Best Security plugins for Claude Code

Hookify creates custom hooks to prevent unwanted behaviors by analyzing conversation patterns or explicit instructions, using simple markdown configuration files with regex pattern matching. It supports four hook events (PreToolUse, PostToolUse, UserPromptSubmit, Stop) and provides commands to generate rules, list configurations, and interactively manage hook behavior without requiring restarts.

This Agent Skill performs automated security audits using OWASP Top 10, CWE Top 25 2025, and CVSS v4.0 standards for any project, with deep PHP/TYPO3 scanning across 80+ checkpoints and 19 reference guides. It integrates via a PreToolUse hook to flag risky commands and provides vulnerability assessment, risk scoring, secure coding guidance, and DevSecOps pipeline security.

This plugin automatically loads credentials from a CLAUDE_ENV_FILE environment variable on session start and redacts secrets from CLI output in real-time using the nopeek CLI tool. It intercepts both session initialization and tool execution to prevent sensitive data from being exposed in logs or terminal output.

This Claude Code plugin prevents unsafe GitHub release practices by intercepting dangerous `gh release` commands via hooks and provides orchestrated version bumping, signed tagging, and CI-driven release workflows across multiple ecosystems (TYPO3, PHP, Node.js, Go, Python, Rust). It detects project type, manages semantic versioning from conventional commits, and ensures releases flow through proper code review and CI pipelines with supply chain security features like SBOMs and attestations.

This plugin acts as a security reminder hook that warns developers about potential security vulnerabilities—including command injection, XSS, and unsafe code patterns—when they edit files. It uses a Python-based analysis triggered by PreToolUse events to flag risky code patterns before they're executed.

Reins intercepts tool calls via pre/post hooks to block destructive actions, route high-risk operations to human approval, and maintain an immutable audit trail of all decisions. It protects against vulnerabilities covered in OWASP MCP, ASI, and Agentic Skills Top 10 threat models by analyzing commands before execution and logging outcomes to a local decision log.

Safety Net intercepts and blocks destructive git and filesystem commands before AI agents execute them by analyzing command semantics, making it immune to flag reordering and shell wrappers. It runs as a PreToolUse hook across seven coding agent CLIs (Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Kimi Code, OpenCode, and Pi) and works on Windows, macOS, and Linux.

This plugin provides Git workflow automation including worktree management, branch cleanup, secret scanning, and configuration validation through hooks and guardrails. It uses a PreToolUse hook to inspect and control tool execution decisions, with built-in shell integration for Git operations.

This plugin documents AI-generated codebases and audits them for security/performance gaps by comparing documented intent against actual implementation, producing a reviewer-ready shipping packet. It provides five commands to reverse-engineer architecture, map test coverage, and identify risks that generic scanners miss.

This plugin performs security audits on codebases through a single command that analyzes code for potential vulnerabilities and security issues. It operates without requiring external dependencies or third-party services.

This agent implements AI ethics frameworks, governance policies, and responsible AI practices for B2B applications, focusing on bias detection and algorithmic transparency. It helps enterprises establish AI governance structures and compliance requirements that build trust in AI systems.

This agent implements data privacy engineering and GDPR compliance frameworks for B2B applications, covering data minimization, consent management, and privacy-by-design principles. It specializes in helping enterprises meet global privacy regulation requirements across their platforms.

This Claude Code plugin provides eight skills for threat modeling, security architecture review, incident response, vulnerability management, and access/identity governance. It enforces blocking findings that cannot be overruled by reviewed departments, establishing a strict security governance framework.

This agent automates compliance processes for major regulatory frameworks including SOC 2, ISO 27001, GDPR, and HIPAA, helping B2B platforms with audit preparation and continuous monitoring. It provides a specialized interface for implementing and managing enterprise regulatory requirements without external dependencies.

This Agent Skill assesses software projects against enterprise-grade standards including OpenSSF Scorecard, Best Practices Badges (Passing/Silver/Gold), SLSA, and supply chain security frameworks. It provides dynamic cross-platform scoring, quality gates, automated security hardening scripts, and guided certification pathways with no external API dependencies.

This plugin provides an AI agent that conducts comprehensive security assessments and compliance validation for B2B SaaS platforms, covering SOC 2, GDPR, and ISO 27001 standards. It specializes in multi-tenant security reviews, enterprise compliance checks, and audit preparation without requiring external API keys or tools.

This plugin provides eight specialized skills for contract review, privacy protection, enterprise risk assessment, corporate governance, compliance verification, and audit readiness. Its reviewer-class findings are authoritative and cannot be overridden by the department under review.

This skill provides a conformance ruleset and self-contained checker for TYPO3 v14 site/project repositories, validating repository layout, Docker/Compose topology, Concourse CI pipelines, supply-chain security, secret handling, and runtime configuration against the Netresearch gold standard. The bundled checker (check.py) requires only Python 3 and PyYAML to audit a target repo and generate a prioritized remediation list across seven rule families (STRUCT, CONTAINER, CI, DEPLOY, DEP, SEC, DOC).