🔒

Secure Claude Code

Security guardrails for Claude Code, MCP tools, and Claude cowork workflows. Local-first modular YARA-style guard packs for secrets, exfiltration, prompt injection, MCP abuse, and risky agent actions.

0 installs

Trust: 52 — Fair

Security

Ask AI about Secure Claude Code

I know everything about Secure Claude Code. Ask me about installation, configuration, usage, or troubleshooting.

0/500

Loading tools...

Reviews

Documentation

Runwall

Runtime security guardrails for Claude Code, Codex, and MCP-based coding setups.

Runwall sits between the agent and risky actions so you can:

block obvious bad shell, git, MCP, and exfiltration flows
scan a repo or runtime setup before enabling it
keep a practical security baseline without turning normal coding into sludge

Release License

Why Use It

Coding agents can:

run shell commands
edit files
push git changes
call MCP tools
touch secrets, browsers, databases, and local services

That is useful, but it is also enough to leak data or damage a machine fast.

Runwall helps reduce that risk with:

preflight checks before risky actions run
output inspection after tools return untrusted content
local trust tracking for tools, hooks, data stores, IPC targets, and approvals
installable profiles: minimal, balanced, and strict

Fast Start

Claude Code

claude plugin marketplace add efij/secure-claude-code
claude plugin install runwall@runwall
claude plugin list

Expected result:

runwall@runwall
Status: enabled

Codex

If your Codex supports local bundle install, install this repo as a plugin bundle.

Fallback:

./bin/runwall generate-runtime-config codex balanced

Local CLI Install

git clone https://github.com/efij/secure-claude-code.git
cd secure-claude-code
./bin/runwall install balanced
./bin/runwall doctor

Profiles

minimal: lowest friction
balanced: sensible default
strict: strongest blocking and review prompts

What It Protects

shell execution
git and repo actions
MCP requests and responses
plugin and skill trust boundaries
secrets and local credential stores
local services, IPC, and browser sessions
destructive actions and production access

Protection families

Secrets & Identity
Supply Chain & Dependencies
Git & Source Control
MCP, Plugins & Skills
Runtime, Network & Egress
Infra & Production Access
Trust, Persistence & Evasion
Quality & Workflow
Memory & Knowledge
SaaS & Control Planes
Fileless & Inline Execution
Remote Content Promotion
Local Data Stores
Local IPC & Helpers
Publish, Release & Supply Chain
Destructive Actions & Blast Radius

Full guard inventory: GUARDS.md

Common Commands

./bin/runwall install balanced
./bin/runwall doctor
./bin/runwall audit .
./bin/runwall list protections
./bin/runwall list runtimes
./bin/runwall generate-runtime-config codex balanced
./bin/runwall generate-runtime-config cursor balanced
./bin/runwall generate-runtime-config windsurf balanced
./bin/runwall generate-runtime-config claude-desktop balanced

Advanced trust-plane commands

./bin/runwall tools list --json
./bin/runwall tools approve <name-or-path>
./bin/runwall hooks list --json
./bin/runwall hooks diff <path-or-key>
./bin/runwall approvals list --json
./bin/runwall services list --json
./bin/runwall data list --json
./bin/runwall ipc list --json
./bin/runwall browser sessions --json
./bin/runwall flow list --json
./bin/runwall agents graph --json
./bin/runwall memory list --json
./bin/runwall knowledge list --json
./bin/runwall review list --json
./bin/runwall artifacts list --json
./bin/runwall release list --json
./bin/runwall destructive list --json
./bin/runwall handoff graph --json
./bin/runwall auth list --json
./bin/runwall apps list --json
./bin/runwall safety list --json

Supported Runtimes

Runtime	Status	How
Claude Code	First-class	native plugin hooks
Codex	Supported	plugin bundle or generated MCP config
Cursor	Supported	generated `mcp.json`
Windsurf	Supported	generated `mcp_config.json`
Claude Desktop	Supported	generated `claude_desktop_config.json`
Generic MCP clients	Supported	inline MCP gateway
CI	Supported	CLI policy checks

More detail: RUNTIMES.md

Audit First

If you want to inspect before enabling:

./bin/runwall audit .
./bin/runwall audit . --format html --output runwall-audit.html
./bin/runwall audit . --format sarif --output runwall-audit.sarif

Troubleshooting

Claude plugin says `failed to load`

Run:

claude plugin uninstall runwall@runwall
claude plugin marketplace remove runwall
claude plugin marketplace add efij/secure-claude-code
claude plugin install runwall@runwall
claude plugin list

You want:

Status: enabled

If GitHub still serves an older broken marketplace state, install from a local checkout until the fix is pushed:

cd ..
git clone https://github.com/efij/secure-claude-code.git
claude plugin marketplace add ./secure-claude-code
claude plugin install runwall@runwall

CI is failing

Run the local smoke checks:

bash tests/smoke.sh

If you only want the quick sanity path:

bash -n bin/shield install.sh update.sh uninstall.sh hooks/lib/patterns.sh tests/smoke.sh
python3 -m py_compile scripts/runwall_tools.py
./bin/runwall generate-plugin-hooks balanced /tmp/runwall-hooks.json
claude plugin validate .

Install Methods

More install options

macOS / Linux bootstrap

curl -fsSL https://raw.githubusercontent.com/efij/secure-claude-code/main/scripts/bootstrap.sh | bash -s -- --repo efij/secure-claude-code --ref main --profile balanced

Windows bootstrap

irm https://raw.githubusercontent.com/efij/secure-claude-code/main/scripts/bootstrap.ps1 | iex; Install-Runwall -Repo "efij/secure-claude-code" -Ref "main" -Profile "balanced"

Thin compatibility wrappers

install.sh
update.sh
uninstall.sh

They forward to ./bin/runwall.

Project Docs

GUARDS.md: guard inventory
RUNTIMES.md: runtime adapters
SECURITY_MODEL.md: model and assumptions
CHANGELOG.md: release notes
CONTRIBUTING.md: contributor notes

License

MIT