Small programs that watch what Claude Code is about to do, and step in. Block a destructive command. Refuse to read a secret. Stage and format an edit. Ping you on Slack. Twenty-two exhaustively tested plugins, each one command to install.
stdinOn every lifecycle event, Claude Code pipes a JSON payload (the tool, its input, the session) to your hook's standard input.
A few hundred lines in Node, Python, or shell. Inspect the payload, check it against your rules, and choose a verdict.
exit 0 or exit 20 lets the tool run. 2 blocks it and hands your message back to Claude as guidance.
Refuses rm -rf ~, fork bombs, curl | sh, dd to a raw disk, and the long tail of catastrophes that look harmless in a one-liner. Three tunable safety levels decide where the line sits.
Stops Claude from reading, editing, or quietly exfiltrating .env files, SSH keys, AWS credentials, kubeconfig: anything load-bearing. Catches the obvious paths and the clever ones: a cat piped to curl is still exfiltration.
Branch-aware guardrails: blocks commit, merge, rebase, reset and push while you're on main, plus destructive gh CLI calls like gh repo delete. Complements block-dangerous-commands rather than overlapping it.
After Claude edits or creates a file, runs git add on it, so git diff --cached becomes the canonical "what did the agent just do" view. One less accounting step in your loop.
Runs the right formatter on whatever Claude just wrote: ruff for Python, prettier for JS/TS/HTML/JSON/Markdown/YAML. The agent's output lands already clean, so diffs stay about logic, not whitespace.
Pings a Slack channel when Claude is stuck on a permission prompt or has gone idle waiting on you. Start a long agentic run, switch tabs, and trust you'll be pulled back when it actually needs a human.
Stops the "fake green" ending: an agent that can't make a test pass will sometimes delete it, rename it out of discovery, or slip in a .skip. This hook refuses all three: while still allowing you to re-enable tests freely.
Writes a durable markdown log of every session (repo, files touched, bash commands with secrets redacted): without adding a millisecond to the loop. Point CC_SESSION_LOG_DIR at an Obsidian vault and your agent keeps a diary.
On APFS, exFAT and NTFS, Content and content are the same path: an agent typing the wrong case deletes the real thing. Resolves every rm/mv target through cd chains and quotes, and blocks only provable case-collisions.
Who guards the guards? Blocks the agent from rewriting its own guardrail config: settings.json, .claude/hooks/, .mcp.json, plugin manifests. Creating a protected file that doesn't exist yet counts as mutation (that exact gap was CVE-2026-25725). Reads always pass.
The out-of-band sibling of config-guard: fires when any config file changes mid-session, whoever changed it. By default it makes the change loudly visible; CONFIG_WATCH_BLOCK=true refuses it outright. Written for the era of the CHAINDROP worm, which hid its payload in .claude/settings.json.
Scans every CLAUDE.md and rules file as it loads for hidden directives: invisible-Unicode smuggling, bidi overrides, secret exfiltration, decode-and-execute, hook tampering. The event can't block by itself, so the hook locks the session instead: every prompt and tool call is refused until a human fixes the file.
+ event-logger: a Python diagnostic that dumps every event's JSON so you can see an event's shape before you write a hook against it. The thing you reach for first.
The guardrail twelve ↑ plus these eight workflow plugins, the subagent spawn cap, and the seven-in-one guard pack.
Per-file context-cost leaderboard: which files eat your tokens.
/context-hogs:leaderboardThe comeback price of a cold prompt cache, before you pay it: warns when your next message re-writes a lapsed 1-hour cache at up to 80x the read rate. Also a Mod form that refuses once and keeps the cache warm.
/cache-tax:statusPersonal model-quality flight recorder: your own receipts when Claude feels nerfed.
/nerf-receipts:receiptsCLAUDE.md compliance scorecard: which rules Claude actually ignores.
/dead-rules-audit:scorecardStamps a prompts / spend / tests / agent-authored receipt into PR bodies on gh pr create.
/pr-provenance-stamp:provenanceWrites your standup from what your agents actually did; re-injects yesterday's blockers.
/standup-autopilot:standupRemembers tried-and-reverted approaches; warns before you pay for a dead end twice.
/dead-end-registry:dead-endsPrices TODO/FIXME debt as aging XP bounties; agents clear them as side quests.
/bounty-board:boardAll seven guards in one Node process: one ~35ms Node startup per tool call instead of seven.
/plugin install guard-pack@claude-code-hooksPer-session subagent spawn budget: asks at 20 and every 10 after, denies at 60, nested fan-outs included. The total cap Claude Code 2.1.224 dropped, back under your control.
/plugin install subagent-spawn-cap@claude-code-hooksMost recorders observe off the critical path: their PostToolUse and Stop hooks run async: true, so they write their receipts without adding latency to the agent loop. The exception is a hook whose output Claude reads back: bounty-board verifies and pays out its bounties synchronously.
Every plugin installs with /plugin ↑. Prefer to own the file? Each hook is still a plain script you can copy.
Anywhere your shell can chmod +x. Convention is ~/.claude/hooks/.
$ mkdir -p ~/.claude/hooks $ cp plugins/block-dangerous-commands/block-dangerous-commands.js \ ~/.claude/hooks/
In .claude/settings.json, bind the hook to an event and matcher.
{
"hooks": {
"PreToolUse": [{
"matcher": "Bash",
"hooks": [{
"type": "command",
"command": "node ~/.claude/hooks/block-dangerous-commands.js"
}]
}]
}
}
The hook is live. Ask Claude to do something reckless and watch it refuse.
$ claude › please rm -rf ~ … hook blocked: deletes home directory.
Twenty-two tested plugins: twelve guardrails, a subagent spawn cap, eight workflow tools, and a seven-in-one guard pack, MIT licensed, no framework to learn. Install one and restart Claude Code, and you're protected in under a minute.