EMILIA Guard: action confirmation for Claude Code
EMILIA Guard
A plugin that holds dangerous tool calls in Claude Code for a human's confirmation and, optionally, a signed receipt.
- 601 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The hook sees every Claude Code tool call and may delay or reject it
- In EMILIA mode details of money-related and external actions go to the emiliaprotocol.ai server, and the EP_API_KEY key gives access to your organization
- The manifest attaches an MCP server that starts through npx -y and receives EP_API_KEY in its environment
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/emilia-guardDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The hook sees every Claude Code tool call and may delay or reject it
- In EMILIA mode details of money-related and external actions go to the emiliaprotocol.ai server, and the EP_API_KEY key gives access to your organization
- The manifest attaches an MCP server that starts through npx -y and receives EP_API_KEY in its environment
This is third-party code. Review the repository files before installing.
What it does
EMILIA Guard attaches a hook to Claude Code tool calls and catches actions that are hard to undo: dangerous shell commands, writes to files with secrets and MCP tool calls tied to money or sending things out. To a matched action the hook answers with a confirmation prompt or a denial. Other calls such as reads, searches and safe edits follow Claude Code's normal permission flow. Without setup the plugin runs in local mode: it holds a dangerous call until explicit confirmation, and no account is needed. Setting the EP_API_KEY and EP_ORG_ID variables switches on EMILIA mode. For calls tied to money and external sends, the policy engine mints a receipt before the action, names the person who must sign and waits for confirmation on their device, 30 seconds by default. The receipt's authenticity is checked without a server through `npx @emilia-protocol/verify`. The plugin installs from the emilia-protocol repository, which also holds the protocol itself with packages for various environments. This card covers only the Claude Code plugin, whose manifest also describes the MCP server @emilia-protocol/mcp-server.
Who it is for. For teams and developers who give Claude Code access to production infrastructure, payments and mailings and want a separate confirmation point.
Good fit when
- The agent works with a live environment and a pause with explicit confirmation is needed before `terraform apply`, `kubectl delete` or `git push --force`
- Payment or mail MCP servers are connected, and calls like a transfer, a sent email or a publication should be confirmed by a person
- Writes to `.env`, `.ssh`, `.aws`, `*.pem` or `.github/workflows` should happen only after consent
- You need a record of the decision: a signed receipt that is verified without a server
- You want to add your own trigger words, such as a production database name, through the `EP_GUARD_PATTERNS` variable
Not a fit when
- You need a hard authorization boundary: the hook relies on substring matching, and encoded, split or unusual commands can evade it
- Claude Code's built-in permission prompts are enough: without receipts the plugin adds only a classifier of dangerous actions
- Agents run with nobody nearby, for example in a night pipeline: the confirmation prompt will go unanswered
- Waiting for a signature is unacceptable: the hook blocks the call while it waits (30 seconds by default), and on a timeout it returns a confirmation prompt
Example request
Apply the terraform changes in the production environment and delete the outdated resources, but stop before every dangerous command and wait for my confirmation.Limitations
The hook does not decide in place of a person and never returns an allow: a matched action gets a confirmation prompt or a denial, even after remote approval. Other calls fall back to Claude Code's normal permission order, which is not a security verdict. Exact command mapping, one-time admission and receipt checking must be built into the shell, MCP server or integration that holds the credentials.
EMILIA mode needs an EP_API_KEY from emiliaprotocol.ai and an organization ID. The signoff wait defaults to 30 seconds with a cap of 60, set by the EP_SIGNOFF_TIMEOUT_S variable. The plugin version in the manifest is 0.1.0, an early release.
Whether emiliaprotocol.ai is reachable from Russia was not checked for this card.
How to disable. Disable the plugin in Claude Code with the `/plugin` command or remove it through the plugin manager, and remove the EP_API_KEY and EP_ORG_ID variables from the environment. Revoke the key issued on emiliaprotocol.ai on the site if needed.
FAQ
How do I install EMILIA Guard in Claude Code?
Run `/plugin marketplace add emiliaprotocol/emilia-protocol`, then `/plugin install emilia-guard@emilia-protocol`. Nothing else needs configuring: the plugin starts in local mode without an account.
Which actions does EMILIA Guard stop?
In Bash: `rm -rf`, `git push --force`, `git reset --hard`, `DROP`, `TRUNCATE` and `DELETE FROM`, `dd`, `mkfs`, piping a script into a shell, `npm publish`, `terraform apply`, `kubectl delete`, deleting and terminating resources through `aws`, `sudo` and reading `.env`. For Write and Edit: paths containing `.env`, `.ssh/`, `.aws/`, `*.pem`, `credentials`, `secrets`, `/etc/` and `.github/workflows/`. For MCP: tools whose names suggest payment, transfer, sending, publishing, deploying, deleting or revoking.
Do I need an account to use EMILIA Guard?
Not for local mode. An account on emiliaprotocol.ai is needed only for signed receipts: it gives you the EP_API_KEY key that, together with EP_ORG_ID, switches on EMILIA mode.
Does EMILIA Guard protect completely?
No. The classifier looks for substrings, so encoded, split or unusual forms of a command can slip past it, and the hook does not bind every argument to a receipt. Strict enforcement must be built into the shell or MCP server that holds the credentials.
How do I add my own triggers to EMILIA Guard?
Set the `EP_GUARD_PATTERNS` variable: one substring per line, case-insensitive and without regular expressions. For example, the name of a production database or a client.
Discussion
No questions or reviews yet.
Related
PluginsA plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
HOL Guard checks an AI agent's shell commands, secret reads, MCP calls and package installs before they run and holds risky actions until you decide
A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
Prowler plugin for Claude Code
Prowler for Claude Code
A plugin that takes a cloud account toward CIS, PCI-DSS and other frameworks: reads Prowler Cloud reports, fixes failures and proposes a rescan
Claude Hooks (Prompt Injection Defender)
Claude Hooks
A Claude Code hook that scans file, web page and command output for hidden instructions and warns the agent
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| EMILIA Guard: action confirmation for Claude Code (this entry) | yes | 601 | |
| AgentShield | no | 1,338 | audits the .claude folder for plaintext keys and broad permissions but does not stop calls at run time |
| guard-skills | no | 1,290 | second-pass diff skills that catch typical code mistakes |
| DashClaw | no | 313 | a plugin and approval server for Claude Code and Codex |
README in short
The plugin document presents it as a safety net with human confirmation for common dangerous Claude Code actions. It explains the limits: the hook does not replace exact checking and never allows an action by itself. Then come installation, the move to signed receipts in four steps, screenshots of confirmation on a device and a table of what gets stopped. The end shows how to set your own triggers.