Claude Code hooks
Security scanning inside Claude Code
Run checks from the host lifecycle instead of relying on a prompt. gate scans edits and inspects shell commands. turn answers at Stop: which of these did this turn just do?
Checks attached to host events
- 01 PostToolUsegate scans the file after Edit, Write, or MultiEdit
- 02 PreToolUsegate fails closed before a Bash command executes
- 03 Stopturn reports only what this turn introduced
npm i -D owlwarden
npx owlwarden init --claude-codeWhat that writes
| Event | Scope | Verdict |
|---|---|---|
PostToolUse (Edit, Write, MultiEdit) | the file that was written | gate blocks with the rule, the line, and the fix |
PreToolUse (Bash) | the command string | gate blocks the command when the check fails |
Stop | everything changed since the turn began | turn --hook claude-code --record: only what this turn introduced |
Per-edit and pre-command hooks stay on gate: those must be cheap
and have no meaningful base to compare against.
turn at Stop is a different question.
An agent told "there are eighteen findings" triages a backlog nobody asked
it to touch.
No repository SessionStart hook
The generated config does not add a SessionStart entry.
agent-hook-autoexec
reports repository configuration that runs when the workspace is opened, at
high severity, because anyone who clones the repository and opens it runs that
command. owlwarden scan would report a generated repository hook
of that shape.
The session digest belongs in user settings,
which a cloned repository cannot write. The same reasoning is why the MCP
entry is node_modules/.bin/owlwarden rather than
npx -y owlwarden:
that shape is a finding too.
MCP for manual scans
Hooks run checks automatically. MCP handles prompted
requests such as explain this rule or scan
packages/api. The server is read-only and static-only.
Before you open an unfamiliar repository
npx owlwarden vet ./cloned-repo
What vet refuses to trust /
what lives in .claude/ /
every rule.
Keep reading
- owlwarden turnWhich of these did I just do?
- RulesTrigger, confidence, and framework-specific fix.
- Agent configHooks, MCP servers, instructions, and editor tasks.
- owlwarden vetCheck a repository before you open it.
- owlwarden sealNotice when your agent's execution surface moves.
- ExposureWhich of these findings do I fix first?
- RuntimesDoes this fix run on Bun, Deno, or Workers?
- CoverageMapped rules and categories static analysis cannot cover.