Help us improve
Share bugs, ideas, or general feedback.
Share bugs, ideas, or general feedback.
Share bugs, ideas, or general feedback.
By frmoretto
Guards against dangerous shell commands and credential file reads by combining pattern-based blocking with optional LLM analysis before execution
npx claudepluginhub frmoretto/hardstop --plugin hsEnable Hardstop protection
Skip Hardstop safety check for the next command only
Show Hardstop current status and statistics
Hardstop - Pre-execution safety layer for shell commands. Shows status and help.
Show Hardstop audit log entries
Executes bash commands
Hook triggers when Bash tool is used
Share bugs, ideas, or general feedback.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Smart command safety filter for Claude Code β parses shell pipelines and evaluates per-command safety rules to auto-approve safe commands and block dangerous ones
Safety hooks to block or require user approval for dangerous commands (rm, git operations, .env access, file size limits)
A secure runtime for Claude Code. Intercepts every tool call with policy-based allow/block/ask decisions, evasion detection, path fencing, file snapshots, and audit logging.
Block destructive git and filesystem commands before execution
Protect secrets and credentials from Claude Code. Blocks writes to .env files, detects API keys in shell commands, prevents hardcoded tokens, and guards service account JSON files.
Achieve flow state safely with Claude Code. Auto-approves routine work, gates risky actions, hard-blocks dangerous patterns. Dual enforcement (skill + hooks), token cap for cost governance, full audit trail. Zero dependencies.
π β Star on GitHub if Hardstop keeps you safe!
Pre-execution safety validation for AI coding agents. Validates every shell command against 428 security patterns before execution β blocking destructive operations, credential theft, infrastructure teardown, and prompt injection. Fail-closed: blocks by default when uncertain.
Ecosystem: The detection patterns are published separately as hardstop-patterns (GitHub) β reusable in any Node.js tool.
Installation β’ How It Works β’ Commands β’ Report Issue
You trust your AI, but you shouldn't trust it with rm -rf / or reading your ~/.aws/credentials. Hardstop sits between the LLM and your system, enforcing a strict Fail-Closed policy on dangerous operations.
&&, |, ;).ssh, .aws, .env) (v1.3)Claude tries to ruin your day? Hardstop says no.
# Claude attempts a home directory deletion
$ rm -rf ~/
π BLOCKED: Deletes home directory
# Claude tries to read your AWS credentials
$ Read ~/.aws/credentials
π BLOCKED: AWS credentials file
# You check the status
$ /hs status
Hardstop v1.4.3
Status: π’ Enabled
Session Risk: Moderate (35/100)
Blocked: 2 commands this session
# One-time bypass for a command you trust
$ /hs skip
βοΈ Next command will skip safety check
# Multi-skip: bypass next 3 commands (v1.3.2)
$ /hs skip 3
βοΈ Next 3 commands will skip safety check
# View recent security decisions
$ /hs log
2026-01-20 10:30:45 π [pattern] rm -rf ~/
ββ Deletes home directory
Hardstop uses a two-layer verification system for Bash commands and pattern-based protection for file reads.
graph TD
A[Tool Call] --> B{Bash or Read?};
B -- Bash --> C{Layer 1: Patterns};
C -- Dangerous Pattern --> D[π BLOCK];
C -- Safe Pattern --> E[β
ALLOW];
C -- Unknown --> F{Layer 2: LLM Analysis};
F -- Risky --> D;
F -- Safe --> E;
B -- Read --> G{Credential File?};
G -- .ssh/.aws/.env --> D;
G -- Source Code --> E;
D --> H[Log to Audit];
E --> I[Execute];
The 428 detection patterns (Layer 1) are published as a standalone npm package: hardstop-patterns β usable in any Node.js tool, not just Hardstop.
PatchPilot - Package vulnerability scanner that blocks risky npm/pip/brew installations.
| Tool | Focus | What It Protects |
|---|---|---|
| Hardstop | Command execution safety | Blocks dangerous commands (rm -rf /, credential theft) |
| PatchPilot | Package installation security | Blocks packages with known CVEs |
Use both for complete Claude Code security:
# Install PatchPilot (package vulnerability scanning)
npx patchpilot-cli install
# Install Hardstop (command execution safety)
npx hardstop install
Why both? PatchPilot secures your dependencies, Hardstop secures your execution layer. No overlapβthey're complementary.