Claude Code Security

claude-code-security

Runtime security for Claude Code workspaces. Blocks prompt injection, memory poisoning, secret exposure, and hook tampering — automatically, at every session.

[](https://github.com/hesreallyhim/awesome-claude-code) [](LICENSE) [](https://github.com/mbay7/claude-code-security/releases) [](https://github.com/mbay7/claude-code-security/actions/workflows/audit.yml) [](evals/) [](https://github.com/mbay7/claude-code-security/issues)

---

Install

git clone https://github.com/mbay7/claude-code-security.git && cd claude-code-security && ./install.sh

Reload Claude Code. Done.

> Why git clone instead of curl | bash? You're installing a security tool. Cloning first lets you read the code before it runs on your machine — that's the right default.

Requirements: python3, jq (auto-installed via brew if missing)

---

What It Catches

$ echo '{}' | python3 ~/.claude/hooks/memory-drift-check.py

🚨 Context Poisoning Detected in Memory Files:
  • INJECTION in project_notes.md:14 — "ignore previous instructions and"
  • INJECTION in feedback_auth.md:3 — "you are now a"

Run /security-scanner on any suspicious file.

$ python3 ~/.claude/hooks/security-scan.py >` blocks · role override attempts · when-Claude-reads-this payloads · HTML comment injections

**Secret patterns (8):** Anthropic API keys · OpenAI keys · AWS credentials · GitHub PATs · Stripe live keys · private key blocks · Supabase JWTs

**Malicious code patterns (5):** reverse shells (`nc -e /bin/bash`) · crypto miners (`xmrig`, `stratum+tcp`) · `base64 | bash` pipes · sensitive file reads (`~/.ssh`, `/etc/passwd`)

---

## Evals

Detection claims are backed by 68 automated tests across all threat categories.

```bash
pip install pytest
python -m pytest evals/ -v

| Category | Tests | Coverage | |---|---|---| | Prompt injection | 20 | Direct overrides, role hijacks, structural tags, Unicode steganography | | Secret exposure | 17 | All 8 key types, crypto material, placeholder false-positive validation | | Memory poisoning | 13 | Write guard injection, clean-write false positives, edge cases | | Behavioral anomalies | 18 | Reverse shells, miners, exfil patterns, tool-audit clean/anomaly split |

CI runs evals on every push and PR via [GitHub Actions](.github/workflows/audit.yml).

---

Why Not Just Trust Claude Code's Built-in Protections?

Anthropic's foundation is solid: permission gates, command blocklists, sandboxing (2026), and prompt injection classifiers. Three structural gaps remain:

1. Indirect prompt injection is architectural. The LLM processes system instructions and data in a unified token stream — it cannot cryptographically distinguish a legitimate instruction from an injected one in a file it reads. Sandboxing reduces blast radius but doesn't stop injection.

1. Memory poisoning isn't in Anthropic's threat model yet. memory-drift-check.py + memory-write-guard.py are the only open-source tools scanning Claude memory files for MINJA-class attacks.

1. Approval fatigue is real. Research confirms developers approve Claude Code operations in bulk without reading them. Automated hooks don't rely on human attention.

Anthropic, Microsoft, and Google all publish a Shared Responsibility Model — the vendor secures the model and infrastructure, the operator (you) secures the runtime. This framework covers your side.

---

Threat Coverage

| CVE / Threat | Coverage | |---|---| | CVE-2025-59536 (CVSS 8.7 — RCE via hooks) | hook-integrity.sh SHA256 manifest | | CVE-2025-6514 (CVSS 9.6 — mcp-remote RCE) | mcp-verifier.py + security-scan.py | | MINJA memory poisoning (NeurIPS 2025) | memory-drift-check.py + memory-write-guard.py | | OWASP LLM Top 10:2025 | LLM01–LLM08 |

---

Compared to Alternatives

| Tool | Injection | Memory Poisoning | MCP Integrity | Secrets | Hook Integrity | Write Guard | |---|---|---|---|---|---|---| | claude-code-security | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | lasso-security/claude-hooks | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | | mintmcp/agent-security | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | | mafiaguy/claude-security-guardrails | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |

---

Contributing

New detection patterns are the most valuable contribution. Each pattern must include a source (CVE number, OWASP ID, or research paper link).

1. Injection patterns → INJECTION_PATTERNS in hooks/security-scan.py
2. Secret patterns → SECRET_PATTERNS with format (label, regex, severity)
3. Gitleaks rules → config/.gitleaks.toml
4. Bug reports → open an issue

See [CONTRIBUTING.md](docs/customization.md) for full details.

---

License

MIT — use it, fork it, adapt it for your stack.

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: mbay7
• Source: mbay7/claude-code-security
• License: MIT

Install and usage instructions live in the source repository linked above.