# Claude Code Security

> A 6-layer security framework for Claude Code workspaces: prompt injection detection, memory poisoning prevention, secrets scanning, behavioral audit logging, and pre-commit guardrails. Install in 5 minutes.

- **Type:** MCP server
- **Install:** `agentstack add mcp-mbay7-claude-code-security`
- **Verified:** Pending review
- **Seller:** [mbay7](https://agentstack.voostack.com/s/mbay7)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [mbay7](https://github.com/mbay7)
- **Source:** https://github.com/mbay7/claude-code-security

## Install

```sh
agentstack add mcp-mbay7-claude-code-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# claude-code-security

**Runtime security for Claude Code workspaces.** Blocks prompt injection, memory poisoning, secret exposure, and hook tampering — automatically, at every session.

[](https://github.com/hesreallyhim/awesome-claude-code)
[](LICENSE)
[](https://github.com/mbay7/claude-code-security/releases)
[](https://github.com/mbay7/claude-code-security/actions/workflows/audit.yml)
[](evals/)
[](https://github.com/mbay7/claude-code-security/issues)

---

## Install

```bash
git clone https://github.com/mbay7/claude-code-security.git && cd claude-code-security && ./install.sh
```

Reload Claude Code. Done.

> **Why git clone instead of `curl | bash`?** You're installing a security tool. Cloning first lets you read the code before it runs on your machine — that's the right default.

**Requirements:** `python3`, `jq` (auto-installed via brew if missing)

---

## What It Catches

```
$ echo '{}' | python3 ~/.claude/hooks/memory-drift-check.py

🚨 Context Poisoning Detected in Memory Files:
  • INJECTION in project_notes.md:14 — "ignore previous instructions and"
  • INJECTION in feedback_auth.md:3 — "you are now a"

Run /security-scanner on any suspicious file.
```

```
$ python3 ~/.claude/hooks/security-scan.py >` blocks · role override attempts · when-Claude-reads-this payloads · HTML comment injections

**Secret patterns (8):** Anthropic API keys · OpenAI keys · AWS credentials · GitHub PATs · Stripe live keys · private key blocks · Supabase JWTs

**Malicious code patterns (5):** reverse shells (`nc -e /bin/bash`) · crypto miners (`xmrig`, `stratum+tcp`) · `base64 | bash` pipes · sensitive file reads (`~/.ssh`, `/etc/passwd`)

---

## Evals

Detection claims are backed by 68 automated tests across all threat categories.

```bash
pip install pytest
python -m pytest evals/ -v
```

| Category | Tests | Coverage |
|---|---|---|
| Prompt injection | 20 | Direct overrides, role hijacks, structural tags, Unicode steganography |
| Secret exposure | 17 | All 8 key types, crypto material, placeholder false-positive validation |
| Memory poisoning | 13 | Write guard injection, clean-write false positives, edge cases |
| Behavioral anomalies | 18 | Reverse shells, miners, exfil patterns, tool-audit clean/anomaly split |

CI runs evals on every push and PR via [GitHub Actions](.github/workflows/audit.yml).

---

## Why Not Just Trust Claude Code's Built-in Protections?

Anthropic's foundation is solid: permission gates, command blocklists, sandboxing (2026), and prompt injection classifiers. Three structural gaps remain:

1. **Indirect prompt injection is architectural.** The LLM processes system instructions and data in a unified token stream — it cannot cryptographically distinguish a legitimate instruction from an injected one in a file it reads. Sandboxing reduces blast radius but doesn't stop injection.

2. **Memory poisoning isn't in Anthropic's threat model yet.** `memory-drift-check.py` + `memory-write-guard.py` are the only open-source tools scanning Claude memory files for MINJA-class attacks.

3. **Approval fatigue is real.** Research confirms developers approve Claude Code operations in bulk without reading them. Automated hooks don't rely on human attention.

Anthropic, Microsoft, and Google all publish a Shared Responsibility Model — the vendor secures the model and infrastructure, the operator (you) secures the runtime. This framework covers your side.

---

## Threat Coverage

| CVE / Threat | Coverage |
|---|---|
| CVE-2025-59536 (CVSS 8.7 — RCE via hooks) | `hook-integrity.sh` SHA256 manifest |
| CVE-2025-6514 (CVSS 9.6 — mcp-remote RCE) | `mcp-verifier.py` + `security-scan.py` |
| MINJA memory poisoning (NeurIPS 2025) | `memory-drift-check.py` + `memory-write-guard.py` |
| OWASP LLM Top 10:2025 | LLM01–LLM08 |

---

## Compared to Alternatives

| Tool | Injection | Memory Poisoning | MCP Integrity | Secrets | Hook Integrity | Write Guard |
|---|---|---|---|---|---|---|
| **claude-code-security** | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| lasso-security/claude-hooks | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| mintmcp/agent-security | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ |
| mafiaguy/claude-security-guardrails | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |

---

## Contributing

New detection patterns are the most valuable contribution. Each pattern must include a source (CVE number, OWASP ID, or research paper link).

1. **Injection patterns** → `INJECTION_PATTERNS` in `hooks/security-scan.py`
2. **Secret patterns** → `SECRET_PATTERNS` with format `(label, regex, severity)`
3. **Gitleaks rules** → `config/.gitleaks.toml`
4. **Bug reports** → [open an issue](https://github.com/mbay7/claude-code-security/issues)

See [CONTRIBUTING.md](docs/customization.md) for full details.

---

## License

MIT — use it, fork it, adapt it for your stack.

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [mbay7](https://github.com/mbay7)
- **Source:** [mbay7/claude-code-security](https://github.com/mbay7/claude-code-security)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-mbay7-claude-code-security
- Seller: https://agentstack.voostack.com/s/mbay7
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.