A pre-tool-use hook is a small program that an agent harness such as Claude Code runs before executing a tool. It receives the tool name and its input, typically as JSON on standard input, and can allow the call or reject it, feeding the reason back to the model so it can try a safer action. Because it runs outside the model, it is a deterministic guardrail rather than a prompt request. Teams use hooks to block commands that contain secrets or personal identifiers, to stop destructive shell commands and to log every action an agent takes.