70 mods for Claude Code security tools, ordered by the votes people give them on ClaudeMods. A good place to start: sec-default,ruflo-market-data or ruflo-migrations.
Each entry links to its original repository or post, and shows how to install it.
70
Streaming mode. Hides names, paths and keys you list from tool output before they reach the screen.
A Claude Code plugin that blocks destructive shell commands and edits to secrets before they run, using function hooks on Bash, Edit, Write and NotebookEdit tool calls.
Dry-runs risky Bash commands (recursive deletes, destructive git, kubectl delete, SQL wipes) and asks Proceed or Cancel first.
A pane of what this machine lets Claude do, read from settings.
Track what your AI coding tools cost
syrtis.nyanako.comVisit sponsor ↗
A Claude Code mod that keeps secrets out of the conversation and out of public repos.
keeps secrets out of every transcript: api keys, tokens and private keys read as a stable placeholder in every kept row, and come back only inside the tool call that names them
Masks secrets (API keys, tokens, passwords, .env values) in tool output and prompts before Claude reads them
A Claude Code function-hook plugin that blocks a `git add` from staging your whole `$HOME` work-tree (`dot add -A`, `dot add .`, `dot add *`). Ships with install instructions via `CLAUDE_CODE_PLUGIN_DIRS` or `--plugin-dir`, plus a configurable `dot-guard.wrappers` setting for custom dotfiles aliases.
A Claude Code plugin that pairs Chrome browser profiles with cswap accounts and blocks Chrome tool actions when the active account does not match the paired profile.
One key for 140+ AI models
bazaarlink.aiVisit sponsor ↗
Asks before a destructive command runs on another machine over ssh (restarts, deletes, kills, reboots)
A Claude Code mod that previews the blast radius of destructive Bash commands when they ask for permission: rm targets measured (files, size, what git can't restore) plus user-defined regex -> dry-run rules, shown as a line under the dialog with details in a side pane. Display only: it never changes the permission decision.
Antes de `git push` e de publicação pelo `gh` (no Bash e no PowerShell), confere os commits que vão subir procurando chave, token e senha. Barra o envio se achar. Liberação pontual com `VARREDURA_OK=1`.
