70 mods for Claude Code security tools, ordered by the votes people give them on ClaudeMods. A good place to start: sec-default,ruflo-market-data or ruflo-migrations.
Each entry links to its original repository or post, and shows how to install it.
70
Keeps secrets, email addresses and IP addresses out of the session transcript: swaps each one for a stable placeholder on the way in, and puts the real value back on the way into a tool call
Starter mod: logs each tool call and blocks Bash commands that contain rm -rf.
The author nearly wiped a Kubernetes namespace after approving an agent’s `oc delete --all` without reading it, then built a suite of 11 Claude Code plugins using the new function hooks API. The main mod, guardrails, blocks destructive commands like mass kubectl/oc deletes, rm -rf, force-push, and secret reads, and tells Claude the user blocked it. Other mods cover activity monitoring, desktop notifications, context tracking, usage limits, prompt coaching, command discovery, and a mod manager. Nine of eleven never call a model, there is no telemetry, and the project is free and MIT licensed.
Track what your AI coding tools cost
syrtis.nyanako.comVisit sponsor ↗
A Claude Code guard mod that denies Edit, Write and NotebookEdit on secret locations (dotenv files, private keys, ~/.ssh, ~/.aws, ~/.gnupg, pass store) and on content carrying a credential shape, including passwords inside URLs. It also denies Bash writes to those paths and Bash reads that would print them. Ships with its own tests.
Example Claude Code mod that rewrites Bash output before the model reads it, preventing tokens and secrets from entering context.
Require a one-time confirmation code for dangerous commands to prevent accidental execution.
Checks each package the model installs against its registry and OSV.dev, and stops a missing, brand-new, look-alike, outdated or vulnerable one, naming the latest version.
Check permission conditions when merge or push commands are detected.
A Claude Code plugin that masks secrets, personal details, and business figures on screen and keeps private files closed while you record, with /rec, /rec strict, /rec off, and /rec config commands.
One key for 140+ AI models
bazaarlink.aiVisit sponsor ↗A Claude Code mod that watches Edit/Write edits to GitHub Actions workflows and, when a step is pinned to a moving ref (tag or branch), tells the model the commit SHA to write instead; an optional deny mode blocks git commit, push and merge until refs are pinned.
Clickable safety rules for Claude Code: block rm -rf, force-push, mass kubectl deletes, secret file access, sudo and network calls, with presets and jail-to-project modes.
