for a deny. Anthropic's hooks guide says a hook that returns permissionDecision: "deny" blocks the tool even in bypassPermissions mode or with --dangerously-skip-permissions, because PreToolUse hooks fire before any permission-mode check. I ran it once to see: on 2026-10-25, Claude Code 2.1.310 headless with --dangerously-skip-permissions, a gated command was denied. That was one version on one machine, not the interactive screen. Run the check below in your own setup.

What turns it off: settings that disable hooks (disableAllHooks, or starting Claude Code with --bare), and an edit to your settings.json made outside Claude Code. The gate blocks Claude's own Edit, Write and shell writes to that file.

A gate for sends, posts and payments

The claude-code-send-gate repo (MIT, Node 20+, no dependencies, 156 tests) is a hook that decides one thing: does this call reach a person or move money?

• MCP tools with a send, reply, forward, publish, post, pay, refund, invoice or similar word in the name, unless a read word (list, get, search) comes first. send_email is blocked. create_draft and list_sent_messages pass.
• Shell commands whose program is a sender: local mailers, osascript sends, gh writes, and curl, python or node calls that POST to known mail, chat, SMS, CRM, accounting or payment hosts.
• Browser scripts that click a Send, Post, Publish, Pay, Buy or Checkout button.

When it blocks something it tells Claude to show you the exact text and recipient and to ask for your yes. You approve in your own terminal, not through Claude:

node ~/.claude/bin/approve-send.mjs --match jane@example.com "invoice reminder"

The script shows what you are approving and a random 4-digit code, and writes a single-use token only if you type the code. The token expires after 180 seconds by default and fits one call. Claude's shell has no terminal to type into, so it cannot do this step. Away mode (away-mode.mjs on) blocks every gated call, approved or not, until you turn it off in your own terminal.

Install and check it

git clone https://github.com/Kylefrc/claude-code-send-gate && cd claude-code-send-gate
node install-gate.mjs --dry-run     # shows what it will change; changes nothing
node install-gate.mjs && node tests/test-send-gate.mjs

The installer backs up settings.json, adds one PreToolUse entry, and does not overwrite files that differ unless you pass --force. Start a new session, run /hooks to confirm it is listed, then ask Claude to send a test message through one of your own mail or chat tools. It should be blocked. Approve it properly and watch it go through once. Do this before you rely on it.

What it cannot see

• A plain mouse click on a Send button through a computer-use or click-by-element tool.
• APIs on hosts that are not in its list (you can add hosts in a config file) and MCP tools with unusual names.
• git push, package publishes and deploys, unless you turn those patterns on.
• Approval is a typed code, not a sandbox. A process that can open its own pseudo-terminal could type it, and the hook's text guard can be dodged. It is a safeguard against mistakes and over-eager automation.
• If the hook cannot read its own input, it lets the call through so a bad payload does not break your session.

Tested on macOS only. On Windows use WSL; Linux should behave the same but I have not run it there.

Common questions

How do I stop Claude Code from sending email without asking?

Put a deny in front of the send tool, in code. A PreToolUse hook that denies mail-sending tools until you approve is the supported hook point for that. Drafting stays allowed.

Can Claude approve its own send?

Not through its own shell, which has no terminal for the code. See the limits above for what a determined process could still do.

Will it block drafts?

No. Drafts save without sending, so tools like create_draft pass.

Can I add my own tools and hosts?

Yes. ~/.claude/send-gate.json takes extraGatedTools, allowTools, extraHosts, extraShellPatterns and tokenTtlSeconds.

The free gate and the paid kit

The gate is free. I also sell The Operator Kit for Claude Code for USD 19: seven rule packs that extend the gate to common business tools, a CLAUDE.md template, a memory system, two skills and a PDF playbook. The gate is complete without it.