Getting Started

Make Claude Code safe in 5 minutes. No coding required. Works on macOS, Linux, and Windows (WSL).

Why this matters: Claude Code has no safety hooks by default. Users have lost entire directories, pushed untested code to main, and committed API keys to public repos. These hooks prevent that.

Prerequisites

0

Install jq 30 sec

Hooks need jq to read JSON. Check if you have it:

jq --version

If not installed:

# macOS
brew install jq

# Ubuntu / Debian
sudo apt install jq

# Windows (in WSL)
sudo apt install jq

Install

1

Run one command 30 sec

This installs 8 safety hooks and configures your settings.json:

npx cc-safe-setup

You'll see a list of hooks. Press Y to install.

What gets installed: destructive command blocker, branch push guard, secret leak prevention, syntax checker, context monitor, bash comment stripper, cd+git auto-approver, API error alert.
2

Restart Claude Code 10 sec

Hooks load on startup. Close Claude Code and reopen it:

# In your terminal, exit Claude Code (Ctrl+C or type /exit)
# Then start it again
claude
3

Verify hooks work 30 sec

Run the diagnostic to confirm everything is set up:

npx cc-safe-setup --doctor

All items should show . If any show , the doctor tells you how to fix it.

Test It

4

Simulate a dangerous command 30 sec

See how hooks react without actually running the command:

npx cc-safe-setup --simulate "rm -rf /"

You should see: ✗ BLOCK — destructive-guard

npx cc-safe-setup --simulate "git status"

You should see: → This command would trigger a permission prompt

Optional: Reduce Permission Prompts

5

Auto-approve read-only commands 30 sec

Tired of approving ls, cat, and git log? This hook auto-approves commands that can't modify anything:

npx cc-safe-setup --install-example auto-approve-readonly

Reduces permission prompts by about 80%. Only commands that write, delete, or push still require approval.

6

Auto-approve test commands 10 sec

npx cc-safe-setup --install-example auto-approve-test

npm test, pytest, go test, cargo test — all auto-approved.

Optional: Maximum Safety

7

Shield mode 30 sec

For autonomous sessions where Claude runs unattended:

npx cc-safe-setup --shield

Installs everything from steps 1-6 plus: scope guard, memory write guard, skill gate, and project-specific hooks based on your tech stack.

What Happens Next

The hooks run silently in the background. You won't notice them until they block something dangerous. When they do, you'll see a clear message explaining what was blocked and why.

Note: Hooks are bypassed when Claude Code runs with --dangerously-skip-permissions or --bare. These modes disable all safety hooks by design.

Next Steps