Claude Guard Hook

claude-guard

A global Claude Code hook that intercepts sensitive data before it reaches the LLM — secrets, API keys, PII, and system info are replaced with `{{GUARD:...}}` placeholders. When Claude writes back, real values are transparently restored.

**Note**: This is a **hook**, not a plugin. Hooks intercept Claude's built-in tools (Read, Write, Bash) via `~/.claude/settings.json`. They work silently in the background.

Quick start

git clone https://github.com/mourad-ghafiri/claude-guard-hook
cd claude-guard-hook
npm run guard:install

**Restart Claude Code after installing.**

Usage

npm run guard              # Interactive menu (recommended)
npm run guard:install      # Install
npm run guard:uninstall    # Uninstall
npm run guard:reload       # Rebuild + apply changes
npm run guard status       # Show status
npm run guard patterns     # List all patterns
npm run guard help         # All commands

How it works

User prompt ──> [UserPromptSubmit] ──> redact secrets → {{GUARD:...}}
                                       feedback: "⚠ redacted 2 secret(s)"

File read   ──> [PreToolUse Read]  ──> block protected files (mock content)
                                       redact secrets + system info

File write  ──> [PreToolUse Write] ──> restore {{GUARD:...}} → real values

Bash cmd    ──> [PreToolUse Bash]  ──> restore placeholders in commands
                                       block env dumps + protected files

Strategies

Strategy	Result	Reversible	When to use
placeholder	{{GUARD:Name:hex}}	Yes	Default. Round-trips safely through Claude
mask	[REDACTED]	No	Hide completely, no trace
replace	Custom replaceBy value	No	Swap with a safe alternative

Patterns

All 48 patterns live in `config/default-config.json` — one flat list. Each pattern has `id`, `name`, `pattern` (regex), `category`, `enabled`, `redactionStrat