Block Dangerous Commands Claude Code Would Run

This mod lets you block dangerous commands Claude Code is about to run through its Bash tool. Before any shell command executes, it is checked against a short list of rules. A match is refused, Claude is told which rule fired and why, and you see a toast with the rule name. Safe commands pass through untouched.

The built-in rules cover rm -rf on /, ~, $HOME, . or *; git push --force to main or master; git clean -fdx; SQL DROP TABLE, DROP DATABASE, DROP SCHEMA and TRUNCATE; chmod -R 777 /; mkfs; dd onto a disk device; redirecting output onto a raw disk; piping curl or wget into a shell; and the classic fork bomb. git reset --hard is available as an opt-in rule. Requires Claude Code 2.1.287 or later.

The recording asks Claude to do something destructive in a demo project. The mod refuses the Bash call, a toast names the rule that matched, and Claude reads the reason and responds without running the command.

Use one of the install methods in the block. The guard is active from the next tool call; no restart is needed after /reload-plugins.

All of the logic sits in one tool.call hook. From hooks/register.ts:

on('tool.call', { tool: 'Bash' }, ($, e, next) => {
  const match = findMatch(e.command, settings)
  if (match === undefined) return next(e)

  if (settings.mode === 'warn') {
    $.ui.toast(`${$.plugin.name}: "${match.name}" is running (warn mode)`)
    return next(e)
  }

  $.ui.toast(`${$.plugin.name}: blocked "${match.name}"`)
  return { deny: denyReason($.plugin.name, match) }
}).catch(($, e, next) =>
  next.called
    ? next(e)
    : { deny: `${$.plugin.name}: its check failed, so the command was not run to be safe.` },
)

The matcher { tool: 'Bash' } means the hook only sees shell commands. findMatch in hooks/rules.ts checks allowPatterns first, then the built-in rules (skipping those switched off), then your extraPatterns. With no match, next(e) runs the command as usual. With a match, the hook returns { deny: reason }, and that reason becomes the tool result Claude reads.

The .catch handler is what makes this a guard and not just a filter. If the check throws before next was called, the call is denied rather than allowed: the mod fails closed. A session.start hook toasts once if any of your custom patterns is not a valid regular expression.

Each rule in rules.ts is plain data with an id, a name, a one-sentence reason and example commands that the tests check.

Change these options in /config. mode: warn turns the guard into a notifier: matching commands still run, and you get a toast. extraPatterns and allowPatterns take JavaScript regular expressions, one per entry. To change a built-in rule, edit its pattern in the RULES array in hooks/rules.ts.

Intercepts tool calls is the reason the mod exists: it sees every Bash command before it runs and can deny it. It never rewrites a command, and it never runs one itself. Changes the UI covers the toasts. It has no file, network, model or command access of its own.

This is protection against accidents, not a sandbox. A command built to avoid the patterns will get through, so keep Claude Code's permission prompts on. Disable the mod with /plugin disable cm-block-dangerous-commands, or start a session with every mod off using claude --safe-mode.

Tested with Claude Code 2.1.291 in the terminal on macOS. If commands you expect to be blocked still run:

• Check claude --version is 2.1.287 or later and that the mod is enabled in /plugin.
• Run /reload-plugins after a shell install.
• Check mode is block, not warn, in /config.
• Check that an allowPatterns entry is not matching more than you meant.
• The guard only covers the Bash tool. File edits through Edit and Write are not checked.

If a safe command is refused, add a narrow allow pattern rather than switching the whole mod to warn mode.