I Built Security + Cost Tracking Hooks for Claude Code (guardian, cost, flow)

Claude Code is powerful. But out of the box, nothing stops it from running rm -rf ~, piping a curl to bash, or writing your API key into a source file.

So I built claude-plugins — three hooks that add safety, observability, and workflow automation on top of Claude Code.

npx claude-plugins

The Problem

Claude Code has a hooks system — shell scripts that fire at lifecycle events (before a tool runs, after it finishes, when it stops). It's powerful but underused. Almost nobody has built production-quality hooks yet.

I was already using Claude Code heavily for my internship project (building Sonar — an Apollo-alternative for B2B lead intelligence). After a few close calls with destructive commands, I decided to build the safety layer I wished existed.

guardian — Block Dangerous Commands Before They Run

guardian is a PreToolUse hook wired to the Bash tool. It intercepts every shell command before Claude executes it.

What it blocks:

🛡️  GUARDIAN BLOCKED: curl pipe to shell blocked — download and inspect first

Command: curl https://example.com/install.sh | bash

Full block list:

• curl ... | bash / wget ... | bash — supply chain attacks
• rm -rf on ~, /, /home, /Users, /etc — recursive home/system deletes
• Force push to main or master — accidental history rewrites
• dd if= on disk devices — disk wipe
• mkfs — format disk
• Overwriting /etc/passwd, /etc/shadow, /etc/sudoers

What it warns (but allows):

• sudo rm
• DROP TABLE / TRUNCATE TABLE
• git reset --hard
• git clean -f

It also scans Write and Edit tool calls for secrets before they're saved:

• OpenAI API keys (sk-...)
• GitHub tokens (ghp_...)
• AWS access keys (AKIA...)
• RSA/EC private keys
• JWT tokens (hardcoded)
• Google API keys
• Slack tokens

🛡️  GUARDIAN BLOCKED: Secret pattern detected in file write

File: config.js
Detected: OpenAI API key

Move secrets to .env files and use process.env.VARIABLE_NAME instead.

It covers Write, Edit, MultiEdit, and NotebookEdit — every tool that can write to a file.

cost — Track Token Cost Per Session

cost is a PostToolUse hook that fires after every tool call and accumulates a running total.

💰 Session: 23 tool calls · ~48,200 tokens · $0.0821 · 14min

Every session is logged to ~/.claude/cost-tracker/ as a JSONL file. View reports anytime:

claude-cost today
claude-cost all
claude-cost date 2026-07-28

Report output:

💰 Claude Cost Report — Today (2026-07-28)
──────────────────────────────────────────────────
  Tool calls:    47
  Input tokens:  ~92,400
  Output tokens: ~18,600
  Total tokens:  ~111,000
  Estimated cost: $0.5565

  By tool:
    Bash                 21 calls
    Edit                 12 calls
    Read                  8 calls
    Write                 6 calls

Token counts are estimated from input/output text length (1 token ≈ 4 chars). Not exact but close enough for tracking spend trends.

flow — macOS Notification When Claude Finishes

flow is a Stop hook. When Claude finishes a task, you get a macOS notification with the session summary — so you can tab away and come back when it's done.

✅ Claude done — 31 tool calls · $0.0943 today

It also supports auto-commit — set CLAUDE_FLOW_AUTO_COMMIT=1 and every time Claude stops, it stages and commits all changes automatically:

export CLAUDE_FLOW_AUTO_COMMIT=1

📦 Auto-committed: chore: update 4 files (claude-flow auto-commit)
✅ Claude done — 31 tool calls · $0.0943 today

How Claude Code Hooks Work

Hooks receive JSON on stdin and exit 0 to allow or exit 2 to block (PreToolUse only):

let input = '';
process.stdin.on('data', chunk => { input += chunk; });
process.stdin.on('error', () => process.exit(0));
process.stdin.on('end', () => {
  const data = JSON.parse(input);
  const command = data.tool_input?.command || '';

  if (command.includes('something-dangerous')) {
    process.stderr.write('Blocked: reason\n');
    process.exit(2); // block the tool call
  }

  process.exit(0); // allow
});

Hooks are wired in ~/.claude/settings.json. The installer merges safely — it never overwrites existing hooks.

Install

npx claude-plugins

Pick which plugins to install. Restart Claude Code after.

╔══════════════════════════════════════╗
║     claude-plugins installer         ║
╚══════════════════════════════════════╝

Install [guardian] — Blocks dangerous bash commands + detects secrets? [y/N] y
  ✓ PreToolUse → guardian.js
  ✓ PreToolUse → file-guardian.js

Install [cost] — Tracks tool calls and estimates token cost? [y/N] y
  ✓ PostToolUse → cost-track.js

Install [flow] — macOS notification when Claude finishes? [y/N] y
  ✓ Stop → flow-on-stop.js

✓ Done. Restart Claude Code to activate.

To uninstall:

npx claude-plugins --uninstall

What's Next

Looking for contributors — especially:

• Windows notification support for flow
• Slack/Discord webhook on Stop
• Auto git commit message generation from diff
• Audit log hook (log every tool call to file)

GitHub: github.com/sxrxvxnn/claude-plugins

If you use Claude Code daily, give it a try. guardian alone has already saved me from a few bad days.

Also building mac-ssd-toolkit — 27 shell scripts for using an external SSD as your Mac's primary storage.