Skip to content
Bulkhead
Menu

Services · Claude Code teams · every price published

Harden the team, not just the repo.

For teams whose coding agents can reach production credentials: a DATABASE_URL in .env, a cloud token in the shell, a deploy key in CI.

If your name is on the production database, this page is for you. The CLI is free and has every guardrail in it. What you pay for here is hours: someone who has read the incident corpus walks your stack against it, writes the policy, and checks that it holds on your agents’ real traffic.

Book a Policy Review — $490Read the three offers

Opens Stripe checkout. After you pay, a person emails you the intake questions.

Who does the work: Andy Zhou (github.com/laqaer), who maintains the CLI.

Bulkhead

SERVICES · WORK ORDER

bulkhead.tools/hardening

THE CLI (MIT)
$0
every guardrail, forever

CREDIT

The $490 Review fee counts in full toward Hardening booked within 30 days.

Fixed prices. No quote call.

For the name on the production database.

Coding agents like Claude Code now run longer tasks with fewer interruptions, and in parallel sessions. Most of what they do is ordinary. The exposure is narrow: one tool call, made with a credential the agent could reach, that you can’t take back.

In April 2026 a Cursor agent deleted PocketOS’s production database volume, backups included, in under ten seconds. The data was later recovered with Railway’s help. The distance between what an agent is meant to touch and what it can reach is the work on this page.

Three questions come first

  1. 1Where can your agents reach production today: database, cloud, CI, secrets?
  2. 2Do they run unattended: overnight, in parallel worktrees, in CI?
  3. 3What already went wrong, or nearly did?

If the honest answer to the first is “nowhere”, you don’t need us. Install the CLI: same guardrails, free.

What a Review sends back, in shape

EXPOSURE MEMO

sample shape

What an agent could send · what the policy does · what it can’t see

  1. Overwrite the .env file

    Default preset: DENIED

    Strict preset: DENIED

    Write .env

    protected path (.env)

  2. Delete a production volume through the platform CLI

    Default preset: DENIED

    Strict preset: DENIED

    railway volume delete --volume vol_7f3a --yes

    Railway volume delete

  3. Wipe a production table with an unscoped DELETE during a code freeze

    Default preset: DENIED

    Strict preset: DENIED

    psql "$DATABASE_URL" -c "DELETE FROM executives;"

    Unscoped SQL DELETE (no WHERE clause)

  4. Reset the database and re-run every migration

    Default preset: allowed

    Strict preset: DENIED

    npx prisma migrate reset --force

    Default allows it; for unattended runs on your stack, turn on the strict rule.

  5. Delete through an interpreter instead of rm

    Default preset: allowed

    Strict preset: allowed

    python3 -c "import shutil; shutil.rmtree('/Users/me/backups')"

    Can’t be seen from the command string. Needs a sandbox or a narrower credential.

  6. A scoped SQL DELETE with a WHERE clause

    Default preset: allowed

    Strict preset: allowed

    psql "$DATABASE_URL" -c "DELETE FROM sessions WHERE expires_at < now();"

    Ordinary work. The policy stays out of its way.

Rows from the open incident corpus, judged by the real engine (v0.2.0). Not client data. Yours is ranked by blast radius for your stack.

01 · Policy Review

Async · 3 business days

Three business days. Three fixes, or no charge.

$490Fixed · credited to Hardening

We read the policy you have against the incident corpus and your stack, and send back one you can merge: a diff, a memo that says what’s still exposed, and a call to walk through both.

What happens

  1. Intake

    Day 0: you send the files.

    The list is below. We read everything before we run anything.
  2. Baseline

    We run the corpus, strict preset.

    npx @bulkheadtools/cli demo --preset strict, noting which strict-only rules matter for your stack.
  3. Review

    We walk your stack against it.

    Databases (unscoped deletes, resets), infrastructure-as-code (destroy paths), cloud CLIs, git workflow, secrets files, budget shape, completion-check mode.
  4. Deliver

    By day 3: the diff, the memo, the call.

    A PR-ready bulkhead.yaml diff with a comment on every added rule, a 2-page exposure memo ranked by blast radius, and a 30-minute walkthrough.
  5. After

    The credit stays open 30 days.

    If you want the rest done for you, the full $490 counts toward Agent Hardening.

What we need from you

  • bulkhead.yaml and .claude/settings.json
  • The output of bulkhead report 10 and bulkhead inbox
  • A list of where your agents can reach production
  • The permission mode you run: default, acceptEdits or auto
  • 30 minutes for the call

No repo access and no secrets. Tell us where credentials live, not what they are.

POLICY REVIEW

fixed price · async

  • 1bulkhead.yaml diffPR-readya comment on every added rule
  • 1Exposure memo2 pagesranked by blast radius: what an agent could do, what the new policy denies, what it still can’t see
  • 1Walkthrough call30 min
TURNAROUND
3 business days
TOTAL
$490

GUARANTEE

Fewer than 3 concrete fixes: no charge.

CREDIT

The full $490 counts toward Agent Hardening booked within 30 days.

Book a Policy Review

Opens Stripe checkout. After you pay, a person emails you the intake questions.

02 · Agent Hardening

Mostly async · 48 hours

48 hours from read access to a verified install.

$2,497Fixed · up to 10 developers and 3 repos

We map every path from your agents to production, write a policy pack for your stack, install it, and tune it against your agents’ real traffic before we hand it over. Then 30 days of tuning by email.

Hour by hour

  1. 01 · Hours 0–8

    Audit

    Repos, agent configs, CI, where credentials live, recent incidents or near-misses. We map every path from an agent to production.

    You get

    Exposure map

  2. 02 · Hours 8–32

    Author

    A policy pack for your stack: protected paths, stack-specific blocked commands with benign controls, budget shape, completion-check mode, the risky-action gate. Where Bulkhead can’t see (interpreters, scripts) we recommend credential scoping and a sandbox. For teams, managed settings (allowManagedHooksOnly) so the hooks live in admin-controlled settings.

    You get

    bulkhead.yaml pack + managed-settings snippet

  3. 03 · Hours 32–48

    Verify + hand off

    Install, run against your agents’ real traffic, tune the false positives, then walk the team through receipts, bulkhead report and bulkhead inbox.

    You get

    Verified install · 45-minute walkthrough

  4. 04 · +30 days

    Tuning support

    Policy tuning by email while the team gets used to it.

What we need from you

  • Read access to the repos in scope (up to 3)
  • How your agents run: modes, where, unattended or not
  • Where credentials live. Not the credentials.
  • A preferred start week
  • 45 minutes of the team for the walkthrough

What it won’t do

A policy can’t fix a token with too much power, and a rule over a command string can’t see inside an interpreter or a script. Where that’s the exposure, the map says so and recommends the credential change or the sandbox. We don’t sell a sandbox and we won’t pretend a policy is one.

AGENT HARDENING

fixed price · 48 hours

scope
≤10 developers
≤3 repos
  • 1Exposure mapevery path from an agent to production
  • 1Policy packbulkhead.yamlprotected paths, blocked commands with benign controls, budget, verify mode, risky gate
  • 1Managed-settings snippet
  • 1Verified installreal traffic
  • 1Team walkthrough45 min
  • Tuning support, email30 days
TOTAL
$2,497
Policy Review credit
−$490
if you had a Review in the last 30 days
Book Agent Hardening ($1,250 deposit)

Opens Stripe checkout. After you pay, a person emails you the intake questions.

03 · Watch

Retainer · at most 5 teams at a time

The policy keeps up after we leave.

$1,500/mo3-month minimum

A Claude Code update can change the hook contract, and your stack changes too. Watch keeps the policy current, and gives you someone to read the ledger with you when a run looks wrong.

What it covers

  • Ongoing

    Policy re-tuning

    As Claude Code changes, and as your stack does.

  • On demand

    Incident forensics

    Send the ledger; within 1 business day we tell you what the agent did, in order, and what it was stopped from doing.

  • Every quarter

    Re-audit

    Every path from your agents to production, mapped again.

  • When it shipsIn the works

    Pro, included

    Pro is planned and not built. When it ships, Watch teams get it at no extra cost.

What we need from you

  • A Bulkhead install to watch, usually the one Hardening left behind
  • The ledger, when you want forensics
  • A note when your stack or your agents’ reach changes
  • Three months: the minimum term

WATCH

retainer · monthly

  • Policy re-tuningongoingas Claude Code changes
  • Incident forensics≤1 business dayfrom your ledger
  • Re-auditquarterly
  • Proincludedwhen it ships · in the works
MONTHLY
$1,500
MINIMUM TERM
3 months
CAPACITY
≤5 teams at once
Ask about Watch

Opens an email to hello@bulkhead.tools with the intake questions filled in. A person replies, with a payment link or two call slots if you’d rather talk first.

Who it’s for. Who it isn’t.

A fit.

  • Startup teams, roughly 2 to 30 developers, whose agents can reach production credentials: database URLs, cloud tokens, CI deploy keys.
  • Agencies running agents on client code, who need to show a client what the agent did and what it was stopped from doing.
  • Teams that let agents run unattended: overnight, in parallel worktrees, in CI.
  • Claude Code in default, acceptEdits or auto mode.

Not a fit.

  • Your agents can’t reach anything that matters.

    The free CLI is enough.

  • You run --dangerously-skip-permissions and plan to keep it.

    Bypass mode isn’t supported; a public bug report says hooks may not block reliably there. Run a sandbox.

  • You need a sandbox, a firewall, or protection from prompt injection.

    Bulkhead is none of those. We’ll tell you what to pair it with.

  • You run Codex CLI or Cursor.

    Claude Code only today; Codex is next. Tell us.

Asked before booking.

Anything else: hello@bulkhead.tools. A person reads it.

Do we need a service, or just the CLI?

Most teams need only the CLI. It is MIT, free forever, and no guardrail will ever move behind a paywall. Services are for when you would rather have someone who has read the incident corpus write the policy for your stack and check that it holds.

Do you need access to production?

No. A Policy Review works from files you send. Agent Hardening needs read access to the repos in scope and a description of how your agents run. We don't need production credentials, and you shouldn't send them: the job is to find where your agents can reach them.

What counts as a “concrete fix” in the Review guarantee?

A specific change that closes a specific exposure: a rule for a destructive command your stack can run, a protected path, a budget or completion-check setting, or a credential that should be scoped down. If we find fewer than three, you don't pay.

Can we start with a Review and move up?

Yes. The full $490 counts toward Agent Hardening if you book it within 30 days of the Review. Watch usually follows Hardening, once there is a policy worth keeping current.

How does booking work?

The booking buttons on this page go straight to checkout. Prices are fixed and published here, so there is no quote step. Questions first? Write to hello@bulkhead.tools and a person replies.

Will you publish that we worked together?

Only with your written sign-off. We ask every client whether we may publish a short case study, and no is a fine answer. It is also why this page shows no logos or testimonials: nothing appears here until a client has signed it off.

What still isn’t covered after a Hardening?

Everything on the limits list. Bulkhead is not a sandbox or a firewall and doesn't stop prompt injection. Hooks can be skipped with --bare, removed, or changed by a Claude Code update. A rule over a command string can't see inside interpreters, scripts, a cd, or encoded commands. The exposure map names which of your paths need a sandbox or a narrower credential instead.

We run Codex CLI or Cursor.

Bulkhead supports Claude Code only today; Codex CLI is next. Write to us before booking and we'll tell you plainly whether a Review is worth it yet.

Start free. Email us for the rest.

The CLI is the product and it stays free. The services are the hours around it, priced in public.

Policy Review — $490Agent Hardening — $2,497Watch — $1,500/mo

Opens Stripe checkout. After you pay, a person emails you the intake questions.

Your copy
npx @bulkheadtools/cli init

Writes bulkhead.yaml and merges the hooks into .claude/settings.json. No telemetry (the hooks run through npx, which checks the npm registry).