command-guard

To block dangerous bash commands in Claude Code, install a PreToolUse hook in the .claude/settings.json file. This hook intercepts Bash tool calls, validates them against a blocklist, and stops risky operations like destructive deletions, force pushes, and database drops before execution.

Claude Code projects need protection against destructive file deletions, Git force pushes, hard resets, database drops, and credential leaks. A command filtering hook intercepts these risky shell operations before they execute, returning blocking reasons to prevent accidental data loss or broken repository history.

Yes, you can customize the blocklist to include project-specific rules like protected Git branches, sensitive config files, or deployment restrictions. The command-guard hook allows you to extend its filtering policies to enforce safer agent behavior when working with repositories and local environments.

A PreToolUse hook validates bash commands by using a Python filter that intercepts shell tool calls, checks them against a blocklist, and returns blocking reasons if dangerous operations are detected. When input cannot be parsed, the hook fails open to allow execution while avoiding false blocks.

Yes, the command-guard hook is designed specifically for Claude Code projects that use Bash tools and need protection against destructive deletions, force pushes, and database drops. It integrates directly via the .claude/settings.json file to intercept shell commands before execution.

When the bash command filter cannot parse the input, it fails open and allows the command to execute. This design prevents the safety hook from accidentally blocking legitimate operations due to parsing errors, ensuring development workflows are not disrupted by false positives.