537 security Claude Code mods, most popular first. Every listing shows its security level and install command.
| Name | Popularity | Security |
|---|---|---|
| voice Voice front desk for Claude Code on Windows (macOS experimental): an OpenAI realtime voice (through codex app- | – | Low risk |
| phi-guard-tw 在模型讀到之前遮罩台灣身分證／居留證號與有標籤的病歷號、健保卡號；擋下會把遮罩值寫回來源的工具呼叫 | – | Low risk |
| all-mods All 4 workflow mods in one install: status-strip, next-steps, ship-it, usage-guard. | – | High risk |
| usage-guard Keeps rate-limit usage in the status line, warns before agent fan-out near a limit, and blocks it at the edge. | – | Low risk |
| subagent-audit Transparency for native subagents: audit records, git-based file attribution, scope checks, chat receipts and | – | Review before installing |
| guardrails Stops risky shell commands before they run: killing ports owned by Docker containers, printing secrets from th | – | Review before installing |
| seatbelt Blocks destructive shell commands and edits to secrets before they run | – | Low risk |
| agent-skills-mods Readable agent-skills workflow in Claude Code: spec pane, task board with run timeline and ETA range, current- | – | High risk |
| protocol-guard Required workflow checks with Claude Code function hooks. Refuses a knowledge-file write, or a memory-service | – | Review before installing |
| mode-gate A Claude Code mod with switchable permission profiles: a safe baseline and named profiles you switch on and of | – | Low risk |
| secret-mask Masks secrets (API keys, tokens, passwords, .env values) in tool output and prompts before Claude reads them | – | Review before installing |
| dbx-trace Flight recorder for Databricks: every query, script and guardrail block Claude makes, in a band above the prom | – | High risk |
| data-guard Masque secrets, emails et IP dans les logs, env et git log, et demande confirmation avant de lire un fichier s | – | Low risk |
| destructive-guard Confirmation avec impact mesuré avant toute commande Bash destructive | – | Low risk |
| pkg-guard Hold npm, pnpm, yarn, pip, uv, and cargo installs of packages that don't exist, are brand new, or are barely d | – | Low risk |
| tripwire Stop secrets leaving the machine. Holds an edit or command that writes an API key, a private key, or a credent | – | Low risk |
| watchtower One line above the prompt showing what your guard mods are doing: the fence, pins, the breaker threshold, the | – | Low risk |
| cold-cache-guard Asks what to do before Claude Code re-sends a large conversation whose prompt cache has expired: on a cold res | – | Low risk |
| cache-guard When a send would re-write a cold prompt cache, a dialog shows the estimated cost with Proceed and Start new s | – | Low risk |
| gcp-reauth Flags expired Google Cloud credentials (invalid_rapt) with the login command to run | – | Low risk |
| hajib Hajib: a doorman that stops dangerous commands and asks for approval in Moroccan Darija | – | Low risk |
| code-modernization Guided modernization for any legacy codebase: start with /modernize, get an assessment, an interactive map, th | – | Review before installing |
| mask-that-pass Masks credentials in tool output (URL passwords, *_TOKEN / *_SECRET / *_PASSWORD values, API keys, bearer toke | – | Low risk |
| desk-meter Context usage, branch and tool count in a band; tokens per request charted in a pane; a note tool for Claude a | – | Review before installing |
| multichat Run several Claude Code chats side by side safely: where the week's usage lands at this pace, a question befor | – | Low risk |
| agent-cross-check When another coding agent (or a person) commits to your repo, Claude notices, runs mechanical checks (line end | – | Low risk |
| shared-repo-guard For repos where several AI agents (or you and an agent) work in the same folder: stops secret values from leav | – | Low risk |
| pm-guard Steers npm/npx/yarn to the package manager the repo's lockfile names (bun or pnpm), bun where there is none | – | Low risk |
| remote-guard Asks before a destructive command runs on another machine over ssh (restarts, deletes, kills, reboots) | – | Low risk |
| blast-radius Holds destructive Bash calls (rm -rf, git reset --hard, git clean, force push, migrations) and shows the files | – | Review before installing |
| secret-guard Bloqueia prompts e saídas de ferramentas que contenham chaves/segredos antes de chegarem ao modelo | – | Low risk |
| integrity Tells implemented apart from verified: a requirement contract from your own words, a Mirage Detector for fake | – | Review before installing |
| identity-guard Stops commits and pushes under the wrong git identity (the work email) before they reach GitHub, and says exac | – | Low risk |
| query-guard Asks before Claude runs destructive or slow-looking SQL through a DB CLI: DELETE, UPDATE without WHERE, DROP, | – | Low risk |
| review-cycle Automated multi-agent code review cycle that spawns reviewers in parallel (plus Codex when available), applies | – | Review before installing |
| tripwire Catches recurring agent failures from past transcripts: whole-disk find, foreground poll loops, errors masked | – | Low risk |
| tessera One mod for Claude Code, Windows and CJK first: pasted-image and text previews in any terminal, themed replies | – | High risk |
| sandbox-guard Denies Edit/Write/Bash writes to Claude config paths the sandbox cannot write (settings, skills, plugins, hook | – | Low risk |
| secret-redactor Masks API keys, tokens, private keys and password assignments in tool results before the model sees them. | – | Low risk |
| verification-guard Checks Claude's claims (tests pass, verified, fixed, no regression, API returns N) against the tool calls that | – | Low risk |
| burn-guard Guards the 5h usage window: caps expensive-tier spawns per turn, keeps Fable spawns manual-only, draws a colou | – | Review before installing |
| outward-gate Confirm dialog before outward-facing sends and out-of-vault deletes; off switch for unattended runs; always-on | – | Review before installing |
| harness Skills and guard hooks: ai-code-cleanup, interrogate, shape-task, verify-change, setup, a shared-worktree git | – | High risk |
| zsemle Zsemle, a pixel-art companion above the prompt (golden retriever, cat, slime, paperclip): watches every usage | – | Review before installing |
| collision-guard Предупреждает, если файл недавно менял другой чат Claude Code | – | Low risk |
| tokens-sesion Banda sobre el prompt con el contexto (cifra y barra de verde a rojo), el gasto de la sesión, el uso de CPU y | – | Review before installing |
| entregas Guarda todo arquivo que a IA cria ou edita, em qualquer conversa: /entregas lista com link, e um "cadê" já che | – | High risk |
| anchor Pin a session to its git worktree: every Bash call runs from the anchor, and the primary checkout is guarded a | – | Low risk |
| dock Container stacks per worktree: a pixel-art pane of every compose stack with its memory and worktree, orphans w | – | Low risk |
| tripwire Rules that are enforced, not remembered: deny, ask, rewrite or note on any tool call, subagents included. A pi | – | Review before installing |
| safety-guard Blocks destructive shell commands and access to secret files (.env, SSH keys, cloud credentials). | – | Low risk |
| secret-scrub Catches API keys, tokens and private keys in the prompt you are about to send, and masks or blocks them before | – | Low risk |
| worktree-hints In a worktree session, tells Claude up front which commands the worktree guard refuses (heredoc and inline-scr | – | Low risk |
| modwall A firewall for other mods: shows what each mod can reach as it loads, and audits, holds or refuses it by your | – | Low risk |
| spend-guard Spend Guard: live session cost band, a warning toast, and a hard stop that holds your next prompt once the ses | – | Low risk |
| kb-settings-guard Denies a delegated agent lane any write to this repo's Claude settings files. | – | Low risk |
| model-registry Report model drift and deny only positively invalid stale-pin launches. | – | Low risk |
| model-guard Choose the model versions Claude and its subagents may use: /models lists the newest of each family from Anthr | – | Low risk |
| cmd-guard Blocks destructive shell commands (rm -rf /, force push, DROP TABLE...) | – | Low risk |
| context-meter Band above the prompt: context fill, prompt-cache countdown, usage limits, and a guard for resuming cold sessi | – | Low risk |
| blast-radius Hält gefährliche Bash-Befehle an (rm -rf, git reset --hard, git clean, force-push …), zeigt was sie anrichten | – | Low risk |
| omnirealm OmniRealm, a god-simulator sandbox in a side panel: terraform a procedural world, seed races and beasts, watch | – | Low risk |
| blast-guard DURING the turn: refuses destructive shell commands, tidies the rest, and pins Explore subagents to Haiku | – | Low risk |
| cm-block-dangerous-commands Refuses destructive Bash commands (rm -rf /, force-push to main, DROP TABLE, curl | sh, ...) before Claude run | – | Low risk |
| bash-guardrails Tool-call guard rules (parser-based), written in CEL; add your own in ~/.claude/bash-guardrails.json or .claud | – | Low risk |
| context-guard-bot A permanent, slim context-usage bar above the prompt with a chomping Pac-Man; green under 20%, amber 20-30%, r | – | Low risk |
| tether Holds a project together across Claude Code sessions: an agents pane, watchers that wake the model only for ne | – | High risk |
| secret-shield Keeps secrets out of the transcript and out of the repo: redacts API keys, tokens, private keys and password U | – | Low risk |
| tripwire Holds destructive commands until you say so: rm -rf, force pushes, git reset --hard, DROP TABLE, curl | sh, su | – | Low risk |
| secret-guard Stops Claude from reading or editing .env files, private keys and credential files, including through symlinks | – | Low risk |
| vault-scribe An all-in-one notes manager for an Obsidian second brain: writes the daily note itself (changes and why, decis | – | High risk |
| agent-deck Agent dashboard (derived from Flightdeck by Stephen Casella, MIT) plus routing of simple subagent tasks to che | – | Low risk |
| guardrails-approval A human signs off before anything that can't be undone: publishing, killing protected processes, editing secre | – | High risk |
| guardrails-challenge Effective challenge: hold answers to evidence under pushback, and check agents' commit claims against git. | – | High risk |
| guardrails-development Development standards: look before building, test what changed, pass the repo's checks, keep the rules in view | – | High risk |
| guardrails-monitoring Ongoing monitoring: keep watching the agent after approval, and watch the controls themselves. | – | High risk |
| guardrails-outcomes Outcomes analysis: check what a reply claims against what the evidence supports. | – | Review before installing |
| guardrails-records Documentation: leave a trail a reviewer can follow, and keep what can't be rebuilt. | – | High risk |
| doctrine An execution posture for substantial agent work: parallel agents in phases and waves, adversarial red-teaming, | – | Low risk |
| ad-ldap Active Directory administration over LDAPS for Claude Code: an MCP server (FastMCP + ldap3) with 15 tools, adm | – | Low risk |
| publish-guard Stops Claude from typing private terms into the browser or writing them into your publishing files, and keeps | – | Low risk |
| record-mode While you record your screen, /record on masks emails, phone numbers, money and your own private terms in the | – | Low risk |
| memory-guards Refuses the footgun commands Claude's memory notes warn about, with the reason and the safe alternative | – | Low risk |
| secret-mask コマンドの結果や読んだファイルに混じったAPIキー・パスワードを、Claudeが読む前に伏せる | – | Low risk |
| switchboard Switchboard: useful extras for Claude Code, each one a switch. A usage meter above the prompt, an output viewe | – | High risk |
| security-scan 変更中のファイルを Semgrep で検査し、検出結果を画面の右で1件ずつ選別、本物だけ Claude に修正を依頼 | – | Low risk |
| block-creds Redacts or blocks credentials (detected by betterleaks) before they are sent to the LLM | – | Review before installing |
| jev-vault-gate Uses Jev to spot durable knowledge in a turn and auto-capture it into ~/vault/raw/ for /compile. | – | High risk |
| dev-guard Blocks catastrophic commands, asks before risky ones, and stops secrets from being written into files | – | Review before installing |
| guard Blocks risky shell commands (phone deletes, printing secrets, self-killing pkill) and strips secrets pasted in | – | Low risk |
| guard Blocks destructive shell commands and access to secret files before they run, anywhere in a compound command | – | Low risk |
| redact Keeps secrets that tools print (keys, tokens, passwords, private keys) out of what the model reads and the nex | – | Low risk |
| deckhand Deckhand — the multi-AI toolbar for Claude Code. A band above the prompt with usage gauges, one-click model bu | – | High risk |
| guardrails Blocks the Bash commands your own rules file names, and shows every block in /blocked. Ships no rules. | – | Review before installing |
| secret-guard Blocks reads of .env files and printing of API keys, with a red warning above the prompt. | – | Low risk |
| dot-guard Block `git add` of a whole $HOME work-tree (dot add -A/./*), which would stage your entire home directory. | – | Low risk |
| home-path-guard Flag hardcoded user home paths (/home/, /Users/) you write into files; nudge $HOME / ~ instead. Machine-local | – | Low risk |
| ghost-proc-guard Stops Claude from starting a second copy of your dev servers on the next free port (monorepos and worktrees in | – | Low risk |
| worktree-guard Guards a shared worktree: stops `git add -A` from staging files this session did not touch, previews destructi | – | Low risk |
| claw-guard Claw mod: asks for your OK before any connector action that sends, deletes, pays, publishes or shares (fails c | – | Review before installing |