aport-guardrails — Claude Code plugin: what it does, how to install
This plugin checks Claude Code tool calls against an OAP policy before execution. It is useful for stopping commands and file actions that break the rules.
/plugin marketplace add anthropics/claude-plugins-community
/plugin install aport-guardrails@claude-communityWhat aport-guardrails does
aport-guardrails places a PreToolUse hook in front of Claude Code tool execution. Each action is checked against an Open Agent Passport policy, so unauthorized commands, risky file operations, and other policy violations can be blocked before they run. Evaluation is local by default, with no network calls, and works offline.
Setup writes the Claude Code hook and its configuration. You can use a hosted passport or a local JSON passport; the hosted path creates a passport and a narrow setup key, then sends decisions to APort. The local path keeps evaluation offline. When creating a local passport for Claude Code, set Spawn sub-agents and tasks? to Y, or Agent and Task calls will be denied.
What it helps with
- block commands outside the agent policy
- stop risky file operations before execution
- check tool calls before they run
- record allow and deny decisions
- configure a local passport for offline checks
Example prompts for the agent
- Check this action against the policy before running it, and block it if the policy rejects it.
- Create the configuration file, then run the command only after the hook approves the action.
- Run the Claude Code task and deny Agent or Task calls that the policy does not permit.
How to install aport-guardrails
Plugin marketplace
/plugin marketplace add anthropics/claude-plugins-community/plugin install aport-guardrails@claude-communityStep by step, with commands for each platform: Claude Code plugins: marketplaces, installing, and building your own
Questions about aport-guardrails
How do I install aport-guardrails in Claude Code?
Add the marketplace with /plugin marketplace add anthropics/claude-plugins-community, then install the plugin with /plugin install aport-guardrails@claude-community.
What does aport-guardrails do?
It intercepts Claude Code tool calls through a PreToolUse hook and checks them against an Open Agent Passport policy before execution.
Can aport-guardrails run offline?
Yes. Evaluation runs locally by default; choosing a local JSON passport keeps the checks offline, while a hosted passport sends decisions to APort.
