DEV Community: Dan Jeong

5 Claude Code Hooks Every Developer Needs

Dan Jeong — Tue, 17 Feb 2026 19:55:32 +0000

Claude Code hooks let you run scripts before and after every tool call. Most people ignore them. Here are five that will save you from real problems.

Quick Setup

All hooks go in ~/.claude/settings.json. Each one runs a script at a specific lifecycle event. The structure:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [{ "type": "command", "command": "bun ~/.claude/hooks/your-hook.ts" }]
      }
    ]
  }
}

Four lifecycle events: PreToolUse, PostToolUse, SessionStart, SessionEnd.

1. Audit Logger (PostToolUse)

Track every command Claude runs. When something breaks at 2am, you want a log.

// ~/.claude/hooks/audit-logger.ts
import { readFileSync, appendFileSync, mkdirSync } from "fs";

const input = JSON.parse(readFileSync("/dev/stdin", "utf-8"));

const logDir = `${process.env.HOME}/.claude/logs`;
mkdirSync(logDir, { recursive: true });

const entry = {
  timestamp: new Date().toISOString(),
  tool: input.tool_name,
  input: input.tool_input,
};

appendFileSync(
  `${logDir}/audit-${new Date().toISOString().split("T")[0]}.jsonl`,
  JSON.stringify(entry) + "\n"
);

process.exit(0);

Hook config:

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "",
        "hooks": [{ "type": "command", "command": "bun ~/.claude/hooks/audit-logger.ts" }]
      }
    ]
  }
}

Empty matcher = runs for every tool, not just Bash. You get a complete audit trail.

2. Git Safety Net (PreToolUse)

Block force pushes to main, accidental hard resets, and history rewrites.

// ~/.claude/hooks/git-safety.ts
import { readFileSync } from "fs";

const input = JSON.parse(readFileSync("/dev/stdin", "utf-8"));
if (input.tool_name !== "Bash") process.exit(0);

const cmd = input.tool_input?.command || "";

const blocked = [
  { pattern: /git\s+push.*--force\s+.*(main|master)/, msg: "Force push to main/master" },
  { pattern: /git\s+reset\s+--hard/, msg: "Hard reset discards uncommitted work" },
  { pattern: /git\s+clean\s+-[dfx]/, msg: "Git clean removes untracked files permanently" },
  { pattern: /git\s+checkout\s+\.\s*$/, msg: "Checkout . discards all changes" },
];

for (const rule of blocked) {
  if (rule.pattern.test(cmd)) {
    console.error(`[BLOCKED] ${rule.msg}`);
    process.exit(2);
  }
}

process.exit(0);

Exit code 2 tells Claude Code to block the command. Claude sees your error message and adjusts.

3. Credential Guard (PreToolUse)

Prevent Claude from reading, copying, or exfiltrating your secrets.

// ~/.claude/hooks/credential-guard.ts
import { readFileSync } from "fs";
import { resolve } from "path";

const input = JSON.parse(readFileSync("/dev/stdin", "utf-8"));

const protectedPaths = [
  "~/.ssh",
  "~/.aws",
  "~/.gnupg",
  "~/.env",
  "~/.config/credentials",
];

const home = process.env.HOME || "";
const expanded = protectedPaths.map(p => p.replace("~", home));

// Check both Bash commands and file operations
const targets: string[] = [];

if (input.tool_name === "Bash") {
  targets.push(input.tool_input?.command || "");
}
if (input.tool_name === "Read" || input.tool_name === "Write" || input.tool_name === "Edit") {
  targets.push(input.tool_input?.file_path || "");
  targets.push(input.tool_input?.path || "");
}

for (const target of targets) {
  const resolved = resolve(target);
  for (const protected_path of expanded) {
    if (resolved.startsWith(protected_path) || target.includes(protected_path)) {
      console.error(`[BLOCKED] Access to protected path: ${protected_path}`);
      process.exit(2);
    }
  }
}

process.exit(0);

This covers Read, Write, Edit, and Bash. Claude can't cat ~/.ssh/id_rsa or cp ~/.aws/credentials /tmp/.

4. Session Context Loader (SessionStart)

Auto-load project notes, TODOs, and context when Claude starts. No more re-explaining your project every session.

// ~/.claude/hooks/session-context.ts
import { readFileSync, existsSync } from "fs";

const contextFiles = [
  "CLAUDE.md",
  ".claude/context.md",
  "TODO.md",
  "ARCHITECTURE.md",
];

const cwd = process.cwd();
const loaded: string[] = [];

for (const file of contextFiles) {
  const fullPath = `${cwd}/${file}`;
  if (existsSync(fullPath)) {
    loaded.push(file);
  }
}

if (loaded.length > 0) {
  console.error(`[Context] Loaded: ${loaded.join(", ")}`);
} else {
  console.error("[Context] No project context files found. Consider adding a CLAUDE.md.");
}

process.exit(0);

Hook config for SessionStart:

{
  "hooks": {
    "SessionStart": [
      {
        "matcher": "",
        "hooks": [{ "type": "command", "command": "bun ~/.claude/hooks/session-context.ts" }]
      }
    ]
  }
}

5. Dangerous Pattern Detector (PreToolUse)

Catch novel dangerous patterns that simple string matching misses.

// ~/.claude/hooks/pattern-detector.ts
import { readFileSync } from "fs";

const input = JSON.parse(readFileSync("/dev/stdin", "utf-8"));
if (input.tool_name !== "Bash") process.exit(0);

const cmd = input.tool_input?.command || "";

// Pipe chains with network tools = potential exfiltration
if (/\|.*\|.*\|/.test(cmd) && /(curl|wget|nc|netcat)/.test(cmd)) {
  console.error("[BLOCKED] Complex pipe chain with network access");
  process.exit(2);
}

// Loops with delete operations
if (/(for|while).*do.*rm/.test(cmd)) {
  console.error("[BLOCKED] Loop containing delete operations");
  process.exit(2);
}

// Eval with variable injection
if (/eval.*\$/.test(cmd)) {
  console.error("[BLOCKED] Eval with variable expansion");
  process.exit(2);
}

// Download and execute pattern
if (/(curl|wget).*\|\s*(bash|sh|zsh|python)/.test(cmd)) {
  console.error("[BLOCKED] Download and execute pattern");
  process.exit(2);
}

// Writing to system paths
if (/(>|tee)\s+\/(etc|usr|bin|sbin)\//.test(cmd)) {
  console.error("[BLOCKED] Writing to system directory");
  process.exit(2);
}

process.exit(0);

Combining All Five

Here's the complete settings.json with all hooks wired up:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "",
        "hooks": [
          { "type": "command", "command": "bun ~/.claude/hooks/credential-guard.ts" }
        ]
      },
      {
        "matcher": "Bash",
        "hooks": [
          { "type": "command", "command": "bun ~/.claude/hooks/git-safety.ts" },
          { "type": "command", "command": "bun ~/.claude/hooks/pattern-detector.ts" }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "",
        "hooks": [
          { "type": "command", "command": "bun ~/.claude/hooks/audit-logger.ts" }
        ]
      }
    ],
    "SessionStart": [
      {
        "matcher": "",
        "hooks": [
          { "type": "command", "command": "bun ~/.claude/hooks/session-context.ts" }
        ]
      }
    ]
  }
}

Each hook runs independently. If one blocks (exit code 2), the command stops. If one logs (exit code 0), execution continues.

Going Further

These five hooks cover the basics. For production use, you want:

YAML-based pattern configs (easier to update than code)
Path protection tiers (zero-access, read-only, no-delete)
Centralized logging with search
Cost tracking per session

I packaged all of this into two products:

Damage Control Bundle ($99): 30+ patterns, path guards, heuristic detection, YAML configs. Production-ready.
Claude Code Hooks Starter Kit ($49): Clean templates for all 4 hook types with documentation. Build your own.

Both run on Bun/TypeScript. Drop into ~/.claude/ and they work.

How to Stop Claude Code from Destroying Your System

Dan Jeong — Tue, 17 Feb 2026 19:46:05 +0000

Claude Code can run any command on your machine. That includes rm -rf /, DROP TABLE users, and chmod 777 ~/.ssh. If you've used it for more than a week, you've probably had a close call.

The fix is hooks. Claude Code supports lifecycle hooks that run before and after every tool execution. You can use them to block dangerous commands before they touch your filesystem.

Here's how to build a security layer in under 30 minutes.

How Claude Code Hooks Work

Hooks are scripts that Claude Code runs at specific lifecycle events:

PreToolUse: Runs before a tool executes. Can block the operation (exit code 2).
PostToolUse: Runs after a tool completes. Good for logging.
SessionStart: Runs when Claude starts a session.
SessionEnd: Runs when a session ends.

The key one for security is PreToolUse. When your hook exits with code 2, Claude Code blocks the command and shows your error message instead.

Layer 1: Pattern Matching

The simplest protection is regex matching against known dangerous commands. Create a YAML file with patterns:

# patterns.yaml
critical:
  - pattern: "rm\\s+(-[rfRF]+\\s+)?/"
    description: "Recursive delete from root"
  - pattern: "DROP\\s+(TABLE|DATABASE)"
    description: "SQL destructive operation"
  - pattern: "chmod\\s+777"
    description: "World-writable permissions"
  - pattern: "curl.*\\|\\s*(bash|sh|zsh)"
    description: "Pipe to shell execution"
  - pattern: "git\\s+push.*--force\\s+.*(main|master)"
    description: "Force push to main branch"

warning:
  - pattern: "npm\\s+publish"
    description: "Publishing to npm registry"
  - pattern: "docker\\s+system\\s+prune"
    description: "Docker full cleanup"

Then in your PreToolUse hook (TypeScript with Bun):

import { readFileSync } from "fs";
import { parse } from "yaml";

const input = JSON.parse(readFileSync("/dev/stdin", "utf-8"));

// Only check Bash tool calls
if (input.tool_name !== "Bash") process.exit(0);

const command = input.tool_input?.command || "";
const patterns = parse(readFileSync("patterns.yaml", "utf-8"));

for (const p of patterns.critical) {
  if (new RegExp(p.pattern, "i").test(command)) {
    // Exit code 2 = block the command
    console.error(`[BLOCKED] ${p.description}`);
    process.exit(2);
  }
}

for (const p of patterns.warning) {
  if (new RegExp(p.pattern, "i").test(command)) {
    console.error(`[WARNING] ${p.description}`);
    // Exit 0 = allow but warn
  }
}

process.exit(0);

Layer 2: Path Guards

Pattern matching catches known commands, but what about cat ~/.ssh/id_rsa > /tmp/exfil? You need path-based protection.

Define protection tiers:

# paths.yaml
zero_access:
  - "~/.ssh"
  - "~/.aws/credentials"
  - "~/.env"
  - "~/.gnupg"

read_only:
  - "/etc/passwd"
  - "~/.bashrc"
  - "~/.zshrc"

no_delete:
  - "~/.git"
  - "package.json"
  - "tsconfig.json"

Then check tool inputs against these paths. Any Write or Edit targeting a zero-access path gets blocked. Any destructive operation on a no-delete path gets blocked.

Layer 3: Heuristic Detection

Patterns and paths catch known threats. Heuristics catch novel ones:

function heuristicCheck(command: string): string | null {
  // Pipe chains with network tools
  if (/\|.*\|.*\|/.test(command) &&
      /(curl|wget|nc|netcat)/.test(command)) {
    return "Complex pipe chain with network access";
  }

  // Loops with delete operations
  if (/(for|while).*do.*rm/.test(command)) {
    return "Loop containing delete operations";
  }

  // Eval with variable injection
  if (/eval.*\$/.test(command)) {
    return "Eval with variable expansion";
  }

  return null;
}

Wiring It Up

Add the hook to your Claude Code settings (~/.claude/settings.json):

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bun ~/.claude/hooks/damage-control.ts"
          }
        ]
      }
    ]
  }
}

Now every Bash command runs through your security layer before execution.

Testing It

# This should be BLOCKED:
claude -p "rm -rf /" --allowedTools Bash

# You should see:
# [BLOCKED] Recursive delete from root

What This Doesn't Cover

This approach has limitations:

Multi-step attacks: Claude could write a script, then execute it. The hook only sees the execution command, not the script contents.
Indirect access: If Claude writes to a file that another process reads, the hook won't catch it.
New tools: Claude Code may add new tools beyond Bash. Your hook needs to cover them.

For production use, you want a more comprehensive solution that handles all three layers with proper YAML configuration, covers all tool types, and includes heuristic detection for novel patterns.

Get the Full Implementation

I built a complete security bundle that handles all of this:

Damage Control Bundle ($99): Production-ready security hooks with 30+ patterns, path guards for SSH/credentials/.env, and heuristic detection. Drop into ~/.claude/ and you're protected.
Claude Code Hooks Starter Kit ($49): Templates for all 4 hook types (PreToolUse, PostToolUse, SessionStart, SessionEnd). Good starting point if you want to build your own.

Both include TypeScript source, YAML configs, settings.json, and documentation.

The Bigger Picture

AI coding assistants are getting more autonomous. Claude Code can already run commands, edit files, and manage git. The capability gap between "helpful tool" and "dangerous tool" is one bad prompt away.

Security hooks are the minimum viable safety layer. Build them before you need them.