What is gcloud-guard?
gcloud-guard is a Claude Code mod by davidho27941 that holds gcloud and gsutil commands that would create, change or delete cloud resources, shows the account, project, location and the current state of the targets, and asks you to Proceed or. It is listed under Security and has no public popularity data yet.
| Type | Claude code mod |
|---|---|
| Author | davidho27941 |
| Repository | davidho27941/cockpit |
| Popularity | no public popularity data yet |
| Category | Security |
| Security | Review before installing (76/100) |
| Rank | #3,001 of 5,272 Claude Code mods; #344 in Security |
| License | MIT |
| Last commit | 2026-10-12 |
| Hooks | 4 events |
| Sees | Bash calls |
| Draws on | Pane, AbovePrompt |
Is gcloud-guard safe to install?
gcloud-guard scores 76/100 on the MCPMods security check: Review before installing. Things to review: starts processes outside the sandbox; reads environment variables. It passed 6 of 8 checks.
Mod footprints come from claude plugin validate, which lists every event a mod hooks and every API call it makes without running it.
| Check | Result |
|---|---|
| No network access | Pass |
| Starts processes outside the sandbox | Review |
| Writes no files or config | Pass |
| Reads environment variables | Review |
| Only sees the events it hooks | Pass |
| Doesn't drive Claude | Pass |
| Passes claude plugin validate | Pass |
| Has an open-source license | Pass |
API calls in its code
| Call | What it means |
|---|---|
$.clock.every | |
$.clock.now | |
$.command.register | |
$.env.get | reads env vars |
$.fs.read | reads files |
$.fs.stat | reads files |
$.process.run | runs processes |
$.state.get | |
$.state.set | |
$.ui.close | draws interface |
$.ui.invalidate | draws interface |
$.ui.open | draws interface |
$.ui.resolve | draws interface |
$.ui.toast | draws interface |
How do I install gcloud-guard?
- Check your Claude Code version. Mods need Claude Code 2.1.287 or later and are on by default.
claude --version
- Read its footprint. This lists every event it hooks and every API call it makes, without running it.
git clone https://github.com/davidho27941/cockpit claude plugin validate ./cockpit/plugins/gcloud-guard
- Install it. Run this in your terminal, then /reload-plugins in an open session.
claude plugin marketplace add davidho27941/cockpit && claude plugin install gcloud-guard@cockpit
Or ask Claude to set it up
Paste this into Claude Code and it installs gcloud-guard for you:
Install the "gcloud-guard" Claude Code mod from https://github.com/davidho27941/cockpit/tree/master/plugins/gcloud-guard. Run claude plugin validate on it first and show me what it can access before you enable it.
More from davidho27941/cockpit
This repository has 6 Claude Code mods on MCPMods.
- auto-handover: When context usage reaches your threshold, writes a handover note over the cached conversation prefix, compacts automati (Review before installing)
- blast-radius: Holds risky shell commands (rm -rf, git reset --hard, git clean, force push, migrations) and shows what they would chang (Review before installing)
- cache-keeper: Keeps the prompt cache warm while a session idles: every 50 minutes (configurable) one tiny request over the conversatio (Low risk)
- opsx-board: OpenSpec board: which phase you are in (propose/apply/archive), which tasks.md task is current, and every sub agent's na (Review before installing)
- secret-guard: Keeps API keys, cloud credentials and other secrets out of what is sent to the model: every text that enters the convers (Review before installing)