Out-of-band Claude Code Stop / SubagentStop hook judges that block 30 LLM dark patterns at the closeout boundary: false-success without evidence, sycophancy, paternalism, permission-loops, vibe time estimates, fake recall, fake stats, fake citations, count-vs-enumeration self-consistency drift, context loss after compaction, multi-agent rollup failures, power-user polish failures, and unreachable new symbols (advisory). Deterministic verdicts, no network calls, no model in the verdict path, Apache-2.0, paper-grade claim ledger.
Comprehensive application security toolbox for Claude Code. 62 skills across 8 frameworks (OWASP Top 10, OWASP API Top 10, STRIDE, PASTA, LINDDUN, MITRE ATT&CK, SANS/CWE Top 25, DREAD), red team simulation with 6 attacker personas plus consolidator, and interactive security education.
Consensus-based security review for RHOAI strategy documents (STRATs). An orchestrator spawns three independent reviewers to identify security risks, then synthesizes findings with confidence tagging based on cross-reviewer agreement. Covers 39 catalog patterns across auth, data protection, cryptographic compliance, network security, supply chain, and infrastructure.
Scan a software repository for ISO 27001:2022 compliance of its software development controls (Annex A 8.4, 8.25–8.33). Produces a per-control compliance gap report covering source code access, secure SDLC, application security requirements, secure architecture, secure coding, security testing, outsourced development, environment separation, change management, and test data.
Configure, run, and interpret HawkScan DAST results inside Claude Code. Generates stackhawk.yml configs, runs scans via CLI or Docker, and transforms security findings into prioritized fix tasks for your coding agent.
Configure HawkScan in your CI/CD pipeline. Provider-agnostic: detects GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure Pipelines, Bitbucket, Buildkite, and other CI systems from repo files, edits the pipeline file in place, and prompts for HAWK_API_KEY storage (CI-native secrets store or external secrets manager).
Claude-native, governed offensive-OSINT and external attack-surface platform for authorized security teams: multi-agent recon across web/API, identity, cloud, secrets, and people/breach intelligence, with deterministic scope, evidence, and approval controls, a governed agent-to-agent orchestrator, and human-reviewed findings for hand-off to validation and pen-testing. It is not an exploitation framework and does not perform intrusive testing.
Use when system trust boundaries, threat models, control verification, AI/tool privileges, supply-chain assurance, classified information flows, or authorization evidence need design or review.
Runtime tool-call governance for Claude Code. Layer-1 deny rules on every tool the hook sees (shell, file mutation, reads of credential material, subagent spawn, scheduling, remote triggers, cross-session messages, harness config writes). Layer-2 conformal risk classifier on mcp__* tools. Hash-chained SQLite audit trail at ~/.vaara/trail/audit.db.
Real-time policy enforcement and tamper-evident audit for tool calls (MCP and built-in) in a Claude Code session. Forwards every tool call to a local SecureVector app for cloud-managed deny rules and persistent audit logging. Fails open if the local app is unreachable.
Let Claude Code use your API keys, SSH keys and database passwords without ever seeing them. Bundles the mcp-warden MCP server config, a skill that teaches Claude to call it, and a guided /mcp-warden:setup.