Mault LiteGovernance for AI coding agents, running entirely on your machine. Four agent roles hand work to one another, every action is checked against your rules before it runs, and each run ends with a report of what was denied. TypeScript projects, Claude Code. Installation Launch VS Code Quick Open ( Ctrl+P), paste the following command, and press enter.Copied to clipboard |
Mault LiteWhat Mault isMault is a governance layer for AI-assisted software development. It sits between coding agents and the codebase and enforces your engineering rules at four checkpoints: write time, commit time, in CI, and at the merge gate. Enforcement is deterministic. No model reviews the output of another model. A proposed action either satisfies the active policy set or it does not, and the same input produces the same decision every time. The unit of enforcement is the runtime hook. Hooks fire before an agent's tool call executes, evaluate the proposed action against policy, and return allow or deny. A denied write never reaches disk, so the codebase never holds the violation and no cleanup commit is needed. Agents cannot switch the hooks off, because the hooks run in the runtime rather than in a prompt the agent can argue with. Every allow and every deny is recorded, so a run produces an audit trail of what the agents attempted, not just what they shipped. What Lite isMault Lite is a test drive. It is a fraction of the product, scoped to one machine and one developer, and it exists so you can watch deterministic enforcement work on real code before deciding whether the full version belongs in your organization. Lite implements the first of the four checkpoints, write time, plus the commit-time gate on your local repository. It runs on TypeScript projects driven by Claude Code, with four of the eight agent roles, 23 runtime hooks, and the governance report at the end of a run. Everything else is the full version. CI enforcement, merge gate enforcement, the remaining agent roles, the other supported coding agents, the other supported languages, and every administrative control that distributes governance to a team. The console shows those behind padlocks rather than hiding them, and the complete list is at the bottom of this file.
Before you installLite is free and takes no credit card, but it does ask for an email address once, before the console opens. Your code and your agent runs stay on your machine. The exact list of what leaves is at the end of this file. What you need
Mault Lite governs TypeScript projects driven by Claude Code. It does not drive other coding agents, and it does not govern other languages. Both limits are listed in full below. Getting startedInstall the extension, then press Ctrl+` to open the Mault console in the bottom panel.
What Mault Lite includesFour of the eight agent roles. Planner, Orchestrator, Worker and Review. Each runs as its own Claude Code session with its own permissions and hands the work on when it finishes. You advance the chain one step at a time, so no run proceeds without your input. 23 runtime hooks. These do the enforcing. They fire before an agent writes a file, runs a command or ends a session. A denial means the action never happened, not that it happened and was reported afterward. An agent cannot turn them off, because the runtime enforces them rather than a prompt asking for them. They cover what agents get wrong when left alone: writing outside the area a task was scoped to, going over the file and line budget the task declared, creating a source file with no test, ending a session without recording what was done, and taking an action that belongs to a role other than the one running. Pre-commit hooks. Type checking, linting, a mock ratio ceiling, the tests related to what changed, and integrity checks on the hooks themselves. These run on your commits, not only the agents'. The governance report. Described below. Three console panels. Setup and Readiness, Agent Workflows, and Admin Configuration.
Everything above runs on your machine. The governance reportAt the end of a run you get a page that opens with three numbers: how many agent actions were checked, how many were denied before reaching disk, and how many violations reached your codebase anyway. Below that, every denial is grouped and explained in plain words: what the agent was trying to do, what stopped it, and what it was told instead. A run on the sample project typically produces a few hundred checks and a handful of denials.
You can save the report as a single self-contained HTML file and send it to someone. It is written to be read by a person who was not watching the run. What Mault Lite does not includeThese appear in the console behind padlocks. Not in Lite:
Also worth knowing:
The full versionThe full version runs eight agent roles across the nine supported coding agents and adds the two checkpoints Lite leaves out, enforcement in CI and enforcement at the merge gate. It governs TypeScript, Python and Java, and it lets an administrator author a policy set once and distribute it to every developer, so the rules are a property of the organization rather than of each machine. Enforcing at all four checkpoints reduces rework to near zero. Governed code runs a 0.18% revert rate, and teams see at least a 10x increase in pull request throughput, because that throughput is not spent undoing what the agents wrote. Both figures are internally measured, not third-party audited. What leaves your machineOnce, at signup. The email address you type, and whether you ticked the box asking for product news. It goes to Mault so that we know who is using Lite and can write to you about it. Nothing else. No code, no file names, no prompts, no agent transcripts, no governance reports, no crash reports. The hooks, the agent runs, the reports and the audit trail are files in your own repository, and you can read every one of them. Privacy Policy | Terms of Service LicenseThe extension is licensed under the Apache License, Version 2.0. Support |
