Judge AI Dredd
loading...| Time | Session | Task | Turns | Tools | Denied | Files | Classification | Mode |
|---|---|---|---|---|---|---|---|---|
| No sessions yet | ||||||||
Connect your Claude Code CLI to this judge
Download the bundle below and follow the three steps. Every tool call your agent makes will be evaluated by this judge server before it runs.
New hook versions ship from this same server. To pull the latest
hook, re-fetch it and restart Claude Code — no settings
change needed, because your settings.json
already points at the stable path
~/.claude/dredd/dredd-hook.sh. This overwrites
only the hook script; your API key,
settings.json, and project config are untouched. The
fetch is idempotent and is how every future hook update lands.
curl -fsSL -H "Authorization: Bearer $(cat ~/.claude/dredd/api-key)" \
{BASE}/api/hook-script -o ~/.claude/dredd/dredd-hook.sh
chmod 755 ~/.claude/dredd/dredd-hook.sh
# then restart any running Claude Code sessions to pick it up
Re-downloading the full bundle below also upgrades the hook and
additionally refreshes settings.json and the
working-with-dredd-judge skill (the re-fetch above
updates only the hook). Server-side improvements (judge, policy)
need no client action — they land when the hook server is
redeployed.
Download the install prompt below and pipe it into a Claude Code
session — Claude will describe each step, ask permission, and
walk through the install one file at a time. Scoped to
~/.claude/dredd/ and ~/.claude/settings.json
only; everything else is out of bounds.
~/.claude/dredd/claude-install-prompt.txt
mkdir -p ~/.claude/dredd
mv ~/Downloads/claude-install-prompt.txt ~/.claude/dredd/
claude < ~/.claude/dredd/claude-install-prompt.txtInstall manually
The bundle is a zip containing dredd-hook.sh,
settings.json, README.md,
claude-install-prompt.txt, and the
working-with-dredd-judge Claude Code skill (under
skills/ — teaches the agent to navigate Dredd
denies transparently and avoid the session-lock strike counter).
The hook script has this server's URL baked in. To install the
skill after extracting:
cp -r /tmp/dredd/skills/working-with-dredd-judge ~/.claude/skills/.
1. Generate & install your API key
The hook server requires a Bearer key on every request — without
one, /intent and /evaluate return
401 and Dredd silently falls back to allowing
everything. Open the
API Keys tab,
click Generate key, then run the snippet shown in
the plaintext banner. The hook script reads from
~/.claude/dredd/api-key by default; override with
$DREDD_API_KEY_FILE if you keep it elsewhere.
2. Install the hook
unzip judge-dredd-integration.zip -d /tmp/dredd
mkdir -p ~/.claude/dredd
cp /tmp/dredd/dredd-hook.sh ~/.claude/dredd/
chmod +x ~/.claude/dredd/dredd-hook.sh3. Wire up the hooks
Applies to every Claude Code session you start. The snippet below
only copies the bundled settings file if
~/.claude/settings.json doesn't already exist;
otherwise it tells you to merge the hooks and
env sections manually.
mkdir -p ~/.claude
if [ -e ~/.claude/settings.json ]; then
echo "~/.claude/settings.json already exists — merge the hooks and env sections from /tmp/dredd/settings.json manually"
else
cp /tmp/dredd/settings.json ~/.claude/settings.json
fi
Applies only to Claude Code sessions started inside the specified
project directory. Useful when you want to guard one codebase
without touching your global config. Project settings override
globals; commit .claude/settings.json to share the
integration with your team, or use settings.local.json
(git-ignored by default) to keep it local.
cd /path/to/your/project
mkdir -p .claude
if [ -e .claude/settings.json ]; then
echo ".claude/settings.json already exists — merge the hooks and env sections from /tmp/dredd/settings.json manually"
else
cp /tmp/dredd/settings.json .claude/settings.json
fi
The check above stops the copy from clobbering an existing file;
if it prints the warning, open both files and merge the
hooks and env sections from
/tmp/dredd/settings.json into your existing one.
The hook script honours $DREDD_URL at runtime, so you
can point a single install at different judge servers by exporting
the variable before launching Claude Code — handy when a project's
.envrc / direnv setup should override the
default.
4. Verify
Start a Claude Code session in any project. Return to this dashboard's
Overview tab — your session should appear in the Live Feed the moment
you send your first prompt. The snippet below exercises the
Bearer-key auth path; /api/health answers without auth,
so it would lie to you if you used it here.
# Confirm the key is set up correctly (returns your identity on success):
curl -H "Authorization: Bearer $(cat ~/.claude/dredd/api-key)" \
{BASE}/api/auth-check
# Expected: HTTP 200 with {"authenticated":true,"ownerEmail":"…"}
# A 401 means the key file is missing, malformed, or revoked.Prerequisites
curlandjqon your PATH (both preinstalled on macOS and most Linux distros).- Claude Code CLI with hook support.
Disable the hook
Need to turn the judge off temporarily — e.g. because a stale reconstructed goal is over-blocking, or you're debugging a false positive? Pick the scope that matches how you installed it.
Remove the hook block from ~/.claude/settings.json.
The simplest reversible option is to move the file aside:
mv ~/.claude/settings.json ~/.claude/settings.json.dredd-off
# re-enable with: mv ~/.claude/settings.json.dredd-off ~/.claude/settings.json
If that file contains unrelated settings you want to keep, delete
just the hooks and env.DREDD_URL keys
instead of moving the whole file.
Drop the hook inside one project directory:
cd /path/to/your/project
mv .claude/settings.json .claude/settings.json.dredd-off
# re-enable with: mv .claude/settings.json.dredd-off .claude/settings.json
Keep the hook installed but bypass it for a single Claude Code
launch — useful when you're about to do something the judge
doesn't understand and you don't want to edit settings files.
Point DREDD_URL at an unreachable address so the
hook's health-check probe fails fast and fails open:
DREDD_URL=http://127.0.0.1:1 claude
The hook script fails open when the server is unreachable — it
returns permissionDecision: "ask" for
PreToolUse and empty responses for every other event,
so Claude Code behaves as if no hook were installed (except for
the brief connect timeout per event).
API Keys
Hook-side authentication keys. Each one is tied to your Clerk identity. Hook traffic carrying one of your keys shows up in your sessions list; revoking a key drops it off the dashboard immediately and stops the hook from being able to reach the judge.
| Key | Description | Owner | Created | Last used | |
|---|---|---|---|---|---|
| No keys yet | |||||
Approvals
Tool calls you've previously approved at an "ask" prompt. The
same tool with the same shape (e.g. curl to the
same host with the same API key, or Edit on the
same file) won't re-prompt for 30 days from the last use.
Revoke any entry to force re-consent next time.
| Tool | Target (host) | Credential | Owner | Project root | Uses | Last used | Expires | |
|---|---|---|---|---|---|---|---|---|
| No approvals yet | ||||||||
Select a log file to view
Bring Your Own Token (Bedrock)
Supply your own Amazon Bedrock API key. When configured, the judge, classifier, and embedding calls for your sessions run on your AWS account. The token is validated against your selected region and stored encrypted — it is never shown again after saving.
Admin — set a token for another user
Select a user and configure their Bedrock token on their behalf. The user is shown that an administrator set it.
Trust mode — skip the judge for a user
Mark a user as trusted so their tool calls skip the LLM judge (and the drift embedding) to save Bedrock cost. Deterministic guardrails (rm -rf, dangerous combinations, and the user's own deny list) still block. Applies to every project the user runs. Enforced only when DREDD_TRUST_MODE_ENABLED is set on the hook container.