claude-code-haiku-guard
A Claude Code hook that rates Bash command risk with rules and Haiku, asking for approval only on risky commands
Install
Copy hook/haiku_guard.py to ~/.claude/hooks/haiku_guard.py, merge the PreToolUse hook from examples/settings.json into ~/.claude/settings.json, and remove broad Bash(... *) allow rules. I will put my OpenRouter key into ~/.openrouter_key myself.This is third-party code. Review the repository files before installing.
What it does
A PreToolUse hook classifies every Bash command by risk. Low-risk commands pass silently, medium ones go to Haiku via OpenRouter for a yes or no decision, and high or critical ones always show a dialog. Decisions are cached per command and working directory; without a key or on network errors, medium commands fall back to a dialog.
Who it is for. For heavy Claude Code users who are tired of approving harmless commands but do not want --dangerously-skip-permissions.
Good fit when
- You want explicit rule-based command gating with your own config
- You do not use the built-in Claude Code Auto Mode
- You work on Windows with Git Bash
Not a fit when
- Auto Mode is already on: the author says the hook is largely redundant then
- You have no OpenRouter access or do not want commands sent there
Example request
Set up haiku-guard as a PreToolUse hook following SETUP.mdLimitations
The project is superseded by the built-in Auto Mode and no new features are planned. Rules are tuned for Windows and Git Bash, and the hook contract is Claude Code specific. Broad Bash(...) allow rules defeat the guard. Only the default model anthropic/claude-haiku-4.5 has been tested.
How to disable. Remove the PreToolUse entry for haiku_guard.py from ~/.claude/settings.json and restart Claude Code.
Security check
- Sends command text and working directory to OpenRouter
- Requires an OpenRouter API key
- Changes global Claude Code settings
README in short
The README describes a Claude Code hook that combines regex rules and Haiku to rate Bash commands. None and low levels are allowed, medium is decided by Haiku, and high and critical always require a dialog. Interpreter wrappers such as python -c are treated as at least medium risk. The top of the README notes that the project is superseded by the built-in Auto Mode and no longer developed. It lists HAIKU_GUARD_* environment variables and offline classifier tests.
FAQ
What happens without an OpenRouter key?
Medium-risk commands show a confirmation dialog instead of being silently allowed. High and critical commands always require confirmation.
Can I mark critical files and folders?
Yes, via ~/.claude/hooks/haiku_guard.config.json with critical_files, critical_dirs and development_processes.
Related
Trail of Bits skills
Trail of Bits Skills Marketplace
Trail of Bits plugin marketplace for security work: smart contracts, C/C++ and Rust review, Semgrep, CodeQL and fuzzing
CTF Skills
ctf-skills
Skills for solving CTF challenges: web, pwn, crypto, reverse engineering, forensics, OSINT, malware and ML attacks