repo-guardian

To scan a git repository for malicious hooks before cloning, run the `guard scan` command to inspect git hooks, .claude settings, and .mcp.json files. This pre-clone security scanner detects malicious payloads and credential-harvesting patterns before any code processing occurs.

A poisoned MCP configuration is a malicious .mcp.json file setup designed to hijack MCP server registrations. Repository scanning detects it by verifying MCP server registrations during the pre-clone scan, preventing credential redirection and malicious code execution.

Yes, you can check for credential-harvesting patterns in .env files and package dependencies using a layered scanning approach. The scanner validates .env files, analyzes package dependencies, and scans for credential redirection to ensure repository integrity.

The best way to prevent prompt injection in Claude Code repositories is to perform a comprehensive pre-clone security scan. This detects prompt injection, malicious git hooks, and hidden files, ensuring malicious payloads do not execute during code processing.

Yes, repository scanning verifies submodules and analyzes hidden files for security vulnerabilities. The layered scanning approach checks submodules, inspects hidden files, and detects malicious code to ensure the repository is free from known attack vectors.