Security plugins for Claude Code

Hookify creates custom hooks to prevent unwanted behaviors by analyzing conversation patterns or explicit instructions, using simple markdown configuration files with regex pattern matching. It supports four hook events (PreToolUse, PostToolUse, UserPromptSubmit, Stop) and provides commands to generate rules, list configurations, and interactively manage hook behavior without requiring restarts.

This plugin enforces Cedar-based authorization policies on every Claude Code tool call and generates Ed25519-signed audit receipts that are independently verifiable offline. It prevents unauthorized tool execution before it happens and maintains a hash-chained trail of all decisions with cryptographic proof.

This plugin gates PR reviews, issue comments, merges, CI workflow edits, and other sensitive review-surface actions behind mandatory human approval, using Cedar policies and Ed25519-signed receipts for audit compliance. It prevents AI agents from taking unvetted actions that affect code review integrity and other contributors by requiring an explicit approval flag or slash command before high-impact tool calls execute.

A Claude Code plugin that runs vulnerability scanning entirely within your session using a team of 9 agents to map architecture, build threat models, hunt for vulnerabilities, and verify findings before reporting. Confirmed findings are transformed into targeted patch files that you review and apply at your discretion.

A Discord bot bridge that connects a Discord channel to Claude Code via an MCP server, exposing tools for sending messages, reactions, edits, and fetching history. The bot handles message forwarding, access control policies (pairing and allowlisting), and file attachment management.

Hookify creates custom hooks to prevent unwanted behaviors by analyzing conversation patterns or applying explicit rules defined in simple markdown configuration files. It supports regex-based pattern matching across multiple event types (bash commands, file edits, user prompts) with configurable warn or block actions.

This Claude Code plugin performs three-layer security review of code edits: pattern-based regex warnings on edits, LLM-powered diff review when Claude finishes a response, and agentic commit review that traces data flow to catch multi-file vulnerabilities like injection, XSS, SSRF, and hardcoded secrets. It integrates via hooks into the Claude Code editing workflow and supports customizable org-specific policies through markdown configuration files.

This AI-powered plugin automates contract review, NDA triage, and compliance workflows for in-house legal teams by analyzing documents against customizable organizational playbooks. It integrates with Slack, Box, Egnyte, Atlassian, and DocuSign to streamline legal briefings, templated responses, and institutional knowledge management.

This Claude Code plugin hooks into PreToolUse events to detect and warn about 12 common security anti-patterns (command injection, XSS, SQL injection, unsafe deserialization, code injection, and GitHub Actions workflow injection) before code execution happens. It caches session state and auto-cleans stale files after 30 days, and can be disabled per-session via environment variable.

This skill helps diagnose and resolve macOS privacy permission (TCC) issues specific to OpenLogi, a Logitech device management application. Use it when triaging device visibility problems, permission prompts, or errors related to Input Monitoring, Accessibility, and code-signing on macOS.

SkillSpector is a security scanner that detects vulnerabilities, malicious patterns, and security risks in AI agent skills before installation, using 71 vulnerability patterns across 17 categories and a two-stage analysis combining fast static checks with optional LLM semantic evaluation. It supports multiple input formats (Git repos, URLs, zip files, directories, single files) and generates terminal, JSON, Markdown, and SARIF reports with risk scoring and baseline suppression.

This standalone Agent Skill provides two utilities: an interactive self-assessment tool that generates personalized learning paths, and an update-threat-db skill that refreshes threat intelligence through AgentSec Triage and synchronizes coding-agent and MCP security advisories. Both skills support the Claude Code Ultimate Guide, a comprehensive resource for learning Claude Code, building reliable agents, and scaling their deployment safely.

This Claude Code plugin integrates AWS DevOps Agent and AWS Security Agent to investigate incidents, review code for release readiness, scan for vulnerabilities, and run penetration tests. It provides 13 skills and 9 commands for automating security and operational workflows across multiple AWS accounts and agent spaces.

a2a-client is an MCP server that provides security-hardened access to Agent2Agent (A2A) agents through the official SDK, exposing tools for discovering agent cards, sending/streaming messages, and managing tasks with operator confirmation gates. Every remote agent card is treated as untrusted input with strict validation, SSRF protection, credential isolation, and confirmation-gated task cancellation.

governed-second-brain is a Claude Code plugin that turns local files into a cited, governed memory system with SHA-256 hash-chained audit trails, operating in-process with no runtime network overhead in local mode or proxying to a shared team brain when configured. It provides two skills (/brain for cited answers and /brain-save for governed capture) plus tools for search, status, audit verification, and lifecycle management—all with deterministic deduplication and policy-driven promotion.

This GitHub Actions plugin automates secure CI/CD workflows for Google Cloud and Vertex AI deployments, enforcing Workload Identity Federation (WIF) for keyless authentication and comprehensive security best practices. It provides pre-commit validation hooks, post-deployment health checks, and IAM least-privilege enforcement to ensure production-ready pipelines.

A Claude Code plugin that bridges Slack channels and DMs to Claude Code sessions via Socket Mode, enabling two-way conversation with built-in governance, audit logging, and session isolation. It operates as an MCP server with declarative policy enforcement, Ed25519-signed audit trails, and defense against prompt injection.

This plugin acts as a security reminder hook that warns developers about potential security vulnerabilities—including command injection, XSS, and unsafe code patterns—when they edit files. It uses a Python-based analysis triggered by PreToolUse events to flag risky code patterns before they're executed.

A PreToolUse hook that intercepts and blocks destructive git and filesystem commands (like `rm -rf`, `git reset --hard`, `git push --force`) before execution by parsing command semantics rather than simple patterns, so flag reordering and shell wrappers cannot bypass it. It runs on Windows, macOS, and Linux across seven coding agent CLIs including Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Kimi Code, OpenCode, and Pi.

CC Safety Net intercepts and analyzes shell commands before execution, blocking destructive operations (like `git reset --hard`) and secret file access (SSH keys, `.env` files) by parsing command intent rather than string matching. It runs as a PreToolUse hook on node and works across multiple coding agent CLIs including Claude Code, Cursor, and GitHub Copilot CLI.

A security audit skill that detects common vulnerabilities introduced by AI coding assistants in vibe-coded applications, including hardcoded secrets, broken database access controls (Supabase RLS, Firebase rules), missing auth validation, and insecure payment flows. The skill automatically activates when reviewing code that handles authentication, payments, databases, API keys, or user data, and organizes security checks by technology stack to avoid irrelevant rules.

This plugin adds a security reminder hook that triggers before code edits to warn about potential security vulnerabilities like command injection, XSS, and unsafe code patterns. It uses python3 to analyze code and flag risky practices in real time.

This Claude Code plugin integrates Sentry error monitoring and performance tracking into your development workflow through an experimental MCP server. It provides access to Sentry's project management, issue tracking, and debugging capabilities via Claude.

claude-council is a Claude Code plugin that queries multiple AI coding agents (Gemini, OpenAI, Grok, Perplexity, Kimi, OpenRouter-routed models, and local Ollama) in parallel and displays their responses side-by-side with a synthesis of agreements and divergences. It helps developers cross-check coding decisions, debug problems, and review security by consulting diverse AI perspectives without requiring any API keys if using local tools or CLI-based providers.

This Claude Code plugin installs a PreToolUse hook that blocks dangerous Bash commands (rm targeting home/root directories, fork bombs, curl|sh, force pushes, git reset --hard, chmod 777, docker volume rm, etc.) before they execute. Three configurable safety levels (critical/high/strict) control what gets blocked, with per-level ask mode allowing you to approve or reject matches instead of hard-denying them.

This PreToolUse hook intercepts destructive Bash commands (rm, rmdir, mv, mkdir, touch, find) and blocks or prompts when the target path differs only in case from what exists on case-insensitive filesystems like APFS and NTFS. It properly resolves command context through cd chains, subshells, quotes, and shell connectors without making probe filesystem calls.

A PreToolUse hook that prevents agents from modifying guardrail configuration files (settings.json, hooks.json, .mcp.json, plugin manifests, and optionally instruction files) across Bash, Edit, MultiEdit, and Write operations by deny-by-default filtering. The hook logs all decisions locally and supports three safety levels (critical, high, strict) with optional prompt-instead-of-deny modes.

git-safety is a PreToolUse hook that prevents destructive git and GitHub CLI operations in Claude Code by denying branch-unsafe commands (commits/pushes/merges on main/master) and risky gh operations before they execute. It runs synchronously at configurable safety levels (critical/high/strict) and logs every blocked command locally without network calls.

guard-pack bundles seven security and safety hooks (spawn limits, config protection, dangerous command blocking, secret protection, test isolation, git safety, case sensitivity) into a single Node process that runs on tool calls. It evaluates guards in a fixed order with the first blocking verdict winning, and includes detailed logging to ~/.claude/hooks-logs/ while making no network calls.

Audits CLAUDE.md and .claude/rules/*.md files for hidden or hostile directives (invisible Unicode, bidi overrides, command injection, secret exfiltration) and locks the session if violations are found. Enforcement spans three hooks: InstructionsLoaded detects, while UserPromptSubmit and PreToolUse prevent any execution until a human fixes or clears the poisoned file.

A PreToolUse hook that screens every Read, Edit, Write, and Bash call against tiered patterns to block or prompt on attempts to access or exfiltrate sensitive files (.env, SSH keys, cloud credentials, keystores) and dangerous shell commands. Matches are denied or converted to a prompt with the exact pattern id and reason, with tunable safety levels (critical/high/strict) via the HOOK_SAFETY_LEVEL environment variable.

nah is a context-aware safety guard for Claude Code that intercepts tool use before execution, classifying actions as safe, ambiguous, or dangerous based on operation type, path context, and command patterns. It protects against risky Bash commands, file access to sensitive locations, suspicious shell patterns, and network code execution through a fast local decision layer.

Reins intercepts tool calls via pre/post hooks to block destructive actions, route high-risk operations to human approval, and maintain an immutable audit trail of all decisions. It protects against vulnerabilities covered in OWASP MCP, ASI, and Agentic Skills Top 10 threat models by analyzing commands before execution and logging outcomes to a local decision log.

This Claude Code plugin automates FedRAMP compliance authorization using Key Security Indicators (KSIs), continuous monitoring, and machine-readable policies synchronized from official FedRAMP documentation. It provides shell-based commands and hooks for compliance notifications to streamline the authorization process.

Cross-Code Organizer is a dashboard that scans and displays Claude Code memories, skills, MCP servers, and hooks, showing what loads globally versus per-project and enabling users to move items between scopes. It provides cross-harness visibility across Claude Code and Codex CLI, includes MCP security scanning to detect poisoned servers, and helps reclaim wasted context tokens by identifying duplicate memories and misplaced configs.

Cross-Code Organizer is a local dashboard for inspecting and managing configuration across multiple AI coding harnesses (Claude Code, Codex CLI, OpenCode, DeepSeek Harness) in one unified interface. It normalizes memories, skills, MCP servers, hooks, and project context per harness, with built-in scanning for poisoned MCP servers and context optimization tools.

OpenQodex is a Claude Code plugin that runs security and lint scanners (Semgrep, Gitleaks, OSV-Scanner, ShellCheck, Ruff) on your changed code, then spawns a separate Claude reviewer that validates each finding and generates a unified report. It integrates with git pre-push hooks to enforce review policies and runs entirely on your own Claude login with no external API keys required.

Pensive is a reflective code review toolkit for Claude Code that orchestrates domain-specific reviews (Rust, APIs, tests, architecture, blast radius, math, shell scripts) with structured analysis and intelligent skill selection. It identifies code quality issues, security vulnerabilities, and architectural risks through specialized agents, producing actionable findings with severity rankings and remediation steps.

Sage is a lightweight security layer that intercepts tool calls (shell commands, URL fetches, file writes) and checks them against multiple threat detection layers including URL reputation, local heuristics, prompt injection detection, and supply-chain checks before execution. It integrates with Claude Code and other AI coding assistants via hooks that monitor PreToolUse, PostToolUse, and SessionStart events to prevent dangerous actions.

This repo provides three Stata-related standalone Agent Skills—including stata-audit for inspecting and validating Stata-MCP audit logs, snapshots, and tool execution history, and stata-skill for general Stata integration. All skills work offline without external APIs or dependencies.

This Claude Code plugin uses PreToolUse and PostToolUse hooks to detect and prevent common secrets leakage patterns such as environment variable echoing, secret file reads, tokens in URLs, and missing gitignore/permissions on sensitive files. It helps developers catch security misconfigurations before they happen by monitoring tool usage and enforcing safe patterns.

The Dynatrace Claude Code plugin connects to your Dynatrace environment to investigate production issues, review deployments, and check vulnerabilities using 34 skills that cover DQL queries, observability (services, frontends, tracing, hosts, Kubernetes, cloud platforms), logging, problem analysis, and alerting. It includes an MCP server for live querying and optionally integrates with the Dynatrace CLI (dtctl) to execute workflows and create dashboards directly from Claude.

Deliberation delegates code review, architecture, debugging, and security analysis to GPT, Gemini, Grok, or 400+ OpenRouter models through MCP, with seven specialized agents that debate findings until consensus and optionally implement changes. Only Gemini can write code; GPT, Grok, and OpenRouter provide advisory-only second opinions via commands like /ask-all, /consensus, and model-specific ask commands.

This standalone Agent Skill provides wallet operations through the Phantom MCP server, enabling address retrieval, transaction signing, token transfers, token purchases, and message signing across Solana, Ethereum, Bitcoin, and Sui networks. The skill integrates directly with the Phantom wallet to execute cryptographic operations and manage digital assets.

The vulnhunter skill detects security vulnerabilities and dangerous patterns in code by identifying sharp edges, footgun configurations, and finding vulnerability variants across codebases. It combines vulnerability detection with systematic variant analysis to help developers locate and remediate security issues.

This standalone Agent Skill provides deep architectural context building for security audits using Trail of Bits methodology. Use it when conducting security reviews, understanding codebases, mapping trust boundaries, or preparing for vulnerability analysis.

Skills Janitor is a standalone agent skill that audits your Claude Code and OpenAI Codex skill collections for duplicates, broken symlinks, unused skills, and security risks — finding prompt injection, hidden instructions, credential theft patterns, and dangerous scripts. It provides six commands (discover, fix, report, security, value, swipe) plus a Tinder-style interactive cleanup UI, with real token-cost accounting and MCP server triage.

Ultraship is a Claude Code plugin with 45 skills, 13 agents, and 37 audit tools for building, shipping, and scaling production software—covering accessibility (WCAG 2.2), security scanning, code quality, SEO, AI readiness, and bundle analysis. A built-in Currency Guard keeps Claude on current docs rather than stale training data, with a blocking ship-gate scorecard that runs six parallel audits (SEO, accessibility, secrets, code profiling, bundle tracking, env validation) before deployment.

Agentic-Security automatically scans code for security vulnerabilities (SAST, SCA, secrets detection) using plain-English risk explanations with cost estimates, and can automatically verify and apply fixes before they touch disk. It integrates directly into Claude Code as a plugin or runs standalone via CLI with multiple output formats (HTML, JSON, SARIF, CSV).

MalChela is a Rust-based malware analysis toolkit that exposes file analysis, YARA rule scanning, hash lookup, NSRL queries, and directory scanning through an MCP server for Claude integration. It supports Windows PE analysis, macOS Mach-O inspection, string extraction with MITRE ATT&CK mapping, and multi-source threat intelligence queries.

libreuiux-hooks registers three Claude Code hooks that inject UI best practices into your workflow: a SessionStart hook outputs stack context and relevant plugins for frontend projects; a PreToolUse hook confirms before editing secrets files; and a PostToolUse hook highlights accessibility and design issues after UI file edits. All hooks read JSON from stdin and return Claude-formatted context without requiring external APIs or writing files.

squirrelscan is a website audit tool that crawls sites and analyzes every page against 300+ rules across SEO, performance, security, accessibility, and more, delivering health scores and fixable issues. It includes two skills for AI agents: one for CLI operations and one for the audit-and-fix loop, plus an MCP server for integration with Claude Code, Cursor, and other coding platforms.

This Claude Code channel polls squirrelscan cloud audit events (audit completion, failures, and issues) and pushes them into your session so your agent can retrieve reports and fix detected issues. It requires the squirrel CLI with the channel command and an active squirrelscan login.

Monte Carlo Agent Toolkit brings data observability into Claude Code, surfacing blast radius, active alerts, and monitor coverage gaps before dbt edits via an MCP server connection. It provides skills for incident response, proactive monitoring, storage cost analysis, and push ingestion, with hooks that enforce data-safety checks automatically during development.

This Claude Code plugin enforces a security boundary around a project directory, allowing destructive file operations (rm, mv, cp, etc.) and file edits within the project while blocking them outside. It uses bash hooks to parse and validate commands before execution, handling edge cases like symlinks, cd tracking, command substitution, and variable expansion.

The envault plugin intercepts tool calls via a PreToolUse hook to substitute secret aliases and ciphers into plaintext values, keeping sensitive data encrypted until the moment of use. It pairs with the envault CLI and the guard.sh external tool to provide a secrets vault workflow that avoids storing plaintext credentials.

Subtext integrates Fullstory session replay into Claude Code, allowing agents to review recorded user sessions for debugging, reproduce bugs, and manage privacy rules for captured data. The plugin connects via MCP servers to Fullstory's hosted service, enabling read-only session analysis plus write capabilities for privacy rule management.

ThreatSwarm is an offensive security workspace for Claude Code with 27 specialist agents covering recon, exploitation, and post-exploitation, plus scope enforcement and evidence logging for penetration testing and red-team operations. It provides six engagement commands (engage, attack, pwned, hunt, ir, report) and three hook-based controls that gate tool execution by scope, log all commands, and aggregate findings.

A Claude Code plugin that enforces git safety and dev discipline for unattended agents through configurable hooks, prose rules, and hard bash-time blocking of force-push, --no-verify, and direct pushes to protected branches. It includes autonomous skills for debugging workflows and resolving merge conflicts, plus an instruction template (CLAUDE-APPEND.md) that applies consistent rules across all code-writing agents in a project.

guardrails is a PreToolUse hook that prevents destructive Bash commands during Claude Code execution by hard-blocking catastrophic operations like rm -rf / and docker volume rm, while allowing safe deletions within the workspace scope after confirming ambiguous cases. It inspects normalized command syntax with heredocs and comments stripped, making it effective against accidental or malicious filesystem damage without impeding legitimate development work.

This stop hook evaluates Claude's final answer against the turn's tool output using TypeSafe's Jev decision model to detect unsupported claims, then sends Claude back to re-check if hallucinations are detected. It integrates with the grounded-ai Python library to provide hallucination detection and fact-checking with optional fallback to LLM judges like Claude, GPT, or local models.

claude-leverage is an AI-coding-agent suite for Claude Code and Codex CLI that enforces security hooks, self-maintaining conventions, and cross-tool skills to keep repositories safe for sustained agent-driven development. It provides 16 skills, 3 subagents, and 9 deterministic security hooks that automate repo maintenance, surface context at edit time, and block dangerous operations before they happen.

EquilateralAgents is a collection of 22 self-learning AI agents that scan code for security issues, quality problems, and compliance violations, then harvest discovered patterns into YAML-based standards to prevent those mistakes from happening again. The system creates a feedback loop where agent findings are converted into institutional knowledge that gets automatically injected into future sessions across Claude Code, Cursor, Codex, and Windsurf.

PagoKit picks the optimal payment provider for your project and auto-generates a complete, secure integration including checkout, webhooks, database schema, and customer portal, backed by deterministic validators that block insecure writes at tool-use time. It knows 42 providers, 136 payment methods, 74 countries, and 106 currencies with their correct exponents, verifying webhook signatures and refund feasibility locally with no external accounts or telemetry.

This Claude Code plugin adds optional safety hooks for firmware development workflows, requiring confirmation before flash/erase operations and sensitive file access, while detecting embedded projects at session start and flagging empty files after edits. It intercepts tool use events via bash scripts that parse JSON input without requiring external services or API keys.

This Claude Code plugin installs three safety hooks for firmware development that prompt for confirmation before flash/erase operations and secret-file access, detect embedded projects at session start, and flag empty files after edits. It integrates with Claude's tool-use pipeline using bash scripts to filter operations without requiring external services.

This Claude Code plugin provides MCP integration with the Zscaler Zero Trust Exchange platform, exposing 402 tools across ZPA, ZIA, ZDX, ZCC, EASM, and Z-Insights services for managing policies, troubleshooting connectivity, and investigating incidents. The server operates in read-only mode by default for security and requires explicit opt-in to enable write operations.

ArmorClaude is a Claude Code plugin that enforces intent-based security by intercepting user prompts to capture a declared plan, then verifies every tool call against that plan before execution and logs all actions for audit compliance. It supports policy-based access control with data classification rules (PCI/PII), optional CSRG cryptographic proofs, and runs in a fail-closed mode where all tool calls are blocked if planning, identity, or token verification fails.

Claude Code plugin for Auvik cloud-based network monitoring that enables MSP analysts to interrogate device inventories, triage alerts, audit configurations, and plan capacity directly in chat through Conduit integration. Provides commands for device inventory reports, alert prioritization, network topology audits, tenant dashboards, and interface utilization analysis.

This cross-vendor security awareness plugin tracks training completion, phishing simulation results, and per-user risk scoring across connected awareness platforms like KnowBe4, Proofpoint, and Checkpoint Avanan through Conduit. It complements incident response with human-layer prevention, measuring training gaps and behavioral risk before incidents occur.

backup-pack bundles job health monitoring, restore-test verification, retention/RPO compliance, and DR readiness checks across connected backup and BCDR tools (Datto BCDR, Datto SaaS Protection, Spanning, Unitrends) via the WYRE MCP Gateway. It provides three independent skills and agents that discover what's actually connected and distinguish missed backups from failures, rank restore evidence, and flag retention/RPO gaps against contracts.

The Blackpoint Cyber plugin provides Claude Code with read-only access to CompassOne MDR data including detections, assets, vulnerabilities, and tenant hierarchies for MSP incident response investigations. It integrates through the Conduit MCP gateway and requires a CompassOne API token for authentication.

This Claude Code plugin maps live tenant configuration from M365, infrastructure tools, and documentation systems to compliance control frameworks (CIS, SOC 2, HIPAA) and detects unauthorized configuration drift, degrading gracefully when connectors are unavailable. It provides source-cited evidence packages, drift reports prioritized by risk, and pre-fills cyber-insurance questionnaires using live data from CIPP, Liongard, IT Glue, Hudu, and EDR platforms via the Conduit gateway.

Inforcer provides read-only governance visibility into Microsoft 365 security baselines across managed tenants, surfacing alignment/drift scores, identity inventory, and audit events through an MCP server integration. This plugin exposes tenant management, baseline comparison, compliance reporting, and the ability to trigger assessment runs, with one command-line interface for portfolio-wide drift reports and single-tenant posture snapshots.

This plugin integrates SaaS Alerts security monitoring into Claude Code, providing MSPs with multi-tenant event queries, anomaly detection, recommended actions, and device/user/billing management across M365 and Google Workspace environments. It connects via the SaaS Alerts MCP server and Conduit gateway, requiring a partner API key for authentication.

This Claude Code plugin normalizes security alerts across heterogeneous EDR/MDR/SIEM vendor stacks and runs triage playbooks, assembling incident timelines without vendor lock-in by discovering connected tools at runtime. It's designed for MSPs managing multiple clients with partial coverage of security tools, explicitly reporting what it can and cannot verify.

This Claude Code plugin integrates with ThreatLocker's zero-trust endpoint protection platform, enabling MSP analysts to triage application approval requests, investigate audit logs, and report on managed computer fleets without leaving chat. It provides commands for approval request prioritization, audit timeline assembly, computer inventory generation, offline agent detection, and multi-tenant pivoting across child organizations.

Makoto is a verification plugin that audits Claude Code agent behavior against logged records, blocking fabricated tool checks while allowing sixteen legitimate advisory self-checks. It enforces integrity across two-tier catalogs of 17 pre-checks and 30 stop gates, all calibrated to zero false positives.

Automated security vulnerability scanner applying OWASP Top 10, CWE Top 25, and CVSS scoring frameworks to any codebase, with deep PHP/TYPO3 analysis via 80+ checkpoints and PreToolUse warnings for risky operations. Provides standards compliance guidance, secure coding patterns, and DevSecOps pipeline integration across multiple AI agent platforms.

Strix Claude Code is an AI-powered penetration testing skill that runs security assessments using the Claude CLI with a Docker sandbox containing Kali Linux tools, MCP server, and browser automation. Users can launch scans via a TUI dashboard or CLI commands against web applications, APIs, domains, IPs, or source code repositories with customizable scan modes (quick, standard, deep).

This plugin automatically routes Snowflake-related prompts from Claude Code to Cortex Code for execution, detecting natural language queries about data and delegating them to Cortex's 55+ built-in skills. Non-Snowflake prompts remain in the current agent, with optional explicit routing via the `$cortex-run` command and configurable security envelopes (RO, RW, RESEARCH, DEPLOY) controlling what operations are allowed.

Railguard is a secure runtime for Claude Code that intercepts every tool call with policy-based allow/block/ask decisions, evasion detection via OS-level sandboxing, and memory safety features. It provides fine-grained access control between the all-or-nothing choice of manual approval or unrestricted execution, with path fencing, file snapshots, audit logging, and session replay capabilities.

Signet automatically signs every Claude Code tool call with Ed25519 cryptographic receipts and maintains a hash-chained audit log for compliance and verification. The plugin requires no configuration, stores keys locally, and uses a WASM module to sign tool actions without external dependencies.

SentinelXPrime embeds stage-aware security guidance into AI coding workflows across planning, implementation, review, and pre-release checkpoints, surfacing security concerns at the right moment through stack-aware skills for multiple frameworks. It operates as advisory-first analysis with read-only, transparent output and no silent enforcement or false assurance.

This plugin automatically loads credentials from a CLAUDE_ENV_FILE environment variable on session start and redacts secrets from CLI output in real-time using the nopeek CLI tool. It intercepts both session initialization and tool execution to prevent sensitive data from being exposed in logs or terminal output.

A Claude Code plugin that scaffolds CrowdStrike Falcon Foundry apps from natural language prompts, generating API integrations, workflows, UI pages, functions, and collections deployed to the Falcon console. It includes 12 skills with intelligent routing hooks that guide users toward Foundry-specific patterns and guard against common CLI mistakes.

This Claude Code plugin provides Git workflow utilities including worktree management, branch cleanup, secret scanning, and configuration validation. It implements guardrails via PreToolUse hooks that can allow, deny, or rewrite tool inputs based on custom policies.

Hardstop is a pre-execution safety layer that blocks dangerous shell commands and credential file reads using pattern matching against 428 security patterns plus LLM analysis for edge cases, operating on a fail-closed policy. It integrates as a hook into Claude Code to validate every command chain before execution and provides status, logging, and bypass controls.

Little Canary is a Claude Code plugin that intercepts user prompts via a hook and blocks code turns when a local Little Canary server rejects them. It integrates with your development environment through a shell-based hook triggered on prompt submission.

BioNexus is a pre-submission review layer that validates epistemic claims in AI-assisted multi-donor single-cell differential expression analyses, locating evidence gaps and recommending repairs before manuscript submission. It separates computational permission from claim ceilings, permitting valid computations while capping claims to what the evidence actually warrants using context-conditioned rules derived from established statistical and biological principles.

Official Google Cloud Storage plugin that bundles 5 Agent Skills with a Cloud Storage MCP server for managing buckets, objects, data transfer, security, and infrastructure. The skills provide natural-language expertise for access diagnostics, security assessments, FUSE mounts, and bucket architecture while the MCP server offers structured tools via MCP Toolbox.

HealthClaw Guardrails is an open-source FHIR and MCP security layer that enforces PHI redaction, step-up authorization, immutable audit trails, and tenant isolation between AI agents and clinical data. It provides 14 MCP tools supporting FHIR R4 US Core v9 and FHIR R6 ballot3, with reference implementations for health record ingestion (Fasten Connect), data quality evaluation (Curatr), and portable health record export (HealthEx).

Agent Guard is a local-first guardrail that inspects user prompts, tool inputs/outputs, and changed files in Claude Code and Codex sessions to block or mask credential leaks before they occur. It uses hooks across session lifecycle events and includes optional PII filtering and Git/CI integration points for defense-in-depth secret leak prevention.

The fuse-security plugin detects and remediates security vulnerabilities including OWASP Top 10 issues, SAST scanning results, CVE risks, dependency problems, and exposed secrets. It integrates shell execution and tool hooks to audit code and dependencies in real-time.

APort Agent Guardrails intercepts tool calls before execution and evaluates them against a passport-based security policy, blocking unauthorized actions through a PreToolUse hook. It provides deterministic authorization enforcement across multiple frameworks (Claude Code, OpenClaw, LangChain, CrewAI, and others) using either hosted or local passport policies, with verified resistance to prompt-injection attacks.

ThumbGate is an MCP-compatible gate system that prevents AI agents from repeating mistakes by converting thumbs-down feedback into permanent pre-action blocking rules. One thumbs-down blocks a pattern forever across sessions and models, eliminating duplicate token spending on the same error.

SpecLock enforces project constraints written in CLAUDE.md, AGENTS.md, and .cursorrules files using semantic conflict detection, Git hooks, and MCP tools that intercept Claude Code writes, edits, and bash commands before execution. It operates in advisory mode by default and can be switched to strict blocking mode to prevent AI agents from violating explicit project rules through keyword matching, synonyms, and indirect action detection.

Crewforth provides disciplined agents and skills for Claude Code with tool-level gate hooks that enforce commit/push approval, guard destructive operations, and measure context usage. It includes git commit trace, secret, and bloat scanning through bash integration and session rehydration capabilities.

repo-security-review is a standalone Claude Code skill that performs comprehensive multi-phase security audits of code repositories, including secret scanning, architecture analysis, dependency vulnerability checks, OWASP code review, and dynamic verification with optional proof-of-concept generation. It supports full-repository scans, pull-request diffs, multi-service analysis, and vendor tool audits, with findings validated through isolated subagents before generating a single markdown report.

NEUS provides verified identity, limited permissions, and reusable trust receipts for AI agents across Cursor, Claude Code, Codex, and VS Code through a single setup. The neus-trust-workflow skill guides agents to verify permissions and sensitive actions, reusing existing trust receipts and summarizing results as Passed, Action needed, or Blocked.

RepoPilot snapshots your repository before a Claude session starts and reviews all changes before the agent stops, blocking any session that skips tests, removes auth/error handling, or lets untrusted input reach dangerous sinks. The plugin runs deterministically and locally using the repopilot CLI via Git hooks and an MCP server, requiring no external API keys or services.

A suite of 59 Claude Code hooks that detect and block 30 LLM dark patterns (sycophancy, paternalism, false-success, permission-loops, fake recall, fake citations, and others) at the closeout boundary using deterministic textual enforcement. Operates entirely out-of-band with no model in the verdict path, supporting multiple locales and destructive-command surface hardening through extensible rule packs.

This Claude Code hook parses compound Bash commands (pipes, chains, subshells) into segments using shfmt AST and matches each against allow/deny lists to auto-approve when all parts are permitted. **This plugin is deprecated and archived as of July 2026; Claude Code now handles compound commands natively, and an unpatched security vulnerability exists where redirects bypass permission checks.**

The akf plugin auto-stamps Claude Code's file output with trust metadata, while checking that metadata before building on existing work. It uses PostToolUse hooks and an external autostamp.sh tool to track and verify provenance of AI-generated files.

This plugin provides personalized AWS guidance for startups, drawing on patterns from 350,000+ startups to advise on architecture, cost, security, and migration across multi-account and multi-region environments. It includes startup eligibility checks for AWS Activate credits and access to 60+ exclusive startup offers, built by AWS Startup Solutions Architects.

Semgrep Guardian scans agent-generated code for security vulnerabilities using Semgrep's static analysis engine integrated as a Claude Code plugin. It monitors tool usage before and after execution, checking generated code at session start, end, and stop events to catch security issues early.

This plugin embeds HawkScan dynamic application security testing (DAST) into Claude's agentic workflow, automatically generating stackhawk.yml configs, running scans via CLI or Docker, and transforming security findings into prioritized remediation tasks. It integrates with StackHawk's platform to validate configurations, parse results, and trigger re-scans after fixes to confirm remediation.

This Claude Code plugin provides a Java quality toolkit with three integrated agents covering security (OWASP compliance), performance optimization (N+1 queries, memory, threading), and testing frameworks (JUnit 5, Mockito, Testcontainers) for Java 8+ projects. It operates through shell commands and hooks to analyze and improve code quality during development workflows.

StackHawk Agent Skills teach your AI coding agent to scan for security vulnerabilities, report security posture, integrate scanning into CI/CD pipelines, and seed test data—all without leaving the coding workflow. The skill set includes HawkScan for DAST scanning, StackHawk API for cross-app reporting, CI integration, and data seeding capabilities.

This Claude Code plugin integrates Aikido Security to scan code for vulnerabilities, secrets, and infrastructure-as-code issues via the Aikido MCP server. It retrieves and displays security findings directly from your Aikido feed within the Claude Code editor.

This Claude Code plugin intercepts tool calls via a PreToolUse hook to validate assumptions before execution, using an external check-assumptions.sh script to assess whether preconditions are met. It helps prevent tool misuse by catching invalid assumptions at runtime.

This Claude Code plugin installs a hook that intercepts Claude responses at the Stop event to scan for speculative language, unverified claims, and hallucination patterns before delivery. It performs real-time content screening to help mitigate unreliable or fabricated outputs without requiring external APIs or services.

The ar plugin provides autonomous execution, file policies, and safety guards for Claude Code and other AI coding assistants through task-lifecycle checks and command safety validation. It integrates natively across multiple harnesses (Claude Code, Codex, Qwen Code, OpenCode, Pi, and others) with hook-based event handling and shared command grammars.

dogma synchronizes Claude instructions from a centralized source repository with intelligent merging, and enforces security and consistency rules via 33 hooks that detect AI traces, enforce permissions, validate secrets, and block risky operations. Teams and enterprises can maintain a single source of truth for coding standards and AI guardrails across multiple projects, while individual developers can keep their rules in sync across repositories and machines.

skilltotal is a Claude Code plugin that intercepts package installations via a PreToolUse hook, scanning each package for malicious indicators and suspicious patterns before allowing installation. It automatically denies confirmed threats and prompts for approval on high-risk packages, look-alike names, or packages that failed security checks.

cmdlens is a Claude Code plugin that analyzes Bash commands before execution, displaying risk assessments and recovery information to help developers avoid destructive operations. It uses Python-based hooks triggered at session start and before each command to evaluate shell safety.

mask2ai detects and masks personal data (emails, phones, payment cards, IBANs, national IDs, names, addresses) before it leaves Claude Code, then restores real values in tool outputs and on screen using a local placeholder map. The plugin intercepts prompts, tool calls, and responses via five hooks, supporting text files, PDFs with OCR redaction, and images with pixel-level blurring on macOS.

Squidbrake intercepts every Claude Code tool call (Bash, PowerShell, file operations, WebFetch, MCP tools) and evaluates it against customizable rules before execution. Destructive commands are blocked, risky operations require approval via dashboard/phone/Slack, and all activity is logged in a tamper-evident audit trail.

Endor Labs workflow agents and setup for Claude Code that provides 11 agents and 1 skill for scanning and remediating code dependencies across multiple IDE and CLI platforms. The plugin runs shell commands and hooks into Claude Code's tool use workflow to enable automated security and configuration workflows.

Claude Tools provides guard hooks (command-guard, leak-guard, mcp-guard, post-guard) that enforce security policies on tool calls, credential access, and MCP server interactions through shell-based preflight checks. The guards require bun and fail safely open if bun is missing; users can opt into a hardened ISOLATED profile with credential restrictions and permission allowlists.

A standalone Agent Skill that orchestrates multiple AI consultants (Gemini 3.8 Flash, Codex, GLM-5.3, Kimi K3) and Claude subagents for consensus-driven code reviews, plan validation, and architectural decisions with weighted synthesis and false positive filtering. Invoked via `/council` commands with specialized review modes (security, architecture, bugs, quality, adversarial, etc.) and includes a secret scanning gate using gitleaks before contacting external consultants.

This Agent Skill provides comprehensive assistance with the Doppler CLI for secrets management, including project/config management, secrets injection, CI/CD integrations, and security best practices. Users can invoke it with `/doppler` or ask about topics like setting up Doppler, injecting secrets, syncing to cloud providers, and managing service tokens.

Rugproof is a Claude Code plugin that transforms your editor into a full-stack smart contract security auditor, providing vulnerability detection, exploit PoCs, mainnet-fork simulation, and invariant generation across Solidity and Vyper on all major EVM chains. It includes 45 slash commands, 23 specialist agents, 45 auto-invoked vulnerability skills, and 13 MCP servers for comprehensive static analysis, testing, and post-deploy monitoring.

This Claude Code plugin installs a security reminder hook that triggers before tool usage to warn developers about potential security vulnerabilities like command injection, XSS, and unsafe code patterns. It uses Python 3 to analyze code and flag risky practices during file editing workflows.

Access real-time and historical DeFi data across 36 blockchains via DexPaprika's MCP server, including DEX liquidity pools, token prices, OHLCV candles, and transaction history. The plugin provides an agent for DeFi security analysis (honeypot and scam detection) plus four skills for token security assessment, technical analysis, batch price lookups, and trending pool discovery.

Iris is an open-source MCP server that scores agent output for quality, safety, and cost using 13 built-in evaluation rules, PII detection, prompt injection detection, and real-time cost visibility with a web dashboard. It works transparently with any MCP-compatible agent (Claude Desktop, Cursor, VS Code, etc.) by logging hierarchical trace trees, flagging safety failures, and enforcing budget thresholds without requiring code changes.

This plugin connects Claude to ManageLM for remote infrastructure management, enabling natural language control over Linux and Windows servers across single or multiple machines. It provides 31 built-in skills for package management, services, networking, security audits, Docker, Kubernetes, databases, and file transfers through a secure outbound-only agent architecture.

Sanctuary Framework is an open-source plugin that wraps MCP-compatible agents with encrypted state storage, cryptographic identity, zero-knowledge proofs, portable reputation, and an audit tool to identify security and privacy gaps. It provides 80+ MCP tools across cognitive, operational, and verifiable reputation layers, with enforcement currently live on macOS and self-custodied key management across all platforms.

SOSA Governor implements real-time governance for Claude Code by classifying MCP tool calls by impact level, blocking high-impact actions (like sending messages or deleting data) until user approval, and maintaining audit logs and trust scores. The plugin uses hooks to intercept tool calls at session start and pre/post execution, plus an on-demand skill for audits, compliance checks, and trust management.

dotforge enforces declarative runtime policies on Claude Code tool calls—like "search before writing" or "no destructive git"—by compiling YAML behavior definitions into PreToolUse hooks that persist session-scoped state and escalate policy violations. It provides 7 agents and 20 skills for bootstrapping, auditing, syncing, and capturing behaviors across multiple Claude Code projects, with hooks operating at PreToolUse, PostToolUse, and Stop events.

io-guard intercepts calls to file and shell tools, validates and sanitizes potentially dangerous operations, and either fixes safe issues automatically or returns a structured error explaining what went wrong. It integrates via hooks at session start, prompt submission, and before/after tool use to protect agents from unintended file or shell commands.

This Claude Code plugin intercepts tool calls when Claude detects "shortcut-taking" language patterns (like "efficiently") and reminds it to proceed step-by-step instead. It blocks unsafe bulk operations that risk corrupting files and losing uncommitted changes, using a PreToolUse hook with multilingual phrase detection across 8 languages.

The veritasacta-verify skill provides cryptographic verification and validation for Acta protocol records — a tamper-evident, hash-chained ledger system for human-AI coordination with typed contributions (claims, questions, predictions) signed via Ed25519. It enables offline verification of signed receipts, VOPRF anonymous credentials, and Knowledge Unit bundles used in vulnerability disclosure workflows and governance audit trails.

zd-core is a foundational security and workflow plugin that runs Node-based guardrails (pre/post-tool hooks) to block dangerous operations like recursive deletes and credential exposure, while providing stack detection and developer handoff documentation. It includes skills for architecture analysis, secrets auditing, onboarding setup, and a terse output style, with all scripts platform-agnostic and testable as CI gates.

appstore-precheck statically scans iOS apps for the 71 most common App Store rejection vectors—covering code, metadata, screenshots, and paywall—then runs 56 semantic deep-review checks before submission. It ships as a portable Agent Skill (native to Claude Code, Cursor, Gemini CLI, and others) and delivers a GREEN / YELLOW / RED verdict from Pierre, a French critic character, without editing your code.

A PreToolUse hook that blocks Claude from running git commands that stage protected paths, whole-tree adds, or rewrite history. It silently allows all other git and non-git commands, reading configuration from optional per-project JSON files or defaults.

credential-guard is a Claude Code plugin that intercepts tool execution via a PreToolUse hook to detect and block credential leakage, including writes to .env files, API keys in shell commands, hardcoded tokens, and service account JSON files. It uses pattern matching to identify common secret patterns like AWS_SECRET, GITHUB_TOKEN, OPENAI_API_KEY, and credential filenames before they are executed.

This Claude Code plugin implements git safety hooks that intercept and block dangerous git operations like force-push, hard-reset, forced branch deletion, and git clean before they execute. It protects the main/master branch by preventing these destructive actions through PreToolUse event hooks.

Godmode is a local, tamper-evident evidence ledger that verifies what coding agents actually executed by maintaining a hash-chained record of commands, changes, and refusals rather than trusting agent claims. It enforces gates at runtime through hooks on tool use, session events, and user input to prevent irreversible operations and grade agent "done" claims against recorded evidence instead of agent word.

A PreToolUse hook that inspects and blocks destructive Infrastructure-as-Code commands (Ansible playbooks without --check, Terraform/OpenTofu/Terragrunt apply/destroy/import, and write-mode operations) before Claude executes them via the Bash tool. Read-only IaC operations like plan, validate, and check-mode runs pass through unaffected, allowing agents to safely test infrastructure code without applying unwanted changes.

llm-redact is a proxy control plugin that provides slash commands for monitoring status, live traffic, sessions, redaction previews, routing, spend tracking, and audit verification of LLM traffic. It integrates with llm-redact-posture to enable guarded configuration editing and security controls through a Claude Code environment.

This standalone Agent Skill audits whether an app's legal documents (Privacy Policy, Terms of Service, Cookie Policy, DPA) actually reflect what the app does, checking for critical, important, and minor compliance gaps. It supports GDPR, CCPA/CPRA, LGPD, PIPL, UK GDPR, and Australian Privacy Act jurisdictions without requiring external APIs or tools.

This safety-essentials plugin provides 5 protective hooks that intercept dangerous operations in Claude Code, blocking destructive commands like `rm -rf`, force-push, hard-reset, `.env` overwrites, and package publish actions. The hooks run at the PreToolUse event stage to prevent these risky operations before they execute.

A design audit plugin that scores projects across 12 dimensions—color, typography, accessibility, layout, and more—using WCAG and APCA standards, reporting exact file locations, measured values, and specific fixes for each issue. It works as a Claude Code plugin, Agent Skills, or standalone CLI tool with zero runtime dependencies and no external keys required.

zetetic-gates enforces quality gates on Claude Code and Codex through pre- and post-tool hooks that check source craftsmanship, prose standards, secret exposure, and test validity before commits and pushes. It validates that new tests can fail against base code, prevents credential leaks, and applies structural/prose checks using project-specific configuration profiles.

This Claude Code plugin enforces session-aware shell guardrails during code execution by hooking into tool usage and session lifecycle events. It requires the caushell-claude-hook runtime to validate and control shell commands before and after they run.

This MCP server integrates Graylog log searching into Claude, enabling log queries by absolute/relative timestamps, distributed trace tracking across services, and surrounding-context analysis for production debugging. It provides tools for stream discovery, field aggregation, composite incident analysis, and system health checks with comprehensive validation and error handling.

The JFrog plugin connects Claude Code to JFrog's platform for artifact management, security scanning, and supply-chain governance using Artifactory repositories, package curation, and the Agent Guard MCP server. It provides skills for interacting with Artifactory, CVE lookups, package safety checks, and enforces skill governance policies via Agent Guard to keep AI-driven installs and actions within organizational security boundaries.

This Claude Code plugin adds game development safety hooks that identify the game engine in use (Godot, Unity, Unreal, or web frameworks), prompt for confirmation before touching secrets/signing keys or running destructive git commands, and remind you to run tests after code changes. It operates transparently via shell scripts triggered at session start, before tool use, and after file writes, requiring only bash and jq.

nxtg-forge is a governance-native AI development platform providing 33 agents, 24 commands, and 27 skills with comprehensive security controls including 4 blocking guards, Semgrep scanning, and drift detection. The plugin uses hook events for pre/post tool execution and command stop gates to enforce compliance and prevent unintended behavior during agent execution.

This plugin intercepts tool execution via a PreToolUse hook to validate Bash commands against a deny-by-default security policy before they run. It prevents unauthorized shell operations by enforcing configurable allow/deny rules at the command level.

Teaches Claude to integrate and debug the Hyper Solutions anti-bot API (Akamai, Incapsula, DataDome, Kasada) across Go, Python, and JavaScript/TypeScript SDKs, with a bundled skill and two MCP servers for request inspection and HAR analysis. The powhttp MCP captures live traffic via proxy to analyze header order and TLS fingerprints, while the har-analyzer MCP runs the fingerprint rule set against exported HAR files.

Pre-submission compliance auditor that scans iOS and Android app projects against Apple's Review Guidelines and Google Play Developer Policy, flagging rejection risks with exact file references and auto-fixing safe violations. Spawns five parallel subagents to audit privacy, IAP, permissions, metadata, and crash risks, outputting a terminal report plus an interactive HTML dashboard.

SCOPE evaluates MCP tools and API actions for security and compliance risk, mapping them against 26 regulatory regimes including GDPR, HIPAA, PCI, SOX, SOC2, EU AI Act, and ISO 42001. The plugin performs pre-flight risk assessment for agentic workflows to identify business impact and regulatory exposure before execution.

subrosa archives every Claude Code session into a local, searchable SQLite database with keyword and semantic search capabilities, automatic session recall, and optional encrypted backups—all without uploading any data unless explicitly opted into checkpointing. The plugin intercepts session lifecycle events to persistently store transcripts, mask secrets, and provide recall snippets while keeping all memory local and private by default.

Attacca is a multi-agent orchestration layer that translates product requirements into working, tested, and audited code across eight AI coding tools (GitHub Copilot, Cursor, Cline, Windsurf, Claude Code, Codex CLI, Gemini CLI, Google Antigravity). It provides eight declarative skills spanning code review, test-driven development, security audits, supply-chain defense, SBOM generation, quality gates, incident response, and workspace mapping—all with shared state files and adaptive workflows based on tool availability and budget.

libre-secops-hooks adds security awareness to Claude Code editing through three hooks: a session-start security profile scan, a pre-edit confirmation prompt for secret/key files, and a post-edit local vulnerability pattern scan. It uses bash and jq to detect secrets, weak cryptography, injection flaws, and configuration issues without making network calls or writing files.

This Claude Code plugin adds security awareness through three hooks: a session-start security profile scan, a confirmation prompt before edits to secret or key files, and a post-edit vulnerability pattern scan for SQL injection, XSS, hardcoded secrets, weak crypto, and other common issues. All scanning is performed locally with bash and jq, requiring no external services or API keys.

mcp-fortress scans MCP servers for security vulnerabilities, prompt injection attacks, and tool poisoning before installation. It verifies MCP package integrity and detects malicious tools through integration with Smithery's MCP ecosystem.

This hook plugin intercepts git commits and GitHub CLI commands before execution to block any that contain AI-assistant attribution mentions (Claude, Copilot, Codex, etc.), preventing them from being added to git history. It runs as a PreToolUse hook using only Python standard library, inspecting command-line arguments and referenced message files to catch co-authored-by trailers and "Generated with" footers across git, GitHub CLI, and GitHub MCP tools.

Fetches and sanitizes public web pages and search results with network policy enforcement, URL validation, and content cleanup to reduce attack vectors. Provides MCP tools for fetch, search (via Brave API), and URL checking with configurable rate limits and domain policies.

This plugin audits Claude Code community skills for 26 security attack patterns including prompt injection, data exfiltration, credential access, reverse shells, and privilege escalation using 3 parallel scanning agents and runtime defense hooks. It includes manifest inspection, Semgrep custom rules, CLI scanning tool, and AWS IAM policy templates for least-privilege environments.

This plugin integrates Sonatype Guide's MCP server to provide Claude Code with software supply chain intelligence and dependency security analysis. It automatically scans dependencies for vulnerabilities, recommends secure versions, and audits projects for security, license, and policy compliance issues.

USAP is an open-source cybersecurity agent skills library with 79 LLM-runnable security workflows (skills) and 12 orchestrator agents (cs-*) that emit a standardized 11-field JSON contract mapped to MITRE ATT&CK and NIST CSF 2.0. It runs in any LLM—Claude, ChatGPT, Gemini, Ollama—as a Claude Code plugin, MCP server, or by pasting a markdown bundle, with human-approval gates and L1–L4 autonomy levels for SOC and AppSec teams.

This plugin connects Claude Code to Vanta's hosted MCP servers to provide direct access to security and compliance tools, including compliance test remediation, control management, vendor risk assessment, vulnerability tracking, policy governance, and compliance gap analysis. It uses OAuth for authentication and automatically routes to the appropriate regional endpoint (US, EU, or Australia) based on the user's configuration.

version-sentinel hard-blocks dependency additions and updates until the agent records a fresh, source-cited version check against package registries (npm, PyPI, Cargo, NuGet), preventing hallucinated or stale versions from entering the codebase. It enforces this constraint via PreToolUse hooks that intercept Edit, Write, and install commands before they land, rejecting changes with exit code 2 if no recent registry lookup is cited.

a11y-fixer scans HTML and JSX code for accessibility violations and issues. It operates as a self-hosted skill with no external API dependencies, using local tools to perform static analysis.

This plugin generates WCAG compliance audit reports to help ensure web accessibility standards are met. It includes an MCP server and skill that runs accessibility checks using standard tooling.

This plugin generates access review reports using an MCP server and a custom skill. It requires npx for local execution and offers tiered pricing with free and paid plans.

AD Guardrails automatically injects security, architecture, performance, and delegation rules into Claude Code at session start, before each code write, and before git push, using 4 specialized agents and 12 skills to enforce OWASP compliance and scalability for 10,000+ users without repeating instructions. The plugin reinforces rules through hooks, automated audits (gitleaks, semgrep, trivy), and a global ~/.claude/CLAUDE.md file that persists across all projects and sessions.

This Claude Code plugin provides infrastructure-level safety and control through four registered hooks that block dangerous bash commands, prevent secret leaks, track session context, and require verification before stopping. It ships a recommended-settings.json configuration fragment with permission denylist and workflow flags, requiring no API keys or external services.

AgentOps wraps Claude Code CLI sessions in 7 security layers and structures work through enterprise guardrails, 12 specialist agents, and a full delivery lifecycle from brainstorm to merged PR. It provides 40 slash commands, 44 hooks, mandatory TDD enforcement, real-time 3D dashboards, and auto-evolution from failures.

AgentReverse extracts tools, skills, plugins, and MCP servers from any source (GitHub repos, local configs, articles) and installs them into your agent with security scanning and manifest tracking. It enables cross-agent portability, backup/restore, and environment auditing via CLI commands and an MCP server.

Detects and fixes OpenAPI/GraphQL spec-vs-code drift across 10+ frameworks, hardens endpoints with request validation, RFC 9457 error envelopes, and idempotency handling, and audits job queues for at-least-once reliability—all statically without running servers or sending requests. Grounded in real file:line evidence and diff-aware, it reconciles contracts continuously in the editor by updating either the spec or the code to match the authoritative side.

branch-guard is a PreToolUse hook for Claude Code that intelligently classifies git and gh commands by safety and branch context, auto-approving read-only operations, branch creation, and commits/pushes on feature branches while requiring confirmation for protected branches and destructive operations. It reduces routine approval prompts while maintaining guardrails for operations like pushing to main or force-resets that could cause problems.

Smart Permissions is an AI-powered hook for Claude Code that auto-approves safe tool operations and auto-denies dangerous ones using a two-layer system: fast deterministic bash rules (Layer 1) and optional AI evaluation for ambiguous calls (Layer 2). It supports multiple providers (Claude, Gemini, Ollama) and customizable permission policies to reduce manual permission prompts.

CI & Incident Medic triages failing GitHub Actions runs, GitLab CI, and CircleCI pipelines with root-cause classification and corrected YAML, hardens Dockerfiles into secure multi-stage non-root images, pre-flights Kubernetes manifests for silent failures before cluster deployment, and auto-drafts blameless postmortems from incident evidence. The plugin ships with five commands, three agents, four auto-activating skills covering failure taxonomy, Dockerfile smells, Kubernetes validation, and postmortem writing, plus a PostToolUse hook that nudges triage when shell CI/build/test/deploy commands fail.

Cloakroom is a privacy layer that masks secrets, PII, and API keys before Claude Code processes files or prompts, then restores the real values only when writing files or running local commands. Detection runs locally using rule-based matching and a small detection model, with all masking/unmasking and vault storage kept entirely on your machine.

DeployShield is a production safety guardrail that intercepts and blocks write/mutating operations on cloud, database, IaC, and deployment CLIs (aws, kubectl, terraform, etc.) while allowing read-only commands to execute. It provides deterministic, context-aware protection with deep recursive scanning of subshells and execution wrappers, and can be configured via `.deployshield.json` to permit operations in non-production environments.

Env-guardian scans codebases for exposed secrets, generates .env.example templates, and validates environment configurations against schemas. The Pro tier adds secret rotation capabilities to update compromised credentials across a project.

This Claude Code plugin intercepts dangerous `gh release create/delete/edit` commands and enforces safe, supply-chain-secure release workflows that detect project ecosystems, bump versions across all files, submit changes for review via PR, and trigger CI-driven signed releases with SBOMs and attestations. It supports TYPO3, PHP, Node.js, Go, Python, Rust, and skill repos through three slash commands: `/release` for full orchestration, `/release-prepare` for version bumping only, and `/release-status` for health checks.

A PreToolUse Bash guard that blocks dangerous commands like supply-chain attacks, destructive disk operations, and credential access, with a PostToolUse audit log that records executed commands with secrets redacted. Rules are configurable per rule (off/ask/block) and work across any project without organization-specific logic.

hipaalint-ai scans healthcare codebases for potential HIPAA, HITRUST CSF, and SOC 2 violations across 266 rules, detecting PHI exposure and generating risk scores and audit reports. It provides CLI scanning, auto-remediation for simple violations, and compliance scoring—designed as an informational tool for code review, not legal compliance certification.

LLM App Hardener is a repo-native toolchain that scaffolds eval suites, red-teams for prompt injection, hardens structured-output reliability, and audits token cost by riding promptfoo/DeepEval/Pydantic rather than replacing them. It detects your LLM SDK and framework first, then applies patterns grounded in real file:line evidence across prompts, schemas, and call sites.

This Claude Code plugin intercepts tool usage to prevent secrets from being transmitted and blocks writes to sensitive files like git hooks or shell configurations that could execute arbitrary code later. It performs local hashing for verification without sending data externally or relying on network calls.

MCP Server Smith scaffolds, audits, and hardens Model Context Protocol servers against the MCP 2026-07-28 spec, catching security risks like confused-deputy and prompt-injection through static file analysis without running any server. It includes commands to audit existing servers, scaffold new ones on stateless Streamable HTTP transport, and migrate servers off the deprecated HTTP+SSE transport while ensuring OAuth 2.1/OIDC compliance.

Opsera DevSecOps Agent provides AI-powered security scanning, compliance auditing, and architecture risk analysis directly from Claude Code, with tools for vulnerability detection, secret detection, SAST, compliance verification (SOC2, HIPAA, PCI-DSS, ISO 27001), and SQL injection detection. The plugin integrates with the Opsera platform via OAuth authentication and reports anonymized telemetry to track security posture and remediation progress.

Patrol is a policy engine for Claude Code that enforces coding rules, prevents dangerous actions, and guides workflows through three layers of safety, workflow, and personal rules with adaptive enforcement. It monitors Claude's tool use and prompts via lightweight hooks, consuming zero tokens during normal coding sessions with no violations.

prod-guard is a PreToolUse hook that intercepts Bash commands targeting infrastructure tools (kubectl, gcloud, terraform, etc.) and blocks or prompts on mutating operations against production targets or those relying on shared ambient state like kubeconfig contexts. It resolves each command's actual target from explicit flags or ambient configuration, classifies it against configurable patterns, and uses self-healing fix-its to guide Claude toward safe explicit targeting.

AI-powered Proxmox VE VM and container lifecycle operations with built-in governance including unified audit logging, budget guards, undo tokens, and risk-tier labeling. Delivers 43 MCP tools for read and write operations across VMs, containers, storage, and cluster management, verified against real Proxmox VE 8.4.19 deployments.

This Claude Code plugin adds AI-powered code review and a blocking pre-push gate that runs natively on your Claude subscription, using methodology adapted from open-code-review. The gate deploys a code-reviewer subagent to scan unpushed commits for high-severity issues, performs independent hallucination checks, and fails closed to prevent non-reviewed code from being pushed.

River Review turns code review criteria into versioned, repo-owned skills executed by perspective-based reviewer agents (code, security, performance, architecture, testing, adversarial) to verify findings against diffs while keeping high-risk judgment with humans. It integrates with Claude Code as a capability pack, running through plan and execution gates and maintaining operating memory to ensure consistent, reproducible, and auditable team review standards.

This Claude Code plugin automatically rewrites `rm` commands to `trash` via a PreToolUse hook, supporting trash-cli-compatible flags like `-r`, `-f`, `-i`, and their long forms while avoiding incompatible flags or `git rm` commands. It uses a compiled Rust binary built on first session to minimize startup overhead and requires `cargo` and the `trash` command to be installed.

This security-roles plugin enforces deterministic security scanning gates at multiple points in the coding workflow—blocking before code execution, rescanning after tool use, and terminating sessions with unresolved findings. It includes 2 auth/security agents and runs built-in rules by default, with optional semgrep integration for additional scanning layers.

Security Watchdog is an automatic scanner that monitors newly installed or updated Claude Code plugins at session start, detecting prompt injection attacks, malicious hook scripts, and data exfiltration attempts. It performs comprehensive static analysis of hook scripts, skill definitions, and plugin permissions using both pattern matching and LLM-based reasoning to identify threats unique to AI extension ecosystems.

A seven-skill pack for scoping and advancing AI initiatives within public-sector and non-profit contexts, covering opportunity screening, stakeholder mapping, procurement navigation, equity assessment, and decision-readiness framing tailored to elected bodies and public-value outcomes rather than private ROI. The skills work together to guide AI proposals from initial concept through formal approval by public decision-makers, accounting for regulatory constraints, disparate-impact risks, and the distinct governance dynamics of public agencies.

workspace-guard is a PreToolUse hook that guards shell commands and file tools in Claude Code by parsing arguments and prompting for confirmation only when a path resolves outside the project root. It allows in-repo reads to run silently while catching out-of-workspace access patterns like `/etc/passwd` reads, sibling checkout writes, and unanchored process kills.

eight-eyes is a multi-agent code review plugin that enforces eight constrained roles (skeptic, security auditor, performance reviewer, etc.) through hook-enforced walls to prevent AI agents from agreeing with each other on the same narrative. Each role has isolated capabilities, blocked tools, and structured evidence requirements to catch issues like security vulnerabilities, missing tests, and performance problems that single-agent reviews miss.

This plugin provides a WCAG-EM accessibility audit workflow that guides users through scoping, evaluating, reporting, remediating, and retesting web content with conformance scoring. It integrates six skills and a phase-gate system to systematize the accessibility compliance process from assessment to remediation.

This plugin connects Claude Code to the hosted Almanax MCP server to scan Git commits for security vulnerabilities and work with security findings directly within the editor. Users authenticate with an API key and can trigger scans on commits, receiving summarized security reports through natural language prompts.

anti-hall enforces verify-first discipline in Claude Code with 58 always-on Node hooks that block fabricated APIs, AI self-credit, force-pushes, and fake completion claims. It ships 18 skills for root-cause analysis, orchestration, and handover management, plus optional Jev classification to reduce hallucination detection false negatives.

Bounty Operator is a pre-submission adversary tool for bug bounty hunters and smart-contract auditors that challenges draft security findings before submission by arguing against claims with file-and-line references, returning verdicts like "submit", "rewrite-then-submit", "prove-first", "hold-duplicate", or "drop". It runs on your own model in the browser, over MCP in Claude Code or other clients, or from the command line, with support for OpenRouter, Anthropic, OpenAI, Gemini, xAI, DeepSeek, Mistral, or Groq.

cbm-guard is a Claude Code plugin that intercepts five known categories of misleading query patterns in codebase-memory-mcp, including incorrect EXISTS bindings, missing control groups in counts, node/entity confusion, orphan query overestimation, and Route node construction failures. It also checks index freshness to prevent stale results from appearing valid, with configuration via cbm-guard.config.json or zero-setup defaults.

This Claude Code plugin intercepts permanent-delete shell commands (like `rm -rf`) via a PreToolUse hook and redirects them to a recoverable trash workflow instead. It protects users from accidental data loss by ensuring deleted files can be recovered rather than permanently removed.

Clawkeeper adds real-time threat detection, secret scanning, and compliance auditing to Claude Code and Claude Desktop, catching credential exfiltration, reverse shells, prompt injection, and 24+ threat patterns before execution—all running locally with zero network calls in free mode. It deploys hooks at four execution points (UserPromptSubmit, PreToolUse, PostToolUse, SessionStart) to grade your setup, inspect installed plugins, and scan for exposed API keys and hardcoded credentials.

This Cloudflare management plugin provides read-only snapshots, findings, and recommendations for Cloudflare accounts while enabling guarded changes through a safety-focused workflow. It includes three agents and one skill to inspect and manage Cloudflare configurations from any Claude Code project.

A GRC compliance plugin with 51 skills spanning 30+ regulations to help teams scope, assess, remediate, certify, and monitor compliance requirements. It integrates external tooling (phase-gate.sh) and hooks into Claude Code's PreToolUse event to provide compliance guidance across the full lifecycle.

create-starter scaffolds Starter Series projects and audits their release, CD, and security hygiene with nine MCP tools, a CLI, and a Claude Code skill. It generates Launch Proof Reports that verify CI/CD configuration, dependency security, and instruction integrity against a known baseline without requiring live vulnerability scans or human re-verification.

dogovornoe-pravo is a contract review plugin for Russian legal compliance that verifies client agreements against Russian Civil Code norms covering contract formation, liability, warranties, and subscription models, while also triaging confidentiality agreements and tracking contract revisions. It integrates with Google Drive to manage contract documents and provides escalation routing and business-friendly review summaries for stakeholders outside the legal function.

dx-guard automatically scans npm, pip, pnpm, yarn, and bun packages for known vulnerabilities before AI coding agents install them using OSV.dev, with zero configuration or API keys required. It blocks malicious packages entirely and warns about known CVEs, running as a PreToolUse hook that intercepts package installation commands.

This plugin provides a full compliance-to-traceability lifecycle for embedded firmware development, covering CE/FCC/UL standards checks, ESP-IDF/PlatformIO firmware implementation with requirement tags, requirement chain validation, and KiCad PCB auditing (DRC/ERC, gerber export, BOM generation). It includes a SessionStart hook that auto-deploys embedded development toolchain permissions (gcc, cppcheck, clang-tidy, clang-format, sqlite3, doxygen) if gcc is available and local settings are not configured.

Skill is a standalone Agent Skill suite with 38 entrypoints across design, engineering, and research domains, offering both structured SOPs (standard operating procedures) and open-ended heuristics for creative thinking and reproducible workflows. It combines practical execution workflows with exploratory lenses for frontend development, visual design, security reviews, testing, maintenance, and research experimentation.

fable-guard provides opt-in deterministic guardrails through PreToolUse hooks that block secret leaks and dangerous shell patterns before they execute. It is the only fable-pack plugin that ships executable code and runs via python3.

ForgeProof converts GitHub issues into working code and packages the entire artifact lineage—file edits, design decisions, test results—into a tamper-evident Ed25519-signed .rpack bundle that reviewers can cryptographically verify was not altered after creation. It uses local Python 3.11+ and OpenSSH to build and sign bundles with no external API keys or services.

Frank Grimes is a pessimistic code and design review plugin that systematically attacks ideas, code, and architectures to find blocking flaws using a structured iteration loop with Disciplined Falsification methodology. It runs fixed critique categories (Runtime Reliability, API Correctness, Security, Architecture) with automated fix application or report-only modes, and surfaces verdicts (GREEN/YELLOW/RED) based on P0/P1 mitigation and verification strength.

freshprobe verifies whether external data is fresh enough for AI agents to act on by probing endpoints for staleness, latency, TLS health, and content changes, returning deterministic FRESH/STALE/UNKNOWN verdicts with NIST AI RMF alignment. It deploys as a CLI tool, MCP server, or HTTP microservice to prevent agents from confidently acting on stale cached or outdated data.

A GitHub CLI companion plugin that intercepts write operations via a PreToolUse hook to prevent accidental destructive commands while providing comprehensive usage guidance for gh CLI automation, API access, and workflows. The security guard blocks POST/PUT/PATCH/DELETE operations and repository modifications, while a skill offers context-aware examples and best practices for common GitHub operations.

guard-hooks is a Claude Code plugin that installs nine defensive hooks protecting against common shell security pitfalls like recursive rm on $HOME, download-and-execute pipelines, secrets file access, and silent zsh quoting failures. It warns on stale lockfiles and shellcheck findings, masks credential-shaped values from Bash output before the model sees them, and reviews commits for accidentally staged secrets.

This Claude Code plugin automatically analyzes code for security vulnerabilities using SOURCE→FLOW→SINK analysis whenever files are edited or saved. It reports findings directly to Claude so security issues can be fixed in real time.

hermes-gate is a Claude Code plugin that enforces receipt-based completion gating, injecting a completion contract at SessionStart, running a cached fast advisory on Stop, and blocking Bash commands (commit/push/PR operations) at PreToolUse if they lack a matching receipt. It uses three hooks (SessionStart, Stop, PreToolUse) and Python 3 to validate command boundaries.

A Legal Lifecycle Framework Claude Code plugin with 35 skills that enable assessment, drafting, review, compliance, and governance workflows for legal operations. It integrates via a PreToolUse hook and phase-gate.sh external tool, requiring no third-party API keys.

Maxim is a behavioral intelligence layer for Claude that governs multi-agent workflows across 91 specialist agents with framework citation, compliance overlay for 14 jurisdictions, and proactive drift detection. It includes 9 MCPs (95 tools), 52 skill domains, 50 slash commands, and 86 peer-reviewed behavioral frameworks to enforce structured governance on every output with confidence tags and regulatory compliance.

A Claude Code plugin providing specialized analysis of Russian real estate law and contracts, including shared construction agreements (ДДУ under Law 214-ФЗ), ready property sales, commercial and residential leases, and cadastral/EGРN property verification with encumbrance analysis. Each output is a draft document designed for review by a practicing attorney.

netan is a Claude Code plugin that connects to DotNetAnalyzer, an MCP server providing 93 tools for .NET code analysis, refactoring, security scanning, and architecture checking via Roslyn. It enables developers to analyze .NET code directly within Claude using command-line integration and specialized skills for deep code inspection and improvement.

Nova is a Claude Code plugin that provides an independent evaluator framework and adversarial security review for AI-generated code before commit, using generator-evaluator separation with 9 hooks, 1 MCP server, and pre-commit quality gates. It includes 17 slash commands, 12 skills, and 6 specialist agents to verify code reliability, catch security issues (like hardcoded secrets), and maintain session-to-session continuity across the development workflow.

Panel-review routes Claude Code agents to TruVerifAI's MCP server at high-stakes decision moments, deploying four frontier models to independently reason through coding (audit, deliberate, synthesize) and financial (audit, deliberate, synthesize) reviews with conflict-resolution and outcome tracking. The plugin gates risky commits and capital decisions locally, returning verdicts and findings that drive agent actions, while a dashboard shows what percentage of MCP calls actually changed decisions.

ParaQualis-GXP is a Claude Code plugin for computer-system validation and life-sciences regulatory compliance, covering GAMP 5, 21 CFR Part 11, EU GMP Annex 11, live eCFR data, and openFDA APIs with an IQ/OQ/PQ qualification-pack generator. It provides 18 slash commands, 2 auto-invoked advisor skills, 3 specialist sub-agents, and includes an MCP server for openFDA data access (free API key provisioning via `/openfda:setup`).

Patronus Runtime Protection adds native security gates to Claude Code chats, scanning external text and tool results before the model continues using policies configured in the separately installed Patronus Security CLI. The plugin hooks into session lifecycle and user/tool events to check user-authored strings, terminal output, and file content while keeping scanner state isolated and enforcing findings that block dangerous prompts or mask sensitive data.

This plugin implements Russian data protection compliance checks according to Federal Law 152-FZ, providing triage for data processing (consent, data localization, harm assessment), handler authorization review, subject rights responses, and gap analysis against regulations. It integrates with Google Drive via MCP to monitor and document data processing policies and compliance artifacts.

pilot-core provides comprehensive governance and delivery orchestration for full-stack Microsoft projects, including stack detection, security scanning, REST API standards enforcement, and incident correlation across multiple deployment personas. The plugin bundles 13 agents, 44 skills, and 14 hooks to enable autonomous team operations, cross-stack seam review, and spec validation throughout the development lifecycle.

Pilot-sql governs SQL Server and EF Core codebases by reviewing schema design, enforcing injection defense, checking migration safety, and verifying multitenancy isolation and PII protection. It ships three specialist agents (@sql-reviewer, @sql-implementor, @sql-support) with 12 skills and a PreToolUse hook to catch violations and diagnose query/performance issues at runtime.

PromptGuard provides LLM security tools for AI coding agents to detect and prevent prompt injection, PII leakage, data exfiltration, and jailbreaks through MCP server integration and agent skills. The plugin includes commands to scan projects for unprotected LLM calls, redact sensitive data, and a specialized code reviewer agent focused on LLM-specific vulnerabilities.

This Claude Code plugin automatically approves safe shell commands like `ls` and `git status` while prompting for potentially dangerous ones like `rm -rf` and `curl | bash`. It uses pattern matching and Claude Haiku integration to intelligently filter command execution without constant permission interruptions.

Performs adversarial red-team versus blue-team stress-testing on propositions (decisions, architecture, plans, strategies, code, plugin configs, docs) through iterative attack–defense–convergence cycles, producing hardened versions and go/no-go recommendations. Runs as a pure prompt-based skill with optional Node.js quota-guard hook support and can spawn independent agents for parallel audits on large targets.

secret-scanner is a heuristic safety net that scans working diffs for likely secrets—API keys, tokens, private keys, and high-entropy strings—before they are committed or shared. It provides a `/scan-secrets` command, detection patterns via a skill, and a PreToolUse hook that runs a POSIX grep-based scanner before Bash tool calls, designed as defense-in-depth rather than a guarantee.

This Claude Code plugin implements the NIST Cybersecurity Framework 2.0 across 39 skills, enabling users to govern, identify, protect, detect, respond, and recover from security threats. It integrates via a PreToolUse hook and phase-gate.sh script for security validation and policy enforcement.

A PreToolUse hook plugin that intercepts code writes to Claude Code and blocks files containing eval(), Function constructors, hardcoded API keys, AWS credentials, Bearer tokens, private keys, and XSS-prone patterns like innerHTML assignments. The linter runs against every Write, Edit, and MultiEdit tool call, extracting code content and scanning it against regex patterns while respecting comments, with errors blocking writes and warnings providing advisory context.

A comprehensive Claude Code plugin that automates security review preparation for Salesforce AppExchange and AgentExchange submissions through autonomous multi-agent audits, artifact generation, scan orchestration, and readiness verdicts. It identifies security blockers like authorization holes, missing CRUD/FLS checks, and injection vulnerabilities while providing step-by-step runbooks for human-only tasks.

A comprehensive senior engineer toolkit for Claude Code that bundles architectural judgment (Clean Architecture, DDD, SOLID), test discipline (TDD), design patterns, and language expertise across 12 languages (Bash, C#, Dart, Go, Java, Kotlin, Python, Ruby, Rust, SQL, Swift, TypeScript) through 23 commands, 22 subagents, and 60 skills. It includes built-in secret detection, workflow state persistence, security auditing, and pragmatic workflows for design, implementation, testing, refactoring, and debugging.

This Claude Code plugin wraps background Bash tasks with a signal-forensics wrapper that logs the killer's process ID, user ID, and command line when a task is unexpectedly terminated. It intercepts PreToolUse events to rewrite background commands to run under a monitoring wrapper that catches SIGTERM, SIGINT, SIGHUP, and SIGQUIT signals, preserving task behavior while providing detailed forensics in a JSONL log.

A WhatsApp channel plugin for Claude Code that bridges WhatsApp Web messages to Claude via the Baileys library and MCP protocol, with built-in access control and pairing-code-based allowlisting. Claude can reply with text and file attachments, react to messages, and download media, while the plugin prevents unauthorized access through server-side enforcement and manual approval workflows.

This MCP server enables Claude Code and other clients to draft, validate, and convert Sigma detection rules to Splunk, Elastic, OpenSearch, Wazuh and Kibana formats using pySigma pipelines. It ships a 299-rule corpus spanning 14 MITRE ATT&CK tactics with three skills (sigma-rule-writer, sigma-rule-reviewer, threat-coverage-gap-analyzer) and three MCP tools for rule lifecycle management.

The a11y-loop plugin enforces accessibility considerations in Claude Code by requiring plans that change UI to address accessibility before approval and by running audits before sessions with UI changes end. It ships a skill with accessibility rules, a /a11y-plan command, and two hooks that gate plan mode and session stops to ensure accessibility is decided and verified.

Aether WCAG Scanner finds accessibility violations on live URLs by rendering pages in Playwright across desktop, tablet, and mobile viewports and pairing each violation with corpus-backed fixes tied to WCAG 2.1 AA success criteria. It uses axe-core for deterministic measurement and the Allchemy Labs hosted insights engine to ground fix suggestions in WCAG techniques, with all scanning running locally and API access optional for enhanced fix generation.

affirm is a SessionStart hook that surfaces new or modified instruction files (CLAUDE.md, .claude/rules/*, and their imports) and requires explicit user affirmation before treating them as trusted. It compares SHA-256 hashes of all in-scope files against a stored manifest, blocking silent re-programming of Claude's behavior via malicious commits, supply chain attacks, or accidental edits.

This Claude Code plugin enables multiple Claude sessions on the same project to discover each other and securely exchange end-to-end encrypted, signed messages through a shared bridge infrastructure. It provides inter-session communication capabilities using hooks and shell execution without requiring external API keys or paid services.

This Claude Code plugin enforces LLM security guardrails by bundling the AgentGuards MCP server and enforcing hooks that scan prompts, authorize Bash commands, and redact web content in real time. It blocks jailbreaks, prompt injections, and data exfiltration with a fail-closed default and optional fail-open mode for availability-first deployments.

This Claude Code plugin enforces LLM security guardrails—jailbreak detection, prompt-injection and web-content scanning, data-exfiltration blocking, and destructive-command authorization—via hooks that call a self-hosted AgentGuards appliance for every prompt, command, and web fetch. Unlike the hosted variant, it uses environment variables to point at your own appliance instead of a bundled MCP server, preventing accidental calls to the wrong instance.

Scans a repository to detect AI systems, model calls, and compliance oversight points, then commits the findings as a manifest and lands them in Noru as auditable assets and evidence. The plugin focuses on EU AI Act Article 50 transparency obligations, Article 5 prohibited practices, and ISO/IEC 42001 standards alignment to help organizations determine whether they are providers or deployers.

The audit-pack plugin assembles audit evidence bundles by combining Noru's control and evidence graph with local files that integrations cannot reach, then lands tested conclusions back into Noru's register as individual control-evidence mappings. It ensures reproducible sampling strategies, enforces expiry windows anchored to audit periods rather than signatures, and validates that all packaged evidence aligns with Noru's scope snapshot.

This Claude Code plugin installs 13 skills, 6 agents, and 5 commands that teach Claude the reflexes of a senior backend engineer—including load analysis, data modeling discipline, migration safety, query optimization, idempotency design, error handling, observability, security audits, and investigation methods across APIs, workers, CLIs, ETL, and cron jobs. Three Python hooks provide inline warnings for dangerous migrations, insecure backend patterns, and security issues at write time.

Reads forge change history and branch protection settings to detect segregation-of-duties violations (self-approvals, unauthorized bypasses, agent-authored changes without independent review) and files owned findings to Noru. The plugin accepts that violations sometimes genuinely occur in reality and requires each one to be explicitly owned by a named person rather than refused outright.

This plugin securely stores API keys in macOS Keychain and allows Claude to use them in commands without the values ever entering Claude's context window. Claude orchestrates secret retrieval and injection through a native system popup, redacting credentials from all output.

This Claude Code plugin implements a constructive advisor guardrail that gates the executor's first write operation until it consults a read-only Codex CLI advisor, with optional configuration, health monitoring, and session self-disable capabilities. It operates via shell CLI with no MCP, enforcing consultation through PreToolUse, PostToolUse, and SessionStart hooks.

This Claude Code plugin implements an actor-critic safety guardrail that gates the executor's first file write behind a mandatory read-only consultation with a Codex CLI critic, surfacing blindspots common to same-family models. The critic is probed for health on session start, and consultation succeeds via a local Python script that pipes structured JSON to the critic backend with configurable timeouts.

This Claude Code plugin installs a read-only advisor guardrail using Cursor Agent CLI that must be consulted before the first write operation in an executor session. The advisor runs through Cursor's ask mode (defaulting to Cursor Grok 4.6 High) and provides constructive guidance on decisions and risks, with per-project model memory and a configurable consultation timeout.

A Claude Code plugin that implements an actor-critic guardrail by requiring executor sessions to consult an adversarial read-only critic through the Cursor Agent CLI before their first write operation. The critic runs in Cursor's ask mode (read-only) and defaults to cursor-grok-4.6-high, with per-project model memory to remember selections.

defect-scan is a language-aware static analyzer plugin that detects real bugs by running existing project tools (ruff, tsc, clippy, etc.) across 15 languages, then reasons about findings with confidence tiers and proposes verified fixes. It runs entirely locally inside Claude Code as a POSIX shell library with no external services, API keys, or setup required.

An MCP server that analyzes lockfile diffs and dependency version upgrades for npm and PyPI, providing human-readable upgrade plans with semver classifications, breaking changes from release notes, CVEs fixed, and migration guidance. The server runs via npx and integrates with Claude Code, Cursor, and Claude Desktop to surface risk assessments and package upgrade recommendations.

dev-crew is a Claude Code plugin that provides an autonomous AI development team with specialized agents for planning, test-driven development, security auditing, and code review, automating the workflow from spec through implementation to commit. The plugin integrates phase-boundary context compaction and competitive review (Claude + Codex when available) to keep development within context limits while maintaining code quality across correctness, performance, security, and architecture dimensions.

This standalone Agent Skill provides access to four MCP servers for EU AI Act and multi-regulation compliance, including real-time EUR-Lex full-text search across six EU regulations (EU AI Act, DORA, NIS2, Cyber Resilience Act, CSRD, GDPR) and compliance auditing tools. It enables AI agents to classify AI systems for regulatory risk, generate signed compliance artifacts, search regulation text with FTS5, and track enforcement deadlines—all with optional cryptographic attestation for audit defensibility.

evidence-push queries Noru's API for unmet evidence expectations against an organization's controls, matches local artifacts from `.noru/artifacts/` to the queue, and uploads them with control mappings via REST. The plugin stages uploads locally with validation (file type, size, schema), probes for duplicates before pushing, and requires explicit confirmation to avoid blind retries.

findings-ingest reads SARIF and OSV-Scanner reports that stay within your CI pipeline and files them as security findings in Noru against existing risks, automatically closing findings no longer reported. It prevents double-ingestion by only accepting reports explicitly marked as not reaching the forge's alert store, and derives finding identity from logical code location rather than line numbers to survive refactoring.

Forge spawns Builder and Breaker agents in an adversarial loop to harden code: the Builder implements features while the Breaker writes failing tests until no further issues can be found. The Breaker's adversarial tests—covering crashes, security, boundaries, race conditions, and resource leaks—become a permanent test suite in your repository.

Gates is a Claude Code plugin containing two PreToolUse hooks that gate outbound operations via the `gh` CLI: coldread intercepts GitHub text posts (issues, PRs, comments, release notes, gists) and uses a headless reader process to detect comprehension blockers before publication, while destgate restricts publication destinations to a user-managed allowlist. Both hooks operate as safety gates without requiring user action to trigger inspection.

This plugin intercepts Bash commands via a PreToolUse hook to prevent agents from merging PRs, pushing to protected branches, deleting remote branches, or running destructive git operations without explicit approval. It parses shell syntax including quotes, subshells, and variable assignments to identify and block risky git operations, with a strict mode that requires approval for all commits and pushes.

This plugin adds an Agent Skill and MCP server to help migrate npm publishing in GitHub Actions from stored NPM_TOKEN to OIDC-based trusted publishing. It previews and applies workflow and package.json changes, then guides you through the remaining npm trust commands needed to complete the migration.

Reads governance documents (meeting minutes, audit plans, corrective actions) from local markdown files, extracts attributed records with dates and decision history, and files them into Noru as evidence against unmet control expectations. The plugin never modifies governance text itself—it bridges human-written governance records to Noru's compliance platform while preserving attribution and source integrity.

This Claude Code plugin enforces approval gates for high-risk Git, Docker, Kubernetes, and secret-file operations by intercepting PreToolUse events and blocking actions like PR merges, container teardowns, and reads of sensitive files until you explicitly authorize them. It uses pattern matching on bash commands and GitHub/GitLab MCP tool calls to prevent accidental exposure of secrets and destructive changes.

This PreToolUse hook blocks dangerous git operations (force pushes, protected branches, destructive commands), edits to secrets and signing material, and enforces command whitelisting for researcher and verifier agents before Bash, Edit, Write and NotebookEdit calls. It runs with python3, fails securely if missing or crashed, and does not parse scripts or aliases.

This Claude Code plugin bundles the hlx-admin-api-executor skill with a PreToolUse guard hook that intercepts destructive curl commands (POST/PUT/DELETE/PATCH) targeting AEM Edge Delivery Services Admin API and blocks execution until explicitly approved. The skill provides an interactive workflow for planning, executing, and documenting API operations with full request/response traceability using a GET/SET/GET pattern.

Scans Terraform, CloudFormation, Kubernetes, and CI configuration files in a repository against configurable security rules, then upsets findings to Noru with idempotent source+externalId matching to track changes across rescans. Uses git ls-files to honor repository ignore rules and identifies resources by file+rule digest rather than line number to avoid false closure when blocks move.

The INAM Protocol plugin lets Claude query a public reputation registry for AI agents, checking trust scores and verifiable evidence before collaboration. Users can optionally produce countersigned receipts through a demo agent or register persistent agent identities using the open did:key standard.

This plugin enables intent-driven catalog discovery and data quality assessment within Claude Code and Claude CoWork, allowing users to query Informatica IDMC's Cloud Data Governance and Catalog (CDGC) system through natural language to find trusted data assets. It grounds responses exclusively in catalog metadata—ownership, certification, ratings, sensitivity, policy, and compliance flags—with zero-hallucination rules and severity-ranked gap reporting.

This PreToolUse hook intercepts Edit, Write, and NotebookEdit operations to block modifications to research-integrity paths (like eval/ and scoring configs) and licensed corpora directories, preventing agents from accidentally corrupting experimental data or reproducibility artifacts. It uses shell script pattern matching to enforce protection rules, exiting with status 2 to reject blocked edits while allowing all other operations.

libre-fintech-hooks provides three optional safety hooks for Claude Code in financial projects: SessionStart detects payment and ledger frameworks, PreToolUse asks for confirmation before accessing sensitive files and destructive commands, and PostToolUse warns on empty file writes and reminds to run tests. The hooks rely on jq and execute shell scripts that parse tool JSON to protect keys, credentials, and audit trail integrity without acting as a security control.

This Claude Code plugin provides three safety hooks for financial projects: PreToolUse asks before accessing sensitive files (credentials, keys, encrypted data, ledger exports) or destructive commands (rm -rf, force push, SQL DELETE/DROP/TRUNCATE); PostToolUse warns when writes produce empty files and reminds to run tests after code changes; and SessionStart detects payment/ledger folders and dependencies (Stripe, Plaid, Adyen, etc.) to provide context. The hooks are guard rails for daily development and require jq to operate.

LiquiLens reviews covered institutions and their disclosures by connecting to an MCP server at agents.seiche.info. The plugin provides a single skill for financial compliance and regulatory analysis without requiring external API keys.

This plugin embeds OWASP Top 10 for LLM Applications 2025 compliance into Claude Code development workflows, automatically detecting and guiding security hardening for external content ingestion, LLM endpoint exposure, output validation, system prompts, and multi-agent action surfaces. It generates tiered mitigation options and audit-ready security posture reports with OWASP mapping.

This plugin enforces a guardrail for Claude Code, Codex, and Cursor by requiring each executor session to consult a read-only local advisor subagent before its first write operation. The advisor is launched as a native child agent within the same IDE and account, using Opus High for Claude Code, GPT-5.6 Sol for Codex, and Cursor Grok 4.5 High for Cursor.

mcp-yoshi is a real-time security filter for MCP tool communication that runs as a Claude Code hook, inspecting outbound requests (API keys, private keys, PII, path traversal) and inbound responses (prompt injection, shell embedding, script injection, credential leakage, sandbox escape). It detects 21+ attack patterns including tool definition tampering, prompt injection, and response-based exfiltration attempts, with three-level verdicts (PASS, WARN, BLOCK) and configurable logging.

This plugin implements an optional native cloud child-agent review mechanism at configurable tool boundaries, enforcing a PASS result or explicit user waiver in required mode. It uses hooks at SessionStart and pre/post-ToolUse events to gate execution of shell tools like Bash and Git commands, with review evidence validated against workspace state changes.

NebCore AI exposes infrastructure management capabilities (issues, Kubernetes, GitOps, cost, policy, compliance) through an MCP server that bridges the nebcli CLI into Claude Code. The plugin requires nebcli 6.13.0+ installed locally and authentication via `nebcli login` or the NEBCORE_PLATFORM_KEY environment variable.

NebGuard enforces policy-driven guardrails on AI coding assistants and autonomous agents by monitoring actions across multiple event hooks and making allow/warn/block/steer decisions recorded in a tamper-evident audit trail. The plugin integrates via 14 hooks covering session management, tool use, notifications, and user prompts while requiring the external nebguard service.

Noru is a hub plugin that consolidates repository reviews and read-only status checks across independently installed GRC (Governance, Risk, and Compliance) pieces, allowing developers to ask "what compliance work is relevant here?" without needing to know specific command names. It provides five commands—connect, doctor, context, review, and status—that inspect tracked repositories, identify relevant pieces, run local scans in isolation, and report on blockers, findings, and pending sign-offs without making any writes to Noru itself.

offload-sidecar is an MCP tool that offloads file transforms, log triage, and vision tasks by passing file paths instead of content to Claude, routing work through local Ollama tiers (deep/fast) for privacy-critical tasks or Gemini via agy CLI (flash/pro) for vision and large inputs with budget-gated quota management. Deterministic in-process operations (dedup, sort, filter, decode, format conversion) incur no model calls, while LLM-backed operations validate output format before writing results and return only status payloads.

This plugin provides three PreToolUse hooks that prevent unsafe developer actions: blocking git adds of sensitive files (.env, keys, credentials), rejecting edits to lock files and restricted directories (node_modules/, vendor/, .git/), and rejecting single file writes exceeding 1MB. The hooks use pattern matching and require jq to function.

OhMyPrivacy blocks prompts and tool commands containing secrets before they reach the model, storing intercepted values in a configurable vault (age, Doppler, or discarded). It hooks into Claude Code and Hermes Agent to enforce secret redaction through pre-submission filtering and pre-tool-use validation.

OneCLI is a Claude Code plugin that connects AI agents to external APIs by automatically injecting stored credentials into outbound requests through an HTTPS proxy gateway, eliminating the need for credential management in the environment. It supports services including GitHub, Gmail, Google Calendar, Google Drive, Jira, AWS, Notion, and many others, with policy enforcement (blocking, rate limiting, manual approval) applied at the gateway on every request.

owners-go adds approval gates for high-risk agent actions like merges, releases, and prod deployments by requiring the owner to create a marker file before each action runs. The plugin works with any CLI by matching command patterns against customizable rules, and consumes the marker after each successful action to enforce one-approval-per-action.

Scans a repository's ORM models, SQL migrations, and API schemas to automatically classify personal data against the Fideslang taxonomy and publish a complete data map to Noru with citations and ownership. The plugin reads SQL DDL, Drizzle, Prisma, Python ORMs, Protobuf, and GraphQL while tracking coverage gaps and avoiding false positives on validation-only schema definitions.

A PreToolUse guardrail hook that blocks Bash commands invoking python/pip without a uv prefix and instructs the agent to retry using uv instead, enforcing isolated environment management through pure pattern matching. The hook is implemented in PowerShell to avoid bootstrap paradoxes and works deterministically without LLM judgment.

Enforces Qualimetry coding standards, principles, and policies by running automated code reviews using AI analysis and rules-based finding detection. The plugin surfaces violations and recommendations at development time through CLI commands, agents, and post-tool-use hooks.

A Claude Code plugin that converts periodic reviews of machine-generated outputs (access lists, firewall rules, asset inventories, etc.) into dated, expiring sign-offs in Noru, with expiry tracking integrated into the evidence register itself. It provides scan, diff, and push commands to fetch review queues, reconcile exceptions against records, and emit MCP calls to record attestations with ownership and disposition for every exception.

Safe Keys is a Claude Code mod that intercepts API keys pasted into chat, replaces them with placeholder names everywhere (chat, transcript, screen, model context), and supplies the real value only to tools when needed. It uses mod hooks to clean keys from the conversation before they reach the transcript file or the model's context.

Sato Hub is a scored, daily-rebuilt index of onchain-agent tooling (frameworks, MCP servers, wallets, payment rails, identity standards, trading venues, agent skills) and agent-economy metrics; it provides Preflight checks for packages/MCP servers before installation, route recommendations with disclosed fees, and Agent Passports—all read-only and non-custodial. The plugin integrates as an Agent Skill with an MCP server endpoint and includes a PreToolUse install hook (Sato Check) that inspects what crypto packages, MCP servers, or skills can do with your keys and funds before they run.

A Claude Code plugin that establishes a senior software engineer persona with 7 skills and 2 subagents, enforcing deterministic safety hooks including confirmation for destructive commands and validation requirements for code edits. Works on real repositories with explicit certainty labeling and epistemic honesty, supporting both English and Spanish with portable specification-driven architecture.

Skillkeel Starter provides three guardrail hooks that block destructive shell commands, credential leaks, and unsafe git operations before Claude Code can run them, plus eight skills for repository hygiene tasks like generating commit messages, PR descriptions, and scanning for secrets in git history. Every hook and skill ships with evaluated transcripts demonstrating real Claude Code runs.

An MCP server that manages multi-workspace Slack integration with draft-and-confirm safety on all writes, vault auto-export of reads, and support for xoxc/xoxp/xoxb authentication modes. Runs as a single Python process that handles multiple Slack workspaces simultaneously with features like prompt-injection scrubbing, audit logging, and token redaction.

SmartHealthConnect is an archived patient-facing health management surface that provided 6 skills for preventive care gaps, medication monitoring, healthy habits, diet analytics, pediatric immunizations, and clinical trial tracking via SMART on FHIR integration. The plugin is now frozen at v1.2.0 with functionality migrated to the HealthClaw Guardrails engine and CareAgents advisor definitions.

This plugin sanitizes ANSI escape sequences from tool output and detects terminal-based prompt injection attacks using the distill-strip-ansi library. It provides full protection for MCP tools via output replacement and partial protection for built-in tools via context injection and threat classification.

think-like applies expert thinking profiles to code reviews, architecture evaluation, and security audits by capturing the philosophy and communication style of experts like DHH or Sandi Metz. Users can apply built-in profiles or create custom ones that provide both expert perspective and mandatory counterpoints highlighting blind spots.

A Claude Code plugin that reads Open Threat Model (OTM) files committed to a repository and lands threats into Noru's risk register, linked to organizational controls and flagging undeclared components found by other scanning tools. It keeps threat models synchronized with live code by proposing one risk per threat per element, handling expiry based on model observation dates, and providing read-only scan and diff commands before write-enabled push to Noru's API.

Titan Receipts creates tamper-evident, hash-chained and HMAC-signed receipts for every AI-assisted commit, with full session attribution and fail-closed verification that detects any tampering or chain breaks. The system works entirely offline with no external services, storing receipts in `.titan/attestations/` for optional sharing as evidence of code provenance.

The whatsnew plugin analyzes dependency upgrades by cross-referencing vendor breaking-change documentation and identifies missing security fixes in outdated projects. It generates machine-readable CHANGELOG.md files in Declarative Changelog format, pulling release data from the What's New MCP server without requiring authentication.

account-guard warns or blocks Claude prompts when the active account email doesn't match a folder-based policy, preventing accidental use of the wrong Claude account in team or multi-account workflows. The plugin intercepts every prompt submission, checks the current directory against a configurable allowed-emails policy, and either warns or blocks the prompt based on the mismatch action setting.

achilles-ep-delphi integrates real-time DELPHI signals and knowledge graph analysis with security modules (RiskOracle, NoLeak, MemGuard, SecureExec, FlowCore) via 2 MCP servers. Every tool interaction triggers USDC micropayments on Base Mainnet for decentralized usage metering.

This plugin implements Scalekit Agent Auth, enabling AI agents to authenticate and act on behalf of users in third-party applications like Gmail, Slack, Calendar, and Notion. It provides agent skills and MCP server integration for secure third-party app interactions.

agent-docs-nextra provides guardrails for Nextra documentation sites, including a generated-guard hook that blocks hand edits to generated pages and agents for security and SEO validation. It installs rules, lint configs, quality-gate checks, and pull-request CI setup to prevent common docs issues like secrets in exports and missing metadata.

An offline, read-only MCP server that verifies claims about AI systems against supplied evidence bytes and replays agent-evidence conformance vectors. It provides nine tools including verify_claim, run_vectors, and check_artifact_digest for agent builders, auditors, and platform engineers to validate evidence instead of trusting reports.

agent-guard is a set of safety hooks that intercepts shell commands and file writes before a coding agent executes them, refusing destructive operations (like force pushes to main or rm -rf outside safe directories) and rewriting risky patterns (like pkill -f to pkill -A or git push --force to --force-with-lease). It runs without network dependencies using only Python 3.10+ and the standard library, silently passing through benign commands while guiding agents toward safe alternatives when dangerous operations are detected.

This Claude Code plugin intercepts destructive commands (git, filesystem, Kubernetes, cloud, data operations) via a PreToolUse hook and denies or prompts for confirmation before they execute. It acts as a safety layer for coding agents, catching accidental destructive actions while relying on credential scope and isolation for real security boundaries.

This plugin provides security guardrails for Claude Code tool use, including a kill switch, deny rules for risky shell commands, and daily usage caps with an attempt/done ledger. It operates as two hooks that intercept tool calls before and after execution, using only Python standard library.

Agent Guild provides trust and settlement infrastructure for autonomous agents, enabling vetting, capability ranking, and passport verification before delegating work or resources. The plugin integrates with Claude Code and other compatible agents via an MCP server to manage agent discovery, escrow, and evidence-backed collaboration outcomes.

Agentlefs provides agent permissions management for shared team files through an MCP server integration. It enables controlled file access across agents and skills with a CLI-driven interface for permission administration.

agent-memkit is a read-only linter for Claude Code agent memory files (MEMORY.md and notes) that detects index size violations, broken links, malformed frontmatter, and leaked secrets or personal data via PostToolUse and SessionStart hooks. It ships as a Claude Code plugin with a Python stdlib CLI and never modifies files, only reporting findings to help agents keep their memory clean and within Claude's 200-line/25 KB load limit.

agento-patronum blocks Claude Code's access to sensitive files (.env, SSH keys, AWS/Kubernetes configs) and dangerous commands (printenv) through a PreToolUse hook that intercepts Read/Write/Edit/Bash operations before they execute. It provides CLI skills to manage protected patterns, logs all blocked attempts, and fails closed on misconfiguration to ensure credentials and secrets remain inaccessible.

Runs a multi-model adversarial code review panel that excludes the model family that wrote the code, with safety-rail hooks for destructive git commands and protected paths. Reports findings with severity levels and tracks false-positive rates per reviewer and coder pairing.

Agent Seatbelt is a self-contained Python hook that intercepts and evaluates tool calls—shell commands, file writes, and MCP calls—before execution, denying destructive operations like recursive deletes, secret exfiltration, and production deploys while explaining safer alternatives. It runs entirely offline with no external dependencies, providing deobfuscation, blast-radius reporting, pre-destruction snapshots, injection flagging, and tamper-evident audit logging.

This plugin provides security skills for LLM agents including threat modeling, agent configuration auditing, MCP server review, prompt injection tracing, incident lookup, security evaluations, and Semgrep scanning. It includes Bash guard hooks and an optional incident-database MCP server to help agents identify and mitigate security risks.

Agent-security provides threat modeling, configuration auditing, MCP server review, prompt injection tracing, Mason Broker policy generation, incident lookup, security evaluations, and Semgrep scanning for LLM agents. It includes guard hooks for Bash execution and an optional incident-database MCP server.

AI Guardian provides observability and governance for local LLMs through prompt scanning, model policy enforcement, and a transparent capture proxy that detects secrets, PII, and jailbreak attempts. It supports Ollama, llama.cpp, LM Studio, and vLLM runtimes with offline deterministic scanning, provenance pinning, and comprehensive audit logging.

Enforces an AI-native SDLC workflow through deterministic hooks that validate artifact chains (intent/spec/plan), lock tests during fixes, guard credentials and protected paths, enforce production release gates, and verify completion before marking tasks done. The plugin combines 13 skills carrying enforcement knowledge with 7 hooks that intercept tool use and session lifecycle events to embed governance directly into Claude Code workflows.

akte is an MCP-based investigator board that structures claims with quoted evidence, camera-movement drafts, and signed human approvals for verification workflows. Agents create cards and threads linking facts to verbatim sources, while humans retain control through cryptographic release gates.

Anchorwatch is a Claude Code plugin that enforces security guardrails by blocking destructive shell, git, and SQL commands, protecting secret files, and scanning code for leaked credentials. It requires zero dependencies, runs with configurable project-specific rules, and warns before executing irreversible deployments.

armoctl is a Claude Code plugin that exposes the ARMO security platform CLI as 14 skills, enabling teams to list incidents, triage CVEs, manage policies, and generate network policies directly from Claude. The plugin auto-installs and version-syncs the armoctl binary via a SessionStart hook, requiring only ARMO Customer GUID and Access Key credentials.

aspark-guard enforces deterministic quality gates on aSPARK project artifacts by intercepting tool calls and denying writes that violate phase preconditions, while recording all overrides in a hash-bound ledger for review. It runs outside the model context with no silent bypasses: gates can only be overruled through dated, reviewable entries in the repository.

This Claude Code plugin drives Cheat Engine from plain-language requests, enabling memory scanning, reading/writing, pointer resolution, code injection, and Mono/Unity inspection on Windows through a local MCP connection. All operations run locally on your machine with configurable safety locks to prevent crashes or unauthorized game modifications.

The ADI ATP plugin connects Claude Code to ATP's specialized analysis infrastructure for designing, specifying, and evaluating cryptocurrency exchange features with compliance grounding in Vietnamese law, security, and protocol analysis. It provides eight skills that guide users through context questions, gather evidence from legal and security sources, and deliver multi-dimensional markdown and HTML reports on feature design, compliance, and security posture.

This plugin intercepts AWS CLI calls made through Claude Code's Bash tool, enforcing security guardrails by requiring non-production AWS profiles, denying risky operations, and prompting for mutations with an audit log. It acts as a protective middleware that fails closed to prevent accidental or malicious AWS infrastructure changes.

Azure DevKit provides Claude Code with commands and agents for safer Azure infrastructure reviews, diagnostics, and deployments across Bicep, AKS, App Service, Azure Functions, and RBAC—all with built-in safeguards that require explicit approval for mutations and suppress secret values. It includes read-only diagnostic tools, template generators with validation handoffs, and RBAC audit capabilities tailored to individual developers and platform teams.

A community-maintained collection of 21 AI agent skills for cloud platform engineering across Azure, AWS, Google Cloud, and Oracle Cloud, each aligned to the provider's Well-Architected Framework and covering reviews, landing zones, networking, identity, and observability. Each skill provides tested workflows, guardrails, and authoritative documentation links to help AI agents perform real platform engineering tasks securely and following cloud best practices.

A security toolkit for brain-computer interface (BCI) projects that performs threat modeling, vulnerability scanning, and neuroethics compliance checking entirely locally without external API calls. It includes 8 tools for scanning BCI configurations, detecting patterns, scoring device vulnerabilities with NISS scoring, and validating regulatory and neuroethics compliance against published guardrails.

BillingPlane is a Claude Code plugin that audits, discovers, and generates production-ready Stripe billing code with guardrails covering webhooks, lifecycle management, feature gating, and entitlements. It includes 4 slash commands, 2 auto-activating skills, and a webhook validator agent with zero runtime dependencies—all code is owned by the user.

A Claude Code plugin that enforces deterministic governance rules through fail-closed hooks on dangerous tool actions (Bash, Write, Edit) before execution, using control rod profiles to classify and block unsafe operations across domains like pricing, customer data, and auth. It maintains forensic history across session restarts and compactions, provides operator-facing skills to inspect governance posture, and gates session closeout until blocking findings are resolved.

This plugin provides two Agent Skills for verifying C2PA Content Credentials across repository assets: c2pa-check examines files and URLs for credentials while maintaining a lock file to detect credential loss, and c2pa-integrate connects projects to the c2pa.design API with monitoring and CI gates. It includes an MCP server and runs the offline c2pa-check CLI without requiring authentication, though an optional C2PA_API_KEY enables additional features like URL checks and production dashboards.

Carryall is a deterministic IAM control plane that translates natural language intent into minimal-scope Ed25519-signed envelopes for governing AI agent access to data planes. It enforces least-privilege policies and maintains a tamper-evident audit trail while keeping data in your own backend (vault, database, filesystem, or custom storage).

ccguard is a security plugin for Claude Code that blocks dangerous shell commands and file operations using shell-aware pattern matching before they execute. It normalizes obfuscation and covers 25+ attack categories including recursive deletes, privilege escalation, reverse shells, and credential exfiltration—with zero external dependencies.

This plugin provides governed AI-ops for Ceph clusters through a built-in harness that delivers 37 MCP tools—17 read, 18 write, and 2 undo—for HEALTH_WARN/ERR root-cause analysis and cluster operations (OSD/PG/pool/RBD/CephFS/RGW), with unified audit logging, token budgeting, and risk-tier labeling. It connects directly to a vanilla ceph-mgr Dashboard REST API with encrypted credential storage, dry-run/double-confirm protection for destructive operations, and reversibility for tuning changes—no external dependencies or Kubernetes required.

This plugin provides AI-driven CI/CD operations for self-managed GitLab and Gitea instances, enabling diagnostics like pipeline failure root-cause analysis, runner fleet health, and artifact storage auditing through a governed MCP server and CLI. Every read and write operation is audited to an encrypted local database, with risk levels tracked but permission enforcement delegated to the server's own access control.

Civic's MCP Gateway adds identity, scoped permissions, audit trails, and revocable access control to Claude Code's MCP tool integrations. Agents authenticate with bearer tokens and every tool call is logged with agent identity, preventing unauthorized access and enabling immediate revocation.

Claude Alert uses hooks and risk classification to send native sound and banner notifications when Claude Code requires approval, with auto-approval for low-risk operations and a complete local audit trail. Supports macOS, Linux, and Windows, with optional animated menu bar companion on macOS (Tier 2).

Claude Security scans your codebase or pull request diffs for vulnerabilities using a team of agents that verify every finding before reporting it, then can generate targeted patch files for confirmed issues. The scan runs entirely within your Claude Code session with no external dependencies, reading your repository the same way you would and respecting your .git/, .claude/, and CLAUDE.md settings.

This plugin integrates Sentry error monitoring directly into Claude Code, enabling developers to triage, search, and fix production errors without leaving the IDE. It fetches real-time issue data from Sentry, analyzes stack traces with your source code, and proposes fixes through an interactive command-driven workflow.

ClawLock is a Claude Code plugin that provides cryptographic identity, encrypted credential storage, and immutable audit trails for AI agents using Ed25519 keypairs and AES-256-GCM encryption. It includes four skills for security scanning, agent registration, credential vault management, and audit logging, plus 14 MCP tools for managing identities, secrets, and compliance across shared AI agent environments.

This Agent Skill provides a Python scanner that detects invisible and dangerous Unicode characters in text files, including zero-width spaces, bidirectional controls (Trojan Source), tag characters, and blank glyphs. It explains each finding, categorizes by risk level, and removes only the problematic characters while preserving legitimate joiners used in emoji sequences and non-Latin scripts.

Cloakroom masks secrets and PII (names, emails, API keys, phone numbers, addresses) in prompts and tool output before the Claude Code model sees them, then restores the real values only for local operations. Detection runs locally using pattern rules, a small ML model, and OCR for PDFs and images, with all masking and unmasking happening on your machine.

Clover intercepts implementation plans in Claude Code, analyzes them for missing security requirements, and injects those requirements back into the plan before code generation begins. It runs security analysis locally via hooks at plan-mode exit and session start, requiring only a Clover API server connection for threat modeling.

commit-commands is a security-enhanced Git workflow plugin that automates staging, committing, pushing, and pull request creation with deterministic model attribution tracking. It enforces safety guards against unsafe direct commits from Bash and Playwright, provides confirmation-gated cleanup of orphaned branches and worktrees, and maintains compatibility with Anthropic's official commit-commands plugin.

This plugin reads on-disk SQLite audit trails from AIops agents and converts them into tamper-evident, framework-mapped compliance evidence bundles for HIPAA, PCI-DSS, SOC 2, and GDPR with hash-chain sealing and OSCAL export. It operates entirely offline with read-only access to audit databases, producing auditor-ready evidence artifacts without requiring external credentials or APIs.

A Spanish legal contract plugin for law firms that drafts, reviews with risk flagging, negotiates counterproposals, and handles enforcement procedures (demand letters, resolution, remedy claims, court filing) for civil and commercial contracts. It integrates with Jurisprudenciator for live legislation, case law with ECLI citations, commercial registry data, and property records verification.

This Spanish labor law advisory plugin helps law firms and social security graduates with employment contracts, dismissals, and compliance through 31 specialized skills that integrate with Jurisprudenciator for live legislation, case law with ECLIs, and citation verification. It covers contract modalities, payroll calculations, disciplinary action, dismissal letters, reconciliation filings, and litigation support—all conforming to Spain's Workers' Statute and collective bargaining agreements.

Injects a permanent critical mindset into every Claude Code session via hooks, surfacing real bugs, security flaws, and questionable design decisions ordered by impact. Provides explicit `/critique` and `/rigorous` skills for focused deep analysis with structured protocols including security and implementation audits.

Cyberine DevGuard is a Claude Code plugin that prevents accidental writes to files in git repositories other than the one the session started in, using a PreToolUse hook to intercept Write, Edit, and NotebookEdit operations. It supports configurable modes (ask, deny-once, warn, off) and respects allowed directories, symlinks, and repository-level protection policies.

Deep Code Review is a portable Agent Skill that performs evidence-driven reviews of code changes, pull requests, and explicit audits to find real bugs with minimal false positives by tracing behavior through callers, state, data flows, and trust boundaries. It is designed for high-signal correctness, security, data-integrity, compatibility, reliability, and performance defect detection with aggressive false-positive removal and portability across clients implementing the Agent Skills format.

This MCP server extracts structured data from passport, ID card, and driver's license images using optical character recognition and machine-readable zone (MRZ) technology. It integrates with Claude Desktop, Claude Code, Cursor, VS Code, Gemini CLI, Windsurf, and Kiro, charging $0.01 per recognized document after 100 free monthly documents.

This plugin turns Claude into a practical DevOps teammate for Docker and Kubernetes work, helping diagnose failing builds and pods, generate safe manifests, and audit Helm charts and RBAC policies. It reads infrastructure state first, explains findings clearly, and asks before performing destructive operations.

dsct is a packet dissector CLI that streams pcap/pcapng analysis results as JSONL and includes a built-in MCP server for LLM-friendly access to packet data. It handles large capture files efficiently with memory-mapped I/O and provides filtering, sampling, and encryption support (ESP decryption) for network traffic analysis.

Endpoint-aiops is a governed AI-ops tool for managed-endpoint fleets that detects login storms and configuration drift across devices via REST API, with built-in audit logging, budget guards, and undo capabilities. It provides 13 MCP tools (10 read, 3 write) for inventory management, session analysis, patch compliance, and endpoint remediation, all wrapped in a governance harness that records every operation without enforcing permissions (delegating that to the management server).

ExactGround blocks AI coding agents from installing non-existent or typosquatted npm and PyPI packages by hooking into the PreToolUse event before commands execute. It detects hallucinated package names, unpublished versions, and malicious look-alikes while rejecting hidden installs in inline scripts to prevent supply-chain attacks.

This plugin implements two session hooks: a SessionStart reminder and a PreToolUse guard that blocks unsafe git commands like `git add -A`. It uses Node.js to run shell-based event handlers defined in a hooks.json configuration file.

Feishu (飞书) channel for Claude Code that bridges messaging with built-in access control via MCP, exposing tools for replying, reacting to messages, and downloading attachments. It manages pairing, allowlists, and policy through WebSocket subscription to Feishu's IM events and stores state and credentials locally in a configurable directory.

This plugin provides governed AI operations for OPNsense and pfSense firewalls through a unified MCP server, delivering 35 tools for reading firewall state (rules, NAT, VPN, DHCP, diagnostics) and writing configuration changes with built-in audit logging and governance. All operations are transparently recorded with risk-level labeling, undo capability for reversible writes, and root-cause analysis tools for gateway health, rule efficiency, and blocked traffic.

forgeward is an enforced, read-only conformance gate that blocks pushes until privacy, accessibility, AI-output, SEO, supply-chain, security, and code-quality checks pass, with additional skills for CI enforcement, whole-repo audits, and local container pentesting using OWASP ZAP and nuclei. It runs 11 specialized reviewers on any repo, each firing only when the diff touches its domain, and integrates with gstack's /ship workflow when present.

This plugin teaches game reverse-engineering workflows from The Game Hacker's Handbook, providing eight skills, four commands, and an agent that help users find values, locate code that writes them, walk pointer chains, and create signatures using Pointer Lab and pe-mcp tools. A built-in write guard blocks memory modifications until the user explicitly opts in via an environment variable, ensuring safety for learning on owned software, CTF binaries, and tutorials.

The GC AI plugin integrates your GC AI legal knowledge base directly into Claude, enabling document uploads, review playbook execution, and Q&A grounded in your own files through Skills and a dedicated subagent. All requests run as the authenticated GC AI user and are scoped to your organization's accessible content and billing.

GCP DevKit equips Claude Code with practical guidance for inspecting, diagnosing, and safely generating infrastructure across Google Cloud services including Cloud Run, GKE, Firestore, and IAM. It provides read-only diagnostics, conservative Terraform generation, and validation hooks that keep all destructive actions under your control.

This plugin blocks destructive git commands within GitButler workspaces via a PreToolUse hook and keeps the GitButler `but` skill synchronized with the installed CLI version at session start. It parses bash command chains to identify and prevent git write operations like commit, push, and merge while allowing read-only operations.

This Claude Code plugin connects to GitHub's remote MCP server to provide documentation search and read-only access to security tools including code scanning, secret scanning, Dependabot alerts, and security advisories. Authentication is handled automatically via the gh CLI keyring token, requiring no manual token setup.

gox-guard is a Claude Code plugin that installs deterministic gate hooks to prevent Claude from executing irreversible actions like git push when they violate hard rules—currently blocking pushes if betterleaks detects credentials in uncommitted commits. The plugin operates entirely as hook scripts with no repo modifications, running shell checks at PreToolUse and SessionStart events.

Guard provides safety hooks that prevent dangerous shell commands (rm -rf, credential exfiltration, force-pushes), protect sensitive files, and enforce subagent scope — all decisions are logged to queryable JSONL for audit and trace. The plugin runs stdlib-only Python with no external dependencies and offers a read-side CLI to query the decision log and manage allowlists.

Claude Code guardrails is a PreToolUse hook that intercepts risky shell commands and file edits—denying them with a one-line reason or prompting for permission—while allowing safe operations silently at zero token cost. Three configurable presets (strict, balanced, relaxed) control how aggressively the guard blocks operations like force pushes, secret file writes, and destructive commands.

This plugin uses PreToolUse hooks to enforce safety rules: blocking inline interpreter payloads containing unquoted backticks and preventing raw `gh pr merge` commands on stacked PRs. It provides a safe-merge script and dependency security audit skill to replace blocked operations safely.

This Claude Code plugin provides hooks that intercept and block shell commands known to fail, such as pkill -f patterns that would kill the agent's own shell. When a problematic command is detected, the hook denies execution and suggests alternative commands, allowing the agent to self-correct on the next attempt.

This plugin installs PreToolUse safety hooks that block destructive commands (rm -rf, force-push, DROP TABLE), git commits that bypass checks (--no-verify), and modifications to linting/formatting/TypeScript configuration files. The hooks analyze shell and file-write operations before execution, print the blocking reason to the agent, and can be overridden via environment variables when intentional changes are needed.

Three Claude Code project hooks that guard against destructive commands, edits to sensitive files, and apply formatting after code writes. The plugin runs Bash scripts that inspect tool calls and file edits, denying dangerous operations while optionally formatting with existing repository tools like Prettier or Black.

haris guards Claude Code from harmful tool calls by parsing every command with a real shell parser and deciding whether to allow, pass, ask, or deny based on action and target. It protects secrets, persistence spots, system files, and data leaving the machine while allowing safe reads and approved project operations.

The harness plugin provides 5 skills (ai-code-cleanup, interrogate, shape-task, verify-change, setup) and guard hooks to enforce code quality and security practices. It includes a shared-worktree git guard and a PreToolUse hook that prevents reading API-key config files, requiring only python3 to operate.

Herlihy is a Claude Code plugin that injects a concurrency checklist via a PreToolUse hook whenever you edit code containing locks, atomics, CAS, fetch-add, thread spawns, channels, or CUDA syncs, grounding each edit in Herlihy's published work on consensus numbers, linearizability, and progress guarantees. The plugin includes a bundled skill with the full theoretical corpus and carefully tracks which techniques (hazard pointers, Michael-Scott queues, EBR) originated elsewhere to prevent misattribution.

hive-recorder creates a tamper-evident audit trail by signing fingerprints of every Claude Code tool call, prompt, and conversation turn on your local machine. It enforces optional behavioral guidelines, flags out-of-policy calls without blocking execution, and stores only cryptographic signatures rather than sensitive content.

identity-aiops provides AI agents and humans with audited, risk-tiered access to self-hosted Keycloak and authentik identity providers for user/event/client/MFA operations, with all tool calls recorded in an audit log and reversible writes capturing before-state for undo. It includes 29 MCP tools spanning read operations, root-cause-analysis queries, and governed writes with dry-run previews, connected via MCP server and available as a Claude Code plugin, CLI, or standalone server.

This skill audits user flows and code against 12 categories of failure modes—from UX and security to concurrency and payment integrity—then implements fixes in severity order after explicit user confirmation. It triggers on requests to find edge cases, stress-test features, or audit payment/auth/checkout flows, and gates all changes behind a mandatory review step.

This plugin orchestrates a multi-agent investigation pipeline for OpenShift, RHEL, and KVM environments, combining crash forensics, CVE analysis, and IaC validation through composable agents that track evidence provenance via tamper-evident append-only logs. It enforces working-method discipline through verification gates, mechanical checks on references and Japanese localization, and deterministic secret-safety hooks while keeping infrastructure provisioning behind explicit human approval.

Jev integrates TypeSafe's decision model into Claude Code to auto-answer permission prompts, detect prompt injection in fetched content, validate completion claims, and optimize model routing—all via three event hooks that make fast, cheap API calls. It flags unsafe Bash commands, warns of injected content, nudges vague requests, and manages effort routing while preserving prompt cache efficiency.

A local Jev-compatible decision model (winnow:e4b via ollama) that gates dangerous Bash commands at PreToolUse and blocks unverified "done" claims at Stop, using only confident classifications (≥0.8 confidence) and logging all decisions for threshold tuning. The plugin never decides outcomes—it only provides parallel typed judgments via a `decide` MCP tool while deterministic rules and Claude Code's permission flow make final decisions.

jev-shadow runs TypeSafe Jev's hazard classifier alongside Claude Code's built-in safety checks on every proposed tool call, logging verdicts without changing behavior. In shadow mode it measures classifier agreement; in enforce mode it can block unsafe commands for sessions without Claude Code's classifier enabled.

k12mcp provides structured guidance on K-12 compliance requirements including FERPA, COPPA, state privacy laws, and DPA readiness through 8 specialized skills and a multi-step compliance-review agent. The plugin connects Claude Code to a backend MCP server, offering PII scanning, SIS integration details, rostering protocols, and procurement pathway recommendations with a credit-based usage model.

k8s-aiops bundles 55 MCP tools for governed Kubernetes operations with unified audit logging, budget guards, undo tracking, and risk-tier labels on every action. It works with any Kubernetes cluster (k3s, EKS, GKE, AKS, kind, minikube) and delegates permission enforcement to the kubeconfig's RBAC role and context.

Kanon reports every instruction file that governs a Claude Code session, where each one came from, and which expected files never loaded. It classifies sources as user-owned, project-based, or foreign (from dependencies), and tracks changes to files across sessions.

kube-guard is a Claude Code plugin that gates kubectl and helm commands by blast radius (read/write/destructive/high-risk) before execution, enforcing per-context policies, blocking secret dumps and dangerous operations on protected namespaces, and logging all decisions to an audit trail. It works as a PreToolUse hook with zero dependencies, catching kubectl anywhere in a command even when permissions are disabled.

Lawgical provides Vietnamese legal research within Claude with precise citations down to individual articles and clauses, drawing from 150,000+ legal documents. It includes specialized skills for contract drafting, contract review, and compliance checklist creation.

libre-arch-hooks provides three optional hooks that enforce architectural best practices: a SessionStart hook displays detected architecture patterns (DDD, event-driven, messaging), a PreToolUse hook prompts for confirmation before accessing secrets or environment files, and a PostToolUse hook scans edited code for layer violations and dependency direction issues. The plugin requires only bash and jq, keeps no logs, and sends nothing over the network.

This plugin provides three optional hooks that run at session start, before certain tool uses, and after document edits to warn about sensitive files, destructive commands, and documentation quality issues. It integrates with common doc frameworks (MkDocs, Docusaurus, Sphinx, mdBook, Mintlify, Antora) and linters (Vale, markdownlint) to guide Claude's behavior during documentation work.

This plugin provides three optional hooks for Claude Code to give DevOps project context at session start, confirm before editing sensitive files, and review infrastructure changes after edits. It checks for common infrastructure misconfigurations in Terraform, Kubernetes, Docker, Ansible, CI/CD pipelines, and other IaC tools, surfacing findings only when issues are detected.

This Claude Code plugin installs three hooks that inject infrastructure project context at session start, request confirmation before editing secrets or state files, and review infrastructure files for common issues after each edit. It performs pattern-based checks on Terraform, Kubernetes, Docker, Ansible, CI/CD configs, and related infrastructure code without blocking edits.

This plugin provides three optional hooks that monitor Claude Code sessions to protect ML projects: it displays a project summary at session start, asks for confirmation before touching secrets files or running destructive operations, and alerts after edits if files are empty or matching tests exist. The hooks integrate with LibreMLOps to recognize common ML frameworks and tools while keeping all checks local and sending no data over the network.

libre-mlops-hooks is a plugin that registers three lifecycle hooks—SessionStart, PreToolUse, and PostToolUse—to display ML project summaries at session start, prompt for confirmation before accessing secrets files or running destructive data/model commands, and flag empty file writes and matching test files after edits. All checks run locally via bash with no external service dependencies or API keys required.

This Claude Code plugin provides three safety and context hooks for mobile development projects: it detects and reports the platform at session start, prompts for confirmation before touching sensitive files (credentials, signing keys, provisioning profiles) and destructive commands, and warns when files are written empty while reminding to run tests after source changes.

A Claude Code plugin that provides three safety hooks for mobile development projects: PreToolUse confirms before accessing sensitive files or running destructive commands, SessionStart detects and reports the platform (Flutter, iOS, Android, React Native, or Expo), and PostToolUse warns about empty writes and reminds to run tests after source changes. The hooks require jq to parse Claude Code's JSON input and work silently without it.

loadguard confines AI-issued shell commands to systemd scopes with memory and CPU limits, preventing runaway processes from destabilizing the host machine. When system resources grow scarce, it refuses heavy commands and explains the pressure to the model so it can back off instead of thrashing the system.

Log Detective analyzes application logs from App Insights, Log Analytics, CloudWatch, GCP, or local log files to diagnose incidents by identifying when they started, new errors, latency issues, and associated infrastructure changes. It includes a read-only guard hook to prevent modifications and generates suggested alerts and postmortem drafts automatically.

mailbox-autopilot is a hybrid CLI + Claude Code plugin for triaging and cleaning up IONOS IMAP mailboxes, with a conversational skill that orchestrates dry-run preview → apply workflows and drafts replies into your Drafts folder without ever sending mail. It includes a send-blocking PreToolUse hook, audit logging, soft-delete-only operations, and multi-account support via macOS Keychain.

maisecrets intercepts secrets and personally identifiable information (PII) before they reach Claude, storing them in a local platform-specific vault and replacing them with placeholders that are resolved only at execution time. It works through deterministic detection hooks that scan user prompts, tool outputs, and command arguments, with support for multiple backends (macOS keychain, Windows Credential Locker, Linux encrypted file) and no external service dependencies.

This Claude Code skill guides users through implementing OAuth 2.1 authorization for Model Context Protocol (MCP) servers using Scalekit, including token validation, scope-based access control, and deployment. It provides step-by-step workflows with framework-specific code examples for Node.js and Python environments.

This MCP server reviews SQL queries for performance and safety issues, detects risky migrations, suggests index candidates, and analyzes EXPLAIN plans—entirely offline without database credentials. It runs locally via stdio using npx and requires Node.js 22 or newer, sending nothing to remote services.

This MCP server plugin reads package.json and package-lock.json to inventory npm dependencies, run audits, and report package health—all in read-only mode on your local machine with no remote calls or API keys required. It integrates directly into Claude Code and uses npx to start the mcp-dependency-doctor server.

md-scrub enforces Markdown content policies by intercepting writes from Claude Code's tools and removing flagged content before files are saved. It uses the Jev classifier to detect violations against custom topics, and Claude Haiku 5.5 to propose minimal edits that strip problematic text while preserving the rest.

This Claude Code plugin provides a comprehensive Mercado Pago integration toolkit with 13 specialized product skills covering payments, checkouts, subscriptions, marketplace, and disbursements across 7 Latin American countries. It combines stable integration intelligence (flows, decision trees, prerequisites) with live API data via an MCP server, plus a credential-leak prevention hook and secure token management in the OS keychain.

Scans repositories across npm, Python, Go, Rust, Java, Kotlin, and C# for outdated dependencies, queries OSV.dev to detect vulnerabilities, and orchestrates wave-by-wave upgrades to the safest-yet-most-recent version with automatic verification and git rollback on failure. Configuration options allow customization of soak periods, ignore patterns, and per-ecosystem build/typecheck/test commands.

This plugin provides governed AI-ops for self-hosted MinIO object storage, offering 48 tools for capacity analysis, bucket exposure audits, ILM gap detection, WORM retention management, and IAM operations—all wrapped in an audit harness with governance guardrails. It integrates via an MCP server, stores encrypted credentials locally, and supports both CLI and programmatic access with reversible writes and detailed prior-state tracking.

mluk-ops provides safe agent access to project servers by routing all commands through a single entry point with audit logging and intelligent gatekeeping. The plugin uses a PreToolUse hook to allow reads immediately, prompt for reversible changes, and escalate irreversible commands to the owner for approval.

mode-gate is a Claude Code security mod that enforces switchable permission profiles with a safe baseline and named rule bundles you can toggle on and off. It denies Bash commands unless an active rule explicitly allows them, while other tools are subject only to mode-gate's own guards plus Claude Code's native verdict.

This Claude Code plugin provides modular SSO flows using Scalekit's MCP server for apps with existing user management, supporting IdP-initiated login and enterprise onboarding workflows. It integrates via an MCP connection to mcp.scalekit.com and includes shell execution capabilities for managing SSO operations.

Delivers read and write operations across SolarWinds Orion, Paessler PRTG, and Zabbix monitoring platforms via a unified MCP server, including alert deduplication, SWQL queries, and governed writes with audit logging and risk-tier labelling. Enforces time-boxed maintenance windows, dry-run confirmation on destructive operations, and captures undo tokens for administrative reversibility.

MORVS provides Claude with keyless access to US public-records data including company filings, enforcement actions, recalls, sanctions, and debarments through an MCP connection and four specialized skills. The plugin returns source-cited results from government databases without requiring API keys or local credentials.

MO§ES™ Governance Plugin enforces constitutional governance for Claude Code sessions by imposing behavioral modes, operational posture controls, and cryptographic audit trails on agent behavior. It ships with three pre-built governed agents (Primary, Secondary, Observer) and automatically logs all actions with SHA-256 hashing to prevent tampering and ensure compliance oversight.

MSDS Chain provides AI-assisted chemical safety analysis through 23 tools covering hazard assessment, regulatory compliance across 10 regions, PPE recommendations, and SDS document retrieval powered by the ChainSDS database. It integrates as an MCP server and Claude Code skill to embed safety verification directly into experiment design workflows.

Muninn provides persistent memory for Claude Code that stores decisions and enforces rules from CLAUDE.md/AGENTS.md as permission controls and deny hooks. It runs as a local binary with SQLite, requiring no cloud service or model in the read path.

mypowers is a zero-trust AI co-founder OS for Claude Code that registers native hooks for edit-time secret scanning and commit gating, with progressive security posture reporting (FULL/PARTIAL/BASIC) based on available tooling. It provides shared skills, agents, commands, and scripts for security orchestration while remaining fully functional even when optional external security tools are missing.

This Claude Code plugin wraps 33 NAPALM tools for multi-vendor network device operations (Cisco IOS/XE/NX-OS/XR, Arista EOS, Juniper Junos) with a local audit log, encrypted credential storage, token budgets, and undo recording. Every tool is governed with risk-tier labels and redacts secrets; reads and writes are fully auditable to ~/.network-aiops/audit.db.

This plugin wraps OloLand's deterministic forensic quality-of-earnings engines—Beneish M-Score, Benford's Law, EBITDA bridge, journal-entry testing, lapping detection, and legal clause analysis—to provide IC-defensible financial fraud screening as a Pre-LOI alternative to Big-4 QoE engagements. It integrates with OloLand's MCP server to run earnings-manipulation diagnostics and conflict detection on uploaded deal documents with results in 72 hours at $99 per screen.

Open-Crab is a self-maintaining system toolkit for Claude Code that automates daily patrols, disk cleanup, security scans, and self-evolution through a suite of 4 commands and an optional MCP server for local LLM analysis. It can run without dependencies or integrate with local LLM backends (Ollama, LM Studio, llama.cpp, vLLM) to offload file understanding and reduce API token usage.

The ops-toolkit plugin bundles five operational skills covering cloud cost optimization, incident diagnosis from logs, CI/CD health checks, bug fixing, and weekly digests, all behind a guard hook that prevents cloud changes and secret reads. It operates read-only with no external API keys required, executing bash commands to analyze and report on infrastructure and deployment health.

os-control-mcp is an MCP server plugin that gives Claude Code sanctioned control of Linux systemd services, journald logs, D-Bus, and power management through structured system interfaces (systemctl, journalctl, busctl) rather than raw commands. It includes read-only observation tools (diagnostics, logs, resources, processes) and guarded action tools (service control, power operations, notifications) with self-preservation guards that prevent accidental severance of critical system services.

ossay-guard intercepts package installation commands (npm, pip, cargo, go, yarn, pnpm, poetry, uv) and checks each package's actual license file via Ossay before proceeding, prompting you to confirm when licenses are non-commercial, source-available, unlicensed, or restricted. The plugin uses a PreToolUse hook to examine registry metadata and GitHub repositories, allowing permissive licenses silently while blocking or warning on restricted terms.

OurPay Wallet is a Claude Code plugin that provides 45 MCP tools for managing blockchain wallets, enabling AI agents to perform token transfers, trades, and transactions on EVM/Solana networks with owner approval workflows. It includes features for Hyperliquid orders, contract simulations, and OurPay purchases, with optional "Risky mode" for autonomous operation and required Node 24+ runtime.

A PreToolUse hook that blocks dangerous pgrep/pkill patterns that would kill the agent's own session or create infinite loops waiting on processes that cannot exit. It provides specific mitigation advice (using PIDs, --ignore-ancestors, or bracket tricks) when denying unsafe command shapes.

Diagnoses root causes and patterns in Azure Pipelines and GitHub Actions runs, identifying flaky tests, regressions, performance bottlenecks, and caching issues through YAML analysis. Performs security and reliability reviews of CI/CD pipeline configurations using read-only access.

pkgguard prevents coding agents from installing hallucinated, typosquatted, malicious, or freshly hijacked npm and PyPI packages by checking package names and metadata before installation. It operates as a Claude Code hook that intercepts package manager commands, queries npm and PyPI registries, and checks OSV advisories for malware or known vulnerabilities.

prediction-protocol enforces falsifiable predictions before executing dangerous one-way operations (migrations, deploys, force-push, recursive delete, etc.) by requiring a receipt that contains a hypothesis, measurement command, and expected outcome. The system halts on prediction misses and maintains a refuted-beliefs ledger to prevent recurring mistakes.

Preflight is a Claude Code plugin that blocks secrets from being committed by scanning what git add actually stages, and alerts you to auto-executing code in cloned repositories. It also guards against irreversible shell commands, private key leaks, unsafe browser operations, and requires searches before editing payment, auth, schema, or configuration files.

PromptSign verifies cryptographic signatures on Claude Code instruction files (CLAUDE.md, skills, and agent definitions) using Sigstore keyless infrastructure before they reach model context. It re-checks skill bundles at runtime and blocks tampered files, with offline verification against a pinned trust root and no telemetry.

protect-mcp is an MCP security gateway that enforces per-tool policies, generates Ed25519-signed receipts, and provides human approval gates while logging all operations—with shadow mode for non-blocking audits and enforce mode for active policy application. Every security decision is cryptographically signed and verifiable offline, allowing users to benchmark policies against attack suites.

proxy-aiops is an MCP server providing unified AI-ops for Traefik, Caddy, and HAProxy reverse proxies, exposing 28 tools for reading routes, services, certificates, traffic stats, and performing RCA analyses like backend health and cert expiry across all three platforms. It includes governed write operations for config management and server state changes, with built-in audit logging, risk-tier labeling, and undo/restore capabilities.

publish-guard blocks commits, pushes, pull requests, issues, and GitHub API calls that would leak private terms or non-allowed email addresses into repositories of protected GitHub owners, running as a Claude Code hook, git hook, and CI check. It scans commit messages, PR descriptions, issue bodies, author metadata, and file contents against a configurable list of private terms and allowed email patterns.

qlaudified tracks factual claims in Claude's responses by recording their source, qualifiers, and whether those qualifiers persist through multi-step reasoning chains. It uses a "Provenance Administrator" agent to monitor tool use and optionally refeed facts with their original qualifiers back into Claude's loop to preserve hedging language.

queue-aiops provides an AI-ops toolset for diagnosing and operating Redis and RabbitMQ brokers, with 28 MCP tools for memory/latency/backlog/churn root-cause analysis and governed writes (config, client kill, queue purge/delete). Every operation is audited, budgeted, and risk-tiered, with reversible writes recording their before-state for undo capability.

A team of eight specialized agents that delegate Rails development tasks—models, jobs, debugging, code review, security audits, performance analysis, deployments, and upgrades—each reading the project's Gemfile and config to match its actual conventions. Four read-only advisors (debugger, reviewer, security, performance) provide findings with evidence via a SessionStart hook, while four writing specialists (model, jobs, deploy, upgrade) are dispatched on demand.

Reco integrates SaaS and AI security capabilities directly into Claude Code, allowing developers to query application risks, shadow IT, AI agents, user posture, and access events. The plugin provides 5 commands and 1 agent for security investigation and analysis without requiring external API keys.

This Claude Code plugin recovers sessions after Anthropic API output-classifier false positives by surgically removing the triggering message and refusal turn, then re-stitching the JSON parentUuid chain so session resumption works cleanly. It includes hooks to auto-detect policy violations, inject recovery context on the next prompt, and install per-repo CLAUDE.md framing guards to prevent recurrence on legitimate engineering work.

A research and investigation plugin that applies symmetric skepticism to contested topics through deep-investigation protocols, source deconstruction, frame rotation, and adversarial dialectic testing. It ships two MCP servers (financial-mcp for stock data via yfinance, and transparency-mcp for US Congress bills, World Bank indicators, and nonprofit filings) and 22 skills organized around investigation, verification, and bias detection.

A Cedar-enforced access control plugin that intercepts and gates every Cowork tool call and user prompt through 9 lifecycle hooks (session, prompt, tool use, and shutdown events). Integrates with the reva-plugin.onrender.com governance service and relies on shell command execution for policy enforcement.