claude-mod-guardrails
Spec reference
Report 03, section 2.1
Security Guardrails and Secret Scrubber
Would block destructive shell patterns and redact token-like strings from command arguments before a command or tool call runs.
The spec says it would block destructive shell patterns such as recursive deletes and pipe-to-shell installs, and redact strings that look like cloud, Git host or chat tokens from command arguments.
No public repository was found: the URL the spec report gives for it returned HTTP 404 on 2026-09-20. This is a proposal, not something you can install.
The event names are copied from the spec and may not match the names the real engine uses. The report says it passed Tier A validation, but no scanning pipeline exists.
Proposed events, as the spec writes them
- command:pre_exec
- tool:pre_call