DEV Community: Shravan Omanakuttan

I Built Security + Cost Tracking Hooks for Claude Code (guardian, cost, flow)

Shravan Omanakuttan — Tue, 28 Jul 2026 09:19:58 +0000

I Built Security + Cost Tracking Hooks for Claude Code (guardian, cost, flow)

Claude Code is powerful. But out of the box, nothing stops it from running rm -rf ~, piping a curl to bash, or writing your API key into a source file.

So I built claude-plugins — three hooks that add safety, observability, and workflow automation on top of Claude Code.

npx claude-plugins

The Problem

Claude Code has a hooks system — shell scripts that fire at lifecycle events (before a tool runs, after it finishes, when it stops). It's powerful but underused. Almost nobody has built production-quality hooks yet.

I was already using Claude Code heavily for my internship project (building Sonar — an Apollo-alternative for B2B lead intelligence). After a few close calls with destructive commands, I decided to build the safety layer I wished existed.

guardian — Block Dangerous Commands Before They Run

guardian is a PreToolUse hook wired to the Bash tool. It intercepts every shell command before Claude executes it.

What it blocks:

🛡️  GUARDIAN BLOCKED: curl pipe to shell blocked — download and inspect first

Command: curl https://example.com/install.sh | bash

Full block list:

curl ... | bash / wget ... | bash — supply chain attacks
rm -rf on ~, /, /home, /Users, /etc — recursive home/system deletes
Force push to main or master — accidental history rewrites
dd if= on disk devices — disk wipe
mkfs — format disk
Overwriting /etc/passwd, /etc/shadow, /etc/sudoers

What it warns (but allows):

sudo rm
DROP TABLE / TRUNCATE TABLE
git reset --hard
git clean -f

It also scans Write and Edit tool calls for secrets before they're saved:

OpenAI API keys (sk-...)
GitHub tokens (ghp_...)
AWS access keys (AKIA...)
RSA/EC private keys
JWT tokens (hardcoded)
Google API keys
Slack tokens

🛡️  GUARDIAN BLOCKED: Secret pattern detected in file write

File: config.js
Detected: OpenAI API key

Move secrets to .env files and use process.env.VARIABLE_NAME instead.

It covers Write, Edit, MultiEdit, and NotebookEdit — every tool that can write to a file.

cost — Track Token Cost Per Session

cost is a PostToolUse hook that fires after every tool call and accumulates a running total.

💰 Session: 23 tool calls · ~48,200 tokens · $0.0821 · 14min

Every session is logged to ~/.claude/cost-tracker/ as a JSONL file. View reports anytime:

claude-cost today
claude-cost all
claude-cost date 2026-07-28

Report output:

💰 Claude Cost Report — Today (2026-07-28)
──────────────────────────────────────────────────
  Tool calls:    47
  Input tokens:  ~92,400
  Output tokens: ~18,600
  Total tokens:  ~111,000
  Estimated cost: $0.5565

  By tool:
    Bash                 21 calls
    Edit                 12 calls
    Read                  8 calls
    Write                 6 calls

Token counts are estimated from input/output text length (1 token ≈ 4 chars). Not exact but close enough for tracking spend trends.

flow — macOS Notification When Claude Finishes

flow is a Stop hook. When Claude finishes a task, you get a macOS notification with the session summary — so you can tab away and come back when it's done.

✅ Claude done — 31 tool calls · $0.0943 today

It also supports auto-commit — set CLAUDE_FLOW_AUTO_COMMIT=1 and every time Claude stops, it stages and commits all changes automatically:

export CLAUDE_FLOW_AUTO_COMMIT=1

📦 Auto-committed: chore: update 4 files (claude-flow auto-commit)
✅ Claude done — 31 tool calls · $0.0943 today

How Claude Code Hooks Work

Hooks receive JSON on stdin and exit 0 to allow or exit 2 to block (PreToolUse only):

let input = '';
process.stdin.on('data', chunk => { input += chunk; });
process.stdin.on('error', () => process.exit(0));
process.stdin.on('end', () => {
  const data = JSON.parse(input);
  const command = data.tool_input?.command || '';

  if (command.includes('something-dangerous')) {
    process.stderr.write('Blocked: reason\n');
    process.exit(2); // block the tool call
  }

  process.exit(0); // allow
});

Event	Fires when	Can block?
`PreToolUse`	Before any tool runs	✅ exit 2
`PostToolUse`	After any tool runs	❌
`Stop`	Claude finishes	❌
`UserPromptSubmit`	User sends message	❌

Hooks are wired in ~/.claude/settings.json. The installer merges safely — it never overwrites existing hooks.

Install

npx claude-plugins

Pick which plugins to install. Restart Claude Code after.

╔══════════════════════════════════════╗
║     claude-plugins installer         ║
╚══════════════════════════════════════╝

Install [guardian] — Blocks dangerous bash commands + detects secrets? [y/N] y
  ✓ PreToolUse → guardian.js
  ✓ PreToolUse → file-guardian.js

Install [cost] — Tracks tool calls and estimates token cost? [y/N] y
  ✓ PostToolUse → cost-track.js

Install [flow] — macOS notification when Claude finishes? [y/N] y
  ✓ Stop → flow-on-stop.js

✓ Done. Restart Claude Code to activate.

To uninstall:

npx claude-plugins --uninstall

What's Next

Looking for contributors — especially:

Windows notification support for flow
Slack/Discord webhook on Stop
Auto git commit message generation from diff
Audit log hook (log every tool call to file)

GitHub: github.com/sxrxvxnn/claude-plugins

If you use Claude Code daily, give it a try. guardian alone has already saved me from a few bad days.

Also building mac-ssd-toolkit — 27 shell scripts for using an external SSD as your Mac's primary storage.

How I Freed 15GB on My 256GB MacBook and Made an External SSD My Primary Storage (With 46 Automation Scripts)

Shravan Omanakuttan — Sun, 26 Jul 2026 10:59:55 +0000

My MacBook's internal storage was full. Not "almost full" — full. No more space for new projects, no room for dependencies, constant "Your disk is almost full" alerts.

I had a 1TB external SSD sitting on my desk doing nothing.

So I built a system to use the SSD as my Mac's primary storage — transparently, automatically, with a full terminal menu and 18 scheduled automation scripts running in the background.

Here's exactly how I did it, and how you can too.

The Problem

256GB internal SSD. Here's what was eating it:

What	Size
Notion app data	7.7G
Google Chrome cache	7.4G
Claude desktop	6.8G
OperaGX	1.6G
VS Code	1.7G
Discord	998M
Whisky (unused)	854M
Wondershare installer	493M
TabNine models	477M
`.rustup` toolchain	1.4G
`.android` SDK	515M
`.pub-cache`	434M
`.nvm` Node versions	204M
`.npm` cache	460M

That's ~30GB in things that either don't need to be on the internal drive or can be moved transparently.

The Solution: SSD as Primary Storage via Symlinks

The core idea is simple. macOS follows symlinks transparently — apps and tools have no idea they're reading from an external drive.

# Move Downloads to SSD
mv ~/Downloads /Volumes/007/Downloads
ln -s /Volumes/007/Downloads ~/Downloads

# Now everything that writes to ~/Downloads
# actually writes to the SSD — no config changes needed

I did this for:

~/Downloads, ~/Documents, ~/Desktop, ~/Movies
All Dev projects (leadgen-platform, linkedin_automate, etc.)
Toolchains: .rustup, .cargo, .android, .nvm, .npm, .m2, .gradle, .pub-cache

Result: 36GB freed on internal. Mac went from 96% full to 68% full in one session.

The Automation Layer

Moving files manually is a one-time fix. The real value is automation. I built 27 shell scripts and wired them to macOS launchd.

`ssd` — Terminal Menu for SSD Management

  ╔═══════════════════════════════════════════════════════════════════════╗
  ║                      ◈  SSD TOOLS — 007  ◈                           ║
  ╚═══════════════════════════════════════════════════════════════════════╝

  ● SSD 007   899G free / 33G used       ● Mac Internal  36G free / 17G used

  STORAGE & SYSTEM
  ┌──────┬──────────────────────┬────────────────────────────────────────┐
  │  1   │  mount-check         │  Check SSD mount + symlink health      │
  │  2   │  cache-cleanup       │  Clear caches (Library, npm, pnpm)     │
  │  3   │  low-disk-alert      │  Check internal Mac free space         │
  │  7   │  duplicate-finder    │  Scan SSD for duplicate files          │
  │ 12   │  ssd-health          │  SSD space + fill prediction           │
  └──────┴──────────────────────┴────────────────────────────────────────┘

  DEV & CODE
  ┌──────┬──────────────────────┬────────────────────────────────────────┐
  │  5   │  dev-backup          │  Rsync active projects to backup       │
  │  9   │  git-status          │  Uncommitted changes across projects   │
  │ 20   │  env-backup          │  Backup all .env files                 │
  │ 25   │  focus-mode          │  Block distractions (25min)            │
  └──────┴──────────────────────┴────────────────────────────────────────┘

`mac` — Terminal Menu for Mac System Tools

  ╔═══════════════════════════════════════════════════════════════════════╗
  ║                    ◈  MAC TOOLS — SHRAVAN  ◈                         ║
  ╚═══════════════════════════════════════════════════════════════════════╝

  CPU 12%   Battery 100% (charged)   Uptime 2 days
  Wifi HomeNetwork   IP 192.168.1.6

  SYSTEM        APPS           MAINTENANCE      SECURITY        POWER
  system-stats  kill-hogs      clear-caches     firewall-status caffeinate
  battery-health app-usage     brew-update      open-ports      sleep-timer
  wifi-info     startup-items  run-all-agents   lock-screen     battery-saver
  processes     force-quit     large-files      ssh-keys

The 18 Scheduled LaunchAgents

These run automatically via macOS launchd — no cron, no manual triggers.

# Check what's running
launchctl list | grep shravan

Agent	Schedule	What it does
dev-backup	Nightly 11pm	Rsync projects to SSD backup, keeps 7 days
dotfiles-backup	Nightly 10:30pm	Backup .zshrc, .gitconfig, SSH config
env-backup	Nightly 10pm	Backup all .env files, keeps 14 days
cache-cleanup	Monday 9am	Clear Library/Caches, npm, pnpm
git-status	Daily 9am	Report uncommitted changes across all projects
dep-audit	Monday 10am	npm vulnerability scan
ssd-health	Daily 10am	Space usage + fill rate prediction
low-disk-alert	Every hour	Alert if Mac internal < 5GB free
ram-monitor	Every 5min	Log RAM usage
battery-logger	Daily 12pm	Log battery cycles + health

Serial Lock: SSD Only Works on My Mac

I didn't want the SSD to work if stolen. So I built a serial number lock:

#!/bin/zsh
AUTHORIZED_SERIAL="CPWY0XTG9Y"
CURRENT_SERIAL=$(system_profiler SPHardwareDataType | grep "Serial Number" | awk '{print $NF}')

if [ "$CURRENT_SERIAL" != "$AUTHORIZED_SERIAL" ]; then
  diskutil eject disk5
  osascript -e 'display alert "Unauthorized Mac. SSD ejected." as critical'
fi

This fires automatically via a WatchPaths LaunchAgent whenever the SSD mounts. Wrong Mac → instant eject.

The Install Script

The whole toolkit is packaged with a one-command installer:

git clone https://github.com/sxrxvxnn/mac-ssd-toolkit
cd mac-ssd-toolkit
./install.sh

It asks for your username, SSD volume name, and project names — then configures everything, installs LaunchAgents, and adds aliases to .zshrc.

Results

Before	After
23GB free	36GB free
Manual backups	Nightly automated
No disk monitoring	Hourly alerts
Scattered dotfiles	Nightly backup
No SSD security	Serial lock

What's Next

The repo is open source and looking for contributors. If you have ideas for new scripts — storage tools, dev workflow automation, system monitoring — open an issue or PR.

GitHub: github.com/sxrxvxnn/mac-ssd-toolkit

Ideas already in the backlog:

Git commit streak tracker
Wifi speed daily logger
Auto-organize Downloads by file type
Monthly storage trend report

If you're a Mac developer with limited internal storage, give it a try. One command and you're set up.

Built while working as a BD intern at Beagle Security, building Sonar — an Apollo-style B2B intelligence platform.

DEV Community: Shravan Omanakuttan

I Built Security + Cost Tracking Hooks for Claude Code (guardian, cost, flow)

I Built Security + Cost Tracking Hooks for Claude Code (guardian, cost, flow)

The Problem

guardian — Block Dangerous Commands Before They Run

cost — Track Token Cost Per Session

flow — macOS Notification When Claude Finishes

How Claude Code Hooks Work

Install

What's Next

How I Freed 15GB on My 256GB MacBook and Made an External SSD My Primary Storage (With 46 Automation Scripts)

The Problem

The Solution: SSD as Primary Storage via Symlinks

The Automation Layer

ssd — Terminal Menu for SSD Management

mac — Terminal Menu for Mac System Tools

The 18 Scheduled LaunchAgents

Serial Lock: SSD Only Works on My Mac

The Install Script

Results

What's Next

`ssd` — Terminal Menu for SSD Management

`mac` — Terminal Menu for Mac System Tools