Blast Radius

Anthropic’s Claude Code CLI runs with ambient host terminal authority. When Claude plans high-velocity refactors, it can execute cascading recursive shell operations like `rm -rf`, execute unverified package scripts, or inadvertently rewrite environment credential stores (`.env.production`). Blast Radius injects a zero-latency Tree-sitter AST scanner before `tool.call` dispatch to evaluate blast radius score (0-100), blocking dangerous commands and prompting developer confirmation for medium-risk modifications.

{
  "$schema": "https://claudemods.org/schemas/plugin.v2.json",
  "name": "blast-radius",
  "version": "2.0.4",
  "publisher": "@security-craft",
  "entrypoint": "dist/register.js",
  "hooks": [
    {
      "event": "tool.call:execute_bash",
      "priority": 100,
      "blocking": true
    },
    {
      "event": "tool.call:fs.write",
      "priority": 90,
      "blocking": true
    }
  ],
  "permissions": {
    "fs.read": [
      "."
    ],
    "fs.write": [],
    "network": "none",
    "env.read": [
      "PWD",
      "CLAUDE_SESSION_ID"
    ]
  },
  "configSchema": {
    "maxRiskScore": {
      "type": "number",
      "default": 65
    },
    "allowRules": {
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  }
}

import { defineMod, registerHook } from '@claude/code-plugin-sdk';
import { analyzeAST } from './tree-sitter-guard.js';

export default defineMod({
  name: 'blast-radius',
  version: '2.0.4',
  setup({ on }) {
    on('tool.call:execute_bash', async (ctx) => {
      const { command } = ctx.payload;
      const score = await analyzeAST(command);
      
      if (score >= 65) {
        return ctx.abort(`Blast Radius exceeded threshold (${score}/100): command blocked for safety.`);
      }
      if (score >= 35) {
        const approved = await ctx.promptConfirm(`High blast radius (${score}/100): Execute "${command}"?`);
        if (!approved) return ctx.abort('Cancelled by developer.');
      }
      return ctx.proceed();
    });
  }
});