Three Claude Code subagents that build, audit and test — and can't claim work they didn't do.
Claude Code will tell you it checked something. Usually it did. Sometimes it didn't, and there's no way for you to tell the difference. CCAM's agents are built so the difference is visible: each one is restricted to what it can honestly do, every claim is tagged with how it was established, and every report ends with a list of what was not checked.
Version 0.4.1 — early. In daily use by its author. Windows-only. Guard behaviour is measured, not assumed: 179 test cases, all passing, on Windows PowerShell 5.1 and PowerShell 7 — see Guard test results. Read Limitations before relying on it.
You already use Claude Code. This is the part of it you're probably not using.
Claude Code lets you build subagents — specialised assistants with their own
instructions, their own tool access, and their own hard limits. Most people never
build one, because it means learning which settings exist, which tool names are
valid, why hook paths have to be absolute, and — the one that catches everyone —
that the description field is what decides whether your agent ever gets picked.
CCAM gives you three that are already built, and one that builds more.
You describe the assistant you want. AMA works out the rest: which tools it needs, what it must never touch, how many turns before it stops. It writes the definition file and gets it reviewed before calling it finished.
It marks every setting as STATED (you said it), DERIVED (the job required it) or
ASSUMED (it had to pick) — so you can see and correct every guess it made. Until a
reviewer has read the result, AMA calls it a draft and says so.
Changes an agent that already exists. You say which agent and what should change; OHUM makes the smallest edit, shows the old and new text side by side, and gets the result reviewed by FIM.
It can only edit <name>.md files in an agents directory. It cannot edit its own
definition or any guard script, so it cannot loosen the limits that make the other
agents trustworthy. Edits that do loosen an agent (adding Bash or Write, weakening
a hook, raising the turn cap) need your explicit yes first.
Guard test status. ohum-guard.ps1 passes its 26 cases on PowerShell 7.4.6 on
Linux. It has not been run on Windows PowerShell 5.1, which is what Claude Code uses.
Reads code and reports whether it is correct, functional, necessary, and in the right place. It cannot change anything — a guard blocks every command that would modify a file, a package, or git state.
Every claim carries one of three tags: EXECUTED (a command was run and this is its
real output), READ (this line was read), or UNVERIFIED (couldn't confirm it — and
here's what would). Every finding quotes the exact text and cites file:line. Every
report ends with NOT CHECKED: what wasn't examined, why, and the exact command
that would close the gap.
A short report on clean code is the correct output, not a lazy one.
Runs a project's test suite and reports the failures — name, error, location — with one summary line for everything that passed.
It has no ability to write files at all. That matters more than it sounds: told to make the tests pass, a general-purpose assistant can edit the failing test. Sometimes that's right. Often it's the worst outcome available — green tests, broken code. test-runner physically cannot do it.
It also never guesses your test command. It reads your project's own config and cites where it found it, or reports that it couldn't determine one.
Each agent is restricted to what it can do honestly:
- FIM reads, so it reports what is readable. It can spot a loop inside a loop; it cannot tell you how much memory your program uses, and it won't pretend to.
- test-runner runs tests, so it reports test results. It can't make them pass.
- AMA builds definitions, so it builds definitions — and won't call one finished before someone has reviewed it.
The limits aren't a safety feature bolted on afterwards. They're what makes the output trustworthy.
# copy the agents and their guards into your agents folder
Copy-Item *.md "$HOME\.claude\agents\"
Copy-Item guards\*.ps1 "$HOME\.claude\agents\"Then open each .md file and replace <ABSOLUTE-PATH-TO> in the frontmatter with
the real path, using forward slashes:
command: powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:/Users/YOU/.claude/agents/fim-readonly-guard.ps1"; exit $LASTEXITCODEClaude Code requires an absolute path here — it can't be made relative.
@ama I want an agent that flags any pull request touching the database schema.
@ohum In C:/Users/YOU/.claude/agents, lower fim's maxTurns to 30.
@fim review src/auth/. It should validate a JWT and reject expired tokens.
Built with: npm run build. Do not run anything.
@test-runner project root is C:/code/myapp
The guards are what make the agents' limits real, so their behaviour is measured rather than asserted:
powershell -ExecutionPolicy Bypass -File tests\run-all.ps1-ExecutionPolicy Bypass is required because Windows blocks unsigned scripts by
default. The agent hooks pass the same flag for the same reason.
179 cases · 179 passed · 0 false alarms · 0 missed mutations. Full write-up, including the one gap this suite found and what the tests do not cover, in docs/results.md.
Each case is a single line — ALLOW git status, DENY rm -rf build/ — so adding a
case for a command you care about takes seconds.
Stated plainly, because agents you can't trust are worse than no agents.
- Windows only. All three guards are PowerShell. Cross-platform is planned.
- The suite is slow on Windows PowerShell 5.1 — about two minutes, because it starts a fresh process for every case. Correct, but wasteful.
- A guard is a pattern matcher, not a sandbox. It inspects the command an agent asks to run. It cannot see inside a script once that script starts, and a determined user could get past it. It is built to stop an agent's own mistakes, which is the actual threat here — not to contain an adversary.
- Nothing here can safely execute your code. All three agents are readers by design, so anything needing live execution has nowhere to go. That's what the fourth agent is for.
- Some documentation inside
ama.mdis stale — its list of confirmed settings is more conservative than what current versions actually accept.
- Test suite for the guards — 179 cases with known correct verdicts, so the safety claims are measured rather than asserted
- Verified on Windows PowerShell 5.1 and PowerShell 7 — identical results
- Close the bare-
tscgap found by the suite - A fourth agent that can execute, confined to a scratch copy of your code — so FIM can suspect a problem and something else can actually measure it
- Cross-platform guards (macOS / Linux)
- A validator script, so a definition can be checked without a reviewer agent
- Pre-tested guard library, replacing guard generation
- Worked examples
MIT — see LICENSE.