dfm

Refuses a shell, file, web fetch or MCP call that holds the signed-in account's email address beside a word that declares who is calling, so the address does not go out as a client's identity.

Security review, dependency scanning, policy gates, and CVE monitoring

2 skills · 1 command · 1 agent

MCP server for terminal commands, process management, and file operations across text, code, PDF, DOCX, Excel, images, and structured data.

6 skills · 1 MCP server

Production-grade Bash scripting with defensive programming, POSIX compliance, and comprehensive testing

3 skills · 2 agents

MCP server for terminal commands, process management, and file operations across text, code, PDF, DOCX, Excel, images, and structured data.

6 skills · 1 MCP server

Roll Claude Code out to a team with guardrails you can check. Four deterministic stdlib scripts: a settings linter that reads shared, local, user and managed settings together (array merge, deny-ask-allow order) and blocks blanket shell allows, pre-approved destructive commands and committed credentials; an MCP and plugin inventory that blocks anything missing from your approved list or holding a literal secret, and flags unpinned or plain-http servers; a CLAUDE.md layering audit that resolves every layer and @import and flags broken imports, contradictions, secrets and resident size; and a privacy-safe adoption tracker that turns local session files into counts only and classifies the rollout as PILOT, SPREADING, EMBEDDED or STALLED. Ships cs-claude-code-rollout agent, /cs-claude-rollout and /cs-claude-settings-lint commands, 3 references, a baseline managed-settings policy and a four-phase rollout plan.

1 skill · 2 commands · 1 agent