Hook Guard
Guardrail hooks for Claude Code, packaged as the Claude Code Hook Kit. Python 3, standard library only, no network access, no API keys.
$19 USD, one-time
| Hook | Event | What it does |
|---|---|---|
guard_bash | PreToolUse (Bash) | Blocks destructive shell commands |
guard_secrets | PreToolUse (Read, Write, Edit, MultiEdit, NotebookEdit) | Blocks hardcoded secrets and access to .env, private keys and .git/ internals |
format_after_edit | PostToolUse (Write, Edit, MultiEdit) | Runs the formatter you already have installed |
session_log | PostToolUse and Stop | Writes a redacted JSONL log of every tool call and block |
A separate hookkit_report command summarises the logs. A blocking hook exits with code 2, and the reason goes back to Claude so it can pick a safer approach. Blocked secrets are never echoed in full: messages and logs show the first four characters followed by ***.
| Rule | Examples |
|---|---|
| rm-system-path | rm -rf /, rm -rf ~, rm -rf /etc, rm -rf .. |
| rm-git-dir | rm -rf .git |
| git-force-push | git push --force, git push -f (--force-with-lease is allowed) |
| git-discard | git reset --hard, git clean -fd, git checkout . |
| pipe-to-shell | Piping a downloader's output into a shell interpreter |
| chmod-777 | chmod -R 777 . |
| disk-write | dd of=/dev/sda, mkfs.* |
| sql-drop | DROP TABLE, DROP DATABASE, TRUNCATE TABLE |
| env-file-read | cat .env (.env.example is fine) |
| irreversible-publish | npm publish, twine upload, terraform destroy, kubectl delete ns |
| secret patterns | AWS, GitHub, Slack, Anthropic, OpenAI and Google keys, private-key blocks, JWTs and hardcoded credentials in content being written |
| file rules | Read/Write on .env*, id_rsa, *.pem, credentials.json and .git/* |
Limits. Matching is pattern-based, not a shell parser. A command that only mentions a dangerous string inside quotes, such as echo "git push --force", can be blocked too. You can tune this in .claude/hookkit.json: disable rules, allow commands by regex, or add your own blocked patterns. Pattern-based guards reduce risk but cannot catch every dangerous command or secret.
The formatter hook picks the first formatter found per file type (ruff then black for Python, prettier for web files, gofmt, rustfmt, shfmt, terraform fmt). It never uses npx or downloads anything, and a formatter failure never blocks Claude.
The repository has 22 tests (python3 -m unittest discover -s tests) and a smoke test, python3 smoke_test.py, that runs in about 2 seconds in a temporary directory. The scripts total about 450 lines. Read them before installing, as you would any code that runs on every tool call. Hooks run with your user permissions.
Free on GitHub
The repository contains the full working kit. Nothing is crippled, locked or time-limited. Clone it and use it.
Supporter tier, $19
Same code, plus priority fixes, workflow docs and a license key (TIMO_...) that carries update entitlements. It funds development. The kit works fully without a key.
Licence. Hook Kit is not MIT. You may use and modify it in any number of your own or your employer's projects and share it with teammates on those projects. You may not resell or redistribute it. Read LICENSE.txt.
From the README (Python 3.8+ and Claude Code):
- Clone the repo:
git clone https://github.com/timoranjes/claude-code-hook-kit.git hook-kit && cd hook-kit - Run the smoke test:
python3 smoke_test.py(about 2 seconds; it uses a temp directory) - Preview the change:
python3 install.py /path/to/your/project --dry-run - Install:
python3 install.py /path/to/your/project - Restart Claude Code in that project (or run
/hooksto confirm five entries).
The installer copies scripts to .claude/hooks/, merges entries into .claude/settings.json (your other settings and hooks are kept; a one-time settings.json.bak is written), and creates .claude/hookkit.json if missing. Re-running is safe. Remove everything with python3 install.py /path/to/your/project --uninstall.