claude-code-haiku-guard plugin
A Claude Code hook that rates Bash command risk with rules and Haiku, asking for approval only on risky commands
- 6 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Sends command text and working directory to OpenRouter
- Requires an OpenRouter API key
- Changes global Claude Code settings
Install
- Works in
Manual install
Copy hook/haiku_guard.py to ~/.claude/hooks/haiku_guard.py, merge the PreToolUse hook from examples/settings.json into ~/.claude/settings.json, and remove broad Bash(... *) allow rules. I will put my OpenRouter key into ~/.openrouter_key myself.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Sends command text and working directory to OpenRouter
- Requires an OpenRouter API key
- Changes global Claude Code settings
This is third-party code. Review the repository files before installing.
What it does
A PreToolUse hook classifies every Bash command by risk. Low-risk commands pass silently, medium ones go to Haiku via OpenRouter for a yes or no decision, and high or critical ones always show a dialog. Decisions are cached per command and working directory; without a key or on network errors, medium commands fall back to a dialog.
Who it is for. For heavy Claude Code users who are tired of approving harmless commands but do not want --dangerously-skip-permissions.
Good fit when
- You want explicit rule-based command gating with your own config
- You do not use the built-in Claude Code Auto Mode
- You work on Windows with Git Bash
Not a fit when
- Auto Mode is already on: the author says the hook is largely redundant then
- You have no OpenRouter access or do not want commands sent there
Example request
Set up haiku-guard as a PreToolUse hook following SETUP.mdLimitations
The project is superseded by the built-in Auto Mode and no new features are planned. Rules are tuned for Windows and Git Bash, and the hook contract is Claude Code specific. Broad Bash(...) allow rules defeat the guard. Only the default model anthropic/claude-haiku-4.5 has been tested.
How to disable. Remove the PreToolUse entry for haiku_guard.py from ~/.claude/settings.json and restart Claude Code.
FAQ
What happens without an OpenRouter key?
Medium-risk commands show a confirmation dialog instead of being silently allowed. High and critical commands always require confirmation.
Can I mark critical files and folders?
Yes, via ~/.claude/hooks/haiku_guard.config.json with critical_files, critical_dirs and development_processes.
Discussion
No questions or reviews yet.
Related
PluginsA marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
Claude Hooks (Prompt Injection Defender)
Claude Hooks
A Claude Code hook that scans file, web page and command output for hidden instructions and warns the agent
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
Trail of Bits Claude Code Config
claude-code-config
Claude Code settings and practices from Trail of Bits: sandbox, permissions, hooks, skills and MCP servers. It is a set of recommendations rather than a package
An Anthropic GitHub Action that checks pull request changes for vulnerabilities with Claude and leaves comments
README in short
The README describes a Claude Code hook that combines regex rules and Haiku to rate Bash commands. None and low levels are allowed, medium is decided by Haiku, and high and critical always require a dialog. Interpreter wrappers such as python -c are treated as at least medium risk. The top of the README notes that the project is superseded by the built-in Auto Mode and no longer developed. It lists HAIKU_GUARD_* environment variables and offline classifier tests.