guardrails

guardrails refuses three kinds of shell command before they run: Cloudflare writes through cf, commits and pull requests that carry an attribution line, and branches named claude/…. Claude gets the reason back as the tool result, so it can drop the trailer or rename the branch and try again.

What it blocks

• Cloudflare writes. cf deploy, cf migrate and cf init. The author keeps deploys on each project’s Wrangler flow; wrangler commands are not checked.
• Attribution lines. A git commit, gh pr or gh issue command whose text contains Co-Authored-By or “Generated with Claude”, in any letter case. Any Co-Authored-By counts, so a trailer crediting a person is refused too.
• claude/ branches. git checkout -b, git switch -c, git branch or git push with a branch that starts with claude/, including refspecs such as HEAD:claude/fix and refs/heads/claude/fix. Claude is told to use a purpose prefix such as fix/, style/ or chore/ instead.

These are the author’s own conventions, and they are fixed in the code. To change one, edit hooks/register.ts in the plugin. Reading credential files is left to the same author’s secret-guard.

Install

Needs Claude Code 2.1.287 or later.

claude plugin marketplace add arasovic/claude-code-mods
claude plugin install guardrails@claude-code-mods

Restart Claude Code. There is nothing to run: every Bash call is checked from then on.

If you already added this marketplace for session-meter or another mod from the repo, skip the first command. Other repos, such as karanb192/claude-code-mods, also name their marketplace claude-code-mods. If claude plugin marketplace list shows one of those, remove it first with claude plugin marketplace remove claude-code-mods.

How it works

A single tool.call hook watches Bash calls and nothing else. Before the command runs, it tests the command text against three regular expressions. On a match, the call is refused with guardrails: and a one-line reason, and the command never runs.

That text is all it reads. It stores nothing, makes no network calls and adds nothing to the conversation unless it refuses a call.

Limitations

• It checks the command text only. git commit -F message.txt with the trailer inside the file, a shell alias or a script that commits all get through. For a hard guarantee, the author points to permission deny rules in settings.json.
• The patterns match anywhere in the text, so git commit -m "docs: explain cf deploy" is refused as a Cloudflare write.
• Only Bash is covered. A pull request opened through an MCP server or any other tool is not checked.