开源MCP工具

Free guides

Quick Start by Scenario

Examples

Examples

Need custom hooks beyond the 8 built-in ones? Install any example with one command:

npx cc-safe-setup --install-example block-database-wipe

Or browse all available examples in examples/:

• claude-update-smart.sh: Skip the 226 MB tarball download when already up-to-date (workaround for #51243). Turns 30 s checks into 0.3 s. Falls through to the real claude update when a new release exists or the registry is unreachable.
• auto-approve-git-read.sh: Auto-approve git status, git log, even with -C flags
• auto-approve-ssh.sh: Auto-approve safe SSH commands (uptime, whoami, etc.)
• enforce-tests.sh: Warn when source files change without corresponding test files
• notify-waiting.sh: Desktop notification when Claude Code waits for input (macOS/Linux/WSL2)
• edit-guard.sh: Block Edit/Write to protected files (defense-in-depth for #37210)
• auto-approve-build.sh: Auto-approve npm/yarn/cargo/go/python build, test, and lint commands
• auto-approve-docker.sh: Auto-approve docker build, compose, ps, logs, and other safe commands
• block-database-wipe.sh: Block destructive database commands: Laravel migrate:fresh, Django flush, Rails db:drop, raw DROP DATABASE (#46684 #46650 #37405 #37439)
• sql-bulk-delete-warn.sh: Warn when DELETE/UPDATE/TRUNCATE runs via psql/mysql/sqlite3/sqlcmd without a row-count safeguard. Catches the Issue #56738 pattern (DELETE WHERE col IS NULL after a regex/UPDATE that silently NULLed nearly every row, wiping 24,472 of 24,475 rows in 5 minutes before autovacuum cleaned the dead tuples). Also flags DELETE/UPDATE without WHERE, TRUNCATE TABLE, and psql -c invocations missing an explicit transaction. Strict mode via CC_SQL_BULK_DELETE_BLOCK=1 (#56738)
• auto-approve-python.sh: Auto-approve pytest, mypy, ruff, black, isort, flake8, pylint commands
• auto-snapshot.sh: Auto-save file snapshots before edits for rollback protection (#37386 #37457)
• allowlist.sh: Block everything not explicitly approved, inverse permission model (#37471)
• protect-dotfiles.sh: Block modifications to ~/.bashrc, ~/.aws/, ~/.ssh/ and chezmoi without diff (#37478)
• scope-guard.sh: Block file operations outside project directory, absolute paths, home, parent escapes (#36233)
• auto-checkpoint.sh: Auto-commit after every edit for rollback protection (#34674)
• git-config-guard.sh: Block git config --global modifications without consent (#37201)
• deploy-guard.sh: Block deploy commands when uncommitted changes exist (#37314)
• network-guard.sh: Warn on suspicious network commands sending file contents (#37420)
• test-before-push.sh: Block git push when tests haven't been run (#36970)
• large-file-guard.sh: Warn when Write tool creates files over 500KB
• commit-message-check.sh: Warn on non-conventional commit messages (feat:, fix:, docs:, etc.)
• env-var-check.sh: Block hardcoded API keys (sk-, ghp_, glpat-) in export commands
• timeout-guard.sh: Warn before long-running commands (npm start, rails s, docker-compose up)
• branch-name-check.sh: Warn on non-conventional branch names (feature/, fix/, etc.)
• todo-check.sh: Warn when committing files with TODO/FIXME/HACK markers
• path-traversal-guard.sh: Block Edit/Write with ../../ path traversal and system directories
• case-sensitive-guard.sh: Detect case-insensitive filesystems (exFAT, NTFS, HFS+) and block rm/mkdir that would collide due to case folding (#37875)
• compound-command-approver.sh: Auto-approve safe compound commands (cd && git log, cd && npm test) that the permission system can't match (#30519 #16561)
• tmp-cleanup.sh: Clean up accumulated /tmp/claude-*-cwd files on session end (#8856)
• session-checkpoint.sh: Save session state to mission file before context compaction (#37866)
• verify-before-commit.sh: Block git commit when lint/test commands haven't been run (#37818)
• hook-debug-wrapper.sh: Wrap any hook to log input/output/exit code/timing to ~/.claude/hook-debug.log
• loop-detector.sh: Detect and break command repetition loops (warn at 3, block at 5 repeats)
• same-correction-arrest.sh: Detect the user repeating the same correction N=3 times in a session, then require a written plan before further Write/Edit. Operationalizes the model's own self-diagnosis in #60506 ("I have no drift detector"), grounded in the recognition-without-arrest framework from #60226.
• closure-word-verify-gate.sh: Stop hook that scans the assistant's outgoing turn for closure words ("done", "shipped", "complete", "bitti", "finished") and refuses Stop unless a verification command (test runner, Playwright, curl) ran in the same turn. Implements customer recommendation #4 from #60506: "two hours after the rule I said 'bitti' again, without opening the browser"_.
• redundant-read-blocker.sh: PreToolUse hook on Read that detects when the model is about to re-read a file already read in the same session (with the same mtime). Operationalizes #60283 ("excessive token consumption — task halted mid-execution with zero output") and the broader quota-leakage cluster (analysis, audit tool). Default mode warns; strict mode refuses the call.
• commit-quality-gate.sh: Warn on vague commit messages ("update code"), long subjects, mega-commits
• session-handoff.sh: Auto-save git state and session info to ~/.claude/session-handoff.md on session end
• diff-size-guard.sh: Warn/block when committing too many files at once (default: warn at 10, block at 50)
• dependency-audit.sh: Warn when installing packages not in manifest (npm/pip/cargo supply chain awareness)
• env-source-guard.sh: Block sourcing .env files into shell environment (#401)
• symlink-guard.sh: Detect symlink/junction traversal in rm targets (#36339 #764)
• no-sudo-guard.sh: Block all sudo commands
• no-install-global.sh: Block npm -g and system-wide pip
• no-curl-upload.sh: Warn on curl POST/upload (data exfiltration)
• no-port-bind.sh: Warn on network port binding
• git-tag-guard.sh: Block pushing all tags at once
• npm-publish-guard.sh: Version check before npm publish
• max-file-count-guard.sh: Warn when 20+ new files created per session
• protect-claudemd.sh: Block edits to CLAUDE.md and settings files
• reinject-claudemd.sh: Re-inject CLAUDE.md rules after compaction (#6354)
• binary-file-guard.sh: Warn when Write targets binary file types (images, archives)
• stale-branch-guard.sh: Warn when working branch is far behind default
• cost-tracker.sh: Estimate session token cost and warn at thresholds ($1, $5)
• read-before-edit.sh: Warn when editing files not recently read (prevents old_string mismatches)
• windows-python-stub-detector.sh: SessionStart probe that surfaces the Microsoft Store python3 stub on Windows Git Bash — which python3 succeeds but subprocess exits 49 with no output, silently no-op-ing every Python-based hook. Matches four failure modes (exit 49 / Store-redirect stderr / exit 127 / silent stub) and warns via hookSpecificOutput (#57946)

Migration Guide

MIGRATION.md: Step-by-step guide for moving from permissions-only to permissions + hooks. Keep your existing config, add safety layers on top.

Configuration

settings.json Reference

SETTINGS_REFERENCE.md: Complete reference for permissions, hooks, modes, and common configurations. Includes known limitations and workarounds.

Plugin Marketplace

Install safety hooks as Claude Code plugins, no npm required:

/plugin marketplace add yurukusa/cc-safe-setup
/plugin install safety-essentials@cc-safe-setup

Also listed on claudemarketplaces.com.

CI Integration (GitHub Action)

```yaml

.github/workflows/safety.yml

- uses: yurukusa/cc-safe-setup@main with: threshold: 70 # CI fails if score drops below this ```

Troubleshooting

TROUBLESHOOTING.md: "Hook doesn't work" → step-by-step diagnosis. Covers every common failure pattern.

FAQ

Q: I installed hooks but Claude says "Unknown skill: claude-code-hooks:setup"

cc-safe-setup installs hooks, not skills or plugins. Hooks run automatically in the background, you don't invoke them manually. After install + restart, try running a dangerous command; the hook will block it silently.

Q: cc-health-check says to run cc-safe-setup but I already did

cc-safe-setup covers Safety Guards (75-100%) and Monitoring (context-monitor). The other health check dimensions (Code Quality, Recovery, Coordination) require additional CLAUDE.md configuration or manual hook installation from claude-code-hooks.

Q: Will hooks slow down Claude Code?

No. Each hook runs in ~10ms. They only fire on specific events (before tool use, after edits, on stop). No polling, no background processes.

**Q: My permission p