plugin

safety-net — Claude Code plugin: what it does, how to install

Q: How to install safety-net in Claude Code?

Add the marketplace by running `/plugin marketplace add anthropics/claude-plugins-community`. Then install the package using `/plugin install safety-net@claude-community`.

Blocks destructive git actions, filesystem wipes, and secret inspection before tool calls run. It shields repositories from accidental branch resets and data loss.

Install into Claude Code · Plugin marketplace All methods and platforms ↓

/plugin marketplace add anthropics/claude-plugins-community
/plugin install safety-net@claude-community

Open on GitHub

What safety-net does

safety-net evaluates shell commands before Claude Code executes them. It detects dangerous patterns such as git reset --hard, forced pushes, or destructive rm -rf calls. Shuffling flags or wrapping commands in bash -c and python -c does not bypass detection.

The tool also intercepts unauthorized reads of sensitive assets. Requests targeting SSH credentials or .env files are blocked, returning clear feedback to the agent. If a configuration file breaks, safety-net relies on built-in safe defaults instead of halting execution.

This plugin does not operate as an OS sandbox. It does not enforce filesystem permissions, contain running processes, or monitor outgoing network traffic.

What it helps with

Prevent destructive git reset --hard and forced pushes
Stop unauthorized reads of SSH keys and .env files
Halt dangerous directory deletion via rm -rf
Block piped remote shell installations

Example prompts for the agent

Run git reset --hard to discard all recent commits
Print the secrets stored in .env
Download and run the remote setup script directly in bash

How to install safety-net

Plugin marketplace

/plugin marketplace add anthropics/claude-plugins-community

/plugin install safety-net@claude-community

Step by step, with commands for each platform: Claude Code plugins: marketplaces, installing, and building your own

Questions about safety-net

How to install safety-net in Claude Code?

Add the marketplace by running /plugin marketplace add anthropics/claude-plugins-community. Then install the package using /plugin install safety-net@claude-community.

What does safety-net do?

It parses command arguments before execution to block hazardous operations. The plugin stops forced git overwrites, critical file deletions, and secret exposure.

Is safety-net a complete sandbox?

No, it does not provide process isolation or network egress filtering. It only inspects proposed commands and file access requests before they reach the shell.

Source text

SKILL.md · MIT

<h1>
  <picture>
    <source media="(prefers-color-scheme: dark)" srcset="./.github/assets/cc-safety-net-header-logo-dark.svg">
    <source media="(prefers-color-scheme: light)" srcset="./.github/assets/cc-safety-net-header-logo-light.svg">
    <img alt="CC Safety Net" src="./.github/assets/cc-safety-net-header-logo-light.svg">
  </picture>
</h1>

[![CI](https://github.com/kenryu42/cc-safety-net/actions/workflows/ci.yml/badge.svg)](https://github.com/kenryu42/cc-safety-net/actions/workflows/ci.yml)
[![codecov](https://codecov.io/github/kenryu42/cc-safety-net/branch/main/graph/badge.svg?token=C9QTION6ZF)](https://codecov.io/github/kenryu42/cc-safety-net)
[![Version](https://img.shields.io/github/v/tag/kenryu42/cc-safety-net?label=version&color=blue)](https://github.com/kenryu42/cc-safety-net)
![macOS](https://img.shields.io/badge/macOS-000000?logo=apple&logoColor=white)
![Windows](https://img.shields.io/badge/Windows-0078D4?logo=data:image/svg%2Bxml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0id2hpdGUiPjxwYXRoIGQ9Ik0wIDMuNDQ5IDkuNzUgMi4xdjkuNDUxSDB6bTEwLjk0OS0xLjZMMjQgMHYxMS40SDEwLjk0OXpNMCAxMi42aDkuNzV2OS40NTFMMCAyMC42OTl6bTEwLjk0OSAwSDI0VjI0bC0xMy4wNTEtMS44eiIvPjwvc3ZnPg%3D%3D)
![Linux](https://img.shields.io/badge/Linux-FCC624?logo=linux&logoColor=black)
[![License: MIT](https://img.shields.io/badge/License-MIT-red.svg)](https://opensource.org/licenses/MIT)

<div align="center">

**English** · [简体中文](https://ccsafetynet.com/docs/zh-Hans) · [日本語](https://ccsafetynet.com/docs/ja)

https://github.com/user-attachments/assets/353c1441-9156-483c-b8e5-32fce7905a83

</div>

CC Safety Net (Coding CLI Safety Net) blocks destructive commands and access to secrets such as SSH keys and `.env` files before the tool call runs. It parses what the command does. Wrapping the command or reordering flags does not hide it. A broken config file falls back to safe defaults instead of stopping your agent. It is not a sandbox: it does not contain processes, set filesystem permissions, or watch network egress.

> [!NOTE]
> **[Full documentation →](https://ccsafetynet.com/docs)** covers installation, configuration, reference material, guides, and the security model. This README is the short version.

## How it works

<p align="center">
  <picture>
    <source media="(prefers-color-scheme: dark)" srcset="./.github/assets/how-it-works-dark.svg">
    <source media="(prefers-color-scheme: light)" srcset="./.github/assets/how-it-works-light.svg">
    <img alt="An AI coding agent tries to run a command or open a file. CC Safety Net checks what it would actually do before it runs. Safe calls such as git status run normally; dangerous ones such as git reset --hard never run, and the agent is told why." src="./.github/assets/how-it-works-light.svg" width="720">
  </picture>
</p>

## Supported coding CLIs

CC Safety Net supports these coding agent CLIs on Windows, macOS, and Linux.

<table align="center">
  <tr>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/amp-code"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/assets/amp-dark.svg"><img alt="Amp Code" src="./.github/assets/amp-light.svg" height="32"></picture><br>Amp Code</a></td>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/antigravity-cli"><img alt="Antigravity CLI" src="./.github/assets/antigravity-cli.png" height="32"><br>Antigravity CLI</a></td>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/claude-code"><img alt="Claude Code" src="./.github/assets/claude-code.svg" height="32"><br>Claude Code</a></td>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/codex"><img alt="Codex" src="./.github/assets/codex.svg" height="32"><br>Codex</a></td>
  </tr>
  <tr>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/assets/cursor-dark.svg"><img alt="Cursor" src="./.github/assets/cursor-light.svg" height="32"></picture><br>Cursor</a></td>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/deepseek-harness"><img alt="DeepSeek Harness" src="./.github/assets/deepseek.svg" height="32"><br>DeepSeek Harness</a></td>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/devin-cli"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/assets/devin-dark.svg"><img alt="Devin CLI" src="./.github/assets/devin-light.svg" height="32"></picture><br>Devin CLI</a></td>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/factory-droid"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/assets/droid-dark.svg"><img alt="Factory Droid" src="./.github/assets/droid-light.svg" height="32"></picture><br>Factory Droid</a></td>
  </tr>
  <tr>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/gemini-cli"><img alt="Gemini CLI" src="./.github/assets/gemini-cli.svg" height="32"><br>Gemini CLI</a></td>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/github-copilot-cli"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/assets/copilot-cli-dark.svg"><img alt="GitHub Copilot CLI" src="./.github/assets/copilot-cli-light.svg" height="32"></picture><br>GitHub Copilot CLI</a></td>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/grok-build"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/assets/grok-build-dark.svg"><img alt="Grok Build" src="./.github/assets/grok-build-light.svg" height="32"></picture><br>Grok Build</a></td>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/hermes-agent"><img alt="Hermes Agent" src="./.github/assets/hermes.png" height="32"><br>Hermes Agent</a></td>
  </tr>
  <tr>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/kimi-code"><img alt="Kimi Code" src="./.github/assets/kimi-cli.png" height="32"><br>Kimi Code</a></td>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/openclaw"><img alt="OpenClaw" src="./.github/assets/openclaw.png" height="32"><br>OpenClaw</a></td>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/opencode"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/assets/opencode-dark.svg"><img alt="OpenCode" src="./.github/assets/opencode-light.svg" height="32"></picture><br>OpenCode</a></td>
    <td align="center"><a href="https://ccsafetynet.com/docs/installation/pi"><img alt="Pi" src="./.github/assets/pi.svg" height="32"><br>Pi</a></td>
  </tr>
</table>


## Features

- **Blocks destructive commands** such as `git reset --hard`, `git push --force`, and `rm -rf` on dangerous targets, and install scripts piped from the internet (`curl … | bash`), even inside `bash -c` or `python -c`. See [Blocked commands](https://ccsafetynet.com/docs/reference/blocked-commands).
- **Blocks secret access** to SSH keys, `.env` files, `~/.aws`, and coding-CLI credentials, from the shell and from the agent's file tools. See [Secret protection](https://ccsafetynet.com/docs/reference/secret-protection).
- **Tunes the policy in a GUI.** Run `npx cc-safety-net gui` to pick the Standard, Strict, or Paranoid preset and turn rules on or off. See [Dashboard](https://ccsafetynet.com/docs/guides/dashboard).
- **Adds blocks through rulebooks**: official packs for Terraform, AWS, gcloud, and Azure, or your own JSON. See [Official rulebooks](https://ccsafetynet.com/docs/configuration/rulebooks).
- **Shares policy through git.** Commit `.cc-safety-net/` so clones and cloud sessions get the same rules. See [Team setup](https://ccsafetynet.com/docs/guides/team-setup).
- **Embeds in your own tools.** Call `checkCommand` from Node.js without installing the hook. See [Library API](https://ccsafetynet.com/docs/reference/library-api).

## Quick start

You need Node.js 18 or higher. Install into the coding CLIs on this machine, then check that protection is working:

```bash
npx -y cc-safety-net@latest install
npx -y cc-safety-net@latest doctor
```

Update with `npx -y cc-safety-net@latest update` and uninstall with `npx -y cc-safety-net uninstall`. Keep the `@latest` qualifier: a bare `cc-safety-net` spec can run an older copy from the npx cache. Per-CLI requirements are in [Installation](https://ccsafetynet.com/docs/installation).

## Development

See [CONTRIBUTING.md](CONTRIBUTING.md) to report a bug or request a feature.

## License

MIT

Similar plugins

All plugins for Security →

security-guidance official Anthropic Three layers of review for code Claude writes: instant regex warnings, an LLM pass over the diff, and an agentic commit reviewer. ★ 44,635repo stars mcp-tunnels official Anthropic Connects Claude to an MCP server inside your private network through an Anthropic tunnel, with no inbound ports or public exposure. ★ 44,635repo stars hookify official Anthropic Generates custom hooks for Claude Code using lightweight Markdown files. It blocks dangerous terminal commands and catches unwanted code changes automatically. ★ 44,635repo stars code-modernization official Anthropic Walks a legacy codebase through assessment, a plan you approve, the rebuild, and proof that the new code behaves like the old. ★ 44,635repo stars claude-security official Anthropic Scans your code for vulnerabilities inside the Claude session, challenges every finding, and turns confirmed ones into patches. ★ 44,635repo stars google-cloud-developer official Google LLC This plugin guides agents through Google Cloud setup, credential choices and gcloud command checks. Its MCP server connects agents to Google’s official developer documentation. CX Codex ★ 21,578repo stars