Talk Claude into building you a tiny hedge fund.
The plugin turns any Claude Code session into a bonded operator. Bind a capability, run /chio:bond, and every tool Claude reaches for, from the filesystem to your broker, is mediated, metered, and settled against a signed receipt.
Three lines. One bonded Claude.
The plugin ships as an npm package Claude Code can load directly. Install the runtime, add the plugin, point it at a policy, and Claude will route every tool invocation through Chio, without knowing it.
Install the chio runtime
The chio binary handles the kernel; trust plane serves on :8940.
curl -fsSL https://www.chio.world/install.sh | sh && chio trust serveAdd the plugin to Claude Code
Registers /chio:* commands and the PreToolUse/PostToolUse hooks that route every tool call through chio.
claude plugin add @chio-protocol/claude-code-pluginBond a capability
Issues an Agent Passport scoped to the policy. Every tool call is mediated against it.
/chio:bond ./hedge.policy.yaml 4h# HushSpec 0.1.0 · tiny hedge fund, bonded to Claude Code. hushspec: "0.1.0" name: tiny-hedge-fund rules: tool_access: enabled: true default: block allow: - place_order - read_prices - email_receipt egress: enabled: true default: block allow: - https://paper-api.alpaca.markets velocity: budget_usd: 500 max_invocations: 40 window_seconds: 3600 human_in_loop: approve_above_usd: 150
The loop. From a prompt to a receipt.
Every tool Claude reaches for, whether Bash, Write, Edit, Read, or any mounted MCP server, takes the same path. The plugin is just the surface; the chio kernel is underneath.
Claude proposes a tool call.
The PreToolUse hook snaps the call before it leaves the sandbox. Args are normalized; MCP tools are decomposed into (serverId, tool).
place_order {symbol:SPY, qty:6}Chio runs the pipeline.
Capability, 18 guards, budget, and velocity: fail-closed, single pass, ~2ms median.
18 guards · 1.8msTool executes or is denied.
An allow turns into the actual call. A deny surfaces in chat with a human-readable reason and the guard that refused.
decision: allowReceipt is signed.
One ed25519-signed artifact per call. Merkle-committed; streamed to your SIEM; available via /chio:receipt-last.
ed25519:e5f6a7b8…More than a shim. A whole co-pilot.
The plugin folds Chio primitives directly into the conversation. Capabilities, budgets, approvals, and evidence become first-class citizens of the Claude workflow.
Bonded sessions
Every chat becomes an Agent Passport with a scoped capability, a budget, and a TTL. Revoke from anywhere; remote rotations hit in <1s.
capabilitiesBudget meters
Token, dollar, and invocation budgets inline in the chat. Claude sees the remaining runway and narrows scope on its own as it burns down.
velocity · costHuman-in-loop gates
Flag tool calls that need a human. Claude pauses, posts a card, and won't proceed until you /chio:approve with your own signing key.
gatesLive guard edit
Pause, swap, or scope-shrink any of the 18 guards without leaving the chat. Every change is countersigned and receipted.
policyTool store
Browse and mount any MCP server the plugin has bonded. Chio attenuates the scope automatically to match the current policy.
mcpEvidence export
/chio:receipt-export turns any slice of the session into an offline-verifiable bundle. Drop it in a ticket; verify without running Chio.
auditStart with a sentence. Ship a citizen.
Paste these into any Claude Code session with the plugin installed. Every recipe binds a fresh capability, runs inside its own budget, and emits a signed receipt bundle when it's done.
Every step, countersigned.
Bond Claude. Give it a budget. Get a receipt.
Install the plugin, point it at a policy, and Claude Code becomes the operator, not the liability. Four minutes to a working, signed, revocable agent.
