tool-call-guard

Local deterministic pattern bridge for new file content. Not the official Claude Security plugin and not a data-flow scanner.

Appends architecture rules as Claude-only context on every prompt, and drops prompts that explicitly tell Claude to ignore or bypass security rules.

Default-closed eval gate. External Promptfoo runs in CI are the real gate; this mod is defence in depth only.

Short-lived credential gate. Fetches a token from a configured broker only; it never invents a token and never falls back to a long-lived credential.

Redacts secret patterns from prompts, shell commands and shell output, blocks writes that contain secrets, and denies reads and mentions of secret files.

Per-session token tally. Records usage totals in the store and prints the turn total; it is not a token stream or a server-side audit chain.

Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses

200 skills · 98 commands · 71 agents · 1 MCP server · hooks

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

hooks

Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails

3 skills · 1 command · 1 agent

Install the "AAS Secure App Builder" editorial skill bundle for Claude Code.

12 skills

Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture

24 skills · 2 agents

SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening

5 skills · 3 commands · 2 agents