Tool Gatekeeper
v2.1.0🛡️Tier 1 Security AuditedCLI v2.1.287+ VerifiedZero-trust policy engine and human-in-the-loop escalation guardrail for sensitive terminal commands.
Problem Solved & Architectural Motivation
Enforces strict team-wide security policies. Configurable regex rules and AST checks prevent unauthorized port bindings, external network calls, and privileged file modifications without explicit terminal approval.
Zero-Time AST Interception
Evaluates tool payloads prior to kernel fork.
0-100 Impact Index
Weighted heuristic scoring: files touched, git dirty state, env scope.
Native CLI Hook
Zero proxy daemon required; hooks straight into Claude tool calls.
Lifecycle Architecture & Hook Flow
Manifest Schema (plugin.json)
{
"name": "tool-gatekeeper",
"version": "2.1.0"
}Hook Implementation (register.js)
export default function gatekeeper(sdk) {
sdk.on('tool.call:*', async ({ tool, args, promptConfirm }) => {
if (['deploy', 'drop', 'chmod'].some(k => JSON.stringify(args).includes(k))) {
return await promptConfirm(`Authorize sensitive operation for [${tool}]?`);
}
});
}Technical Specifications
Related tool-guards Mods
Pre-execution AST blast radius auditor for Claude Code CLI. Intercepts bash commands, dangerous file deletions, env leaks, and unexpected AST mutations before local execution.
Automatic API key, SSH credential, and secret redaction proxy for terminal outputs and tool requests.
POSIX command sanitizer preventing accidental recursive deletes, fork bombs, and sudo privilege escalation.