CodeFence

CodeFence is a Claude Code plugin that checks agent actions for common security risks. It can block dangerous commands, flag risky edits, and keep a local record of what it found.

What it checks

• Shell commands such as curl | bash, rm -rf /, credential reads, and environment dumps sent to the network.
• Secrets written to files, including API keys, database URLs with embedded credentials, and private keys. Findings redact the value.
• Prompt-injection language in repository files and user prompts.
• Common insecure-code patterns, including SQL string interpolation, eval(), disabled TLS verification, and weak password hashing.
• MCP, Claude Code, CI, and Docker configuration changes that broaden access or weaken safeguards.

Install

CodeFence uses Claude Code's plugin marketplace. You do not need a separate CLI, a pip install, or a .claude/skills symlink.

Runtime requirement

The hook runner needs Python 3.10 or later available as python on PATH. It uses the standard library and bundled JSON rules. It does not install packages, contact the network, or modify a project during setup.

From a clone, run this before installing:

python scripts/setup_check.py

Test a local checkout

claude --plugin-dir /path/to/codefence

This loads the plugin for the current Claude Code session.

Install from a checkout or GitHub

The repository includes its own marketplace manifest at .claude-plugin/marketplace.json.

# Local checkout
claude plugin marketplace add /path/to/codefence
claude plugin install codefence@codefence

# GitHub repository
claude plugin marketplace add pannagkumaar/codefence
claude plugin install codefence@codefence

The same commands work inside Claude Code with /plugin marketplace add and /plugin install. Use --scope project with marketplace add when the plugin should apply to one repository instead of every local project.

CodeFence is a new plugin identifier. Remove any earlier installation before installing codefence@codefence; project configuration now uses .codefence.json and local direct-run data lives in .codefence/.

Confirm the installation:

claude plugin list
claude plugin details codefence@codefence
claude plugin validate . --strict

The plugin exposes six hook event types and the security-reviewer agent. The hook runner loads the bundled source directly, so an editable install is not required.

Example results

CodeFence blocked this command: Downloads and executes remote code
without inspection or verification.
Safer alternative: Download the script, inspect it, verify its checksum or
signature, then run it explicitly if trusted.

CodeFence found 1 security issue in the file just edited:
CRITICAL Anthropic API key pattern detected in config.py.
Full report: CodeFence plugin data/reports/session-<hash>.md

CodeFence session summary: 1 command blocked, 2 file findings.
Review flagged items before committing. Session report:
CodeFence plugin data/reports/session-<hash>.md

Hook coverage

Claude Code event	CodeFence action
SessionStart	Creates local state and adds a short status note.
UserPromptSubmit	Flags prompts that request credential dumping, hook bypasses, or untrusted installs.
PreToolUse for Bash and PowerShell	Allows, asks about, or blocks commands based on risk and mode.
PreToolUse for Read	Protects credential-like files and checks supported text files for secrets and high-risk prompt injection before Claude reads them.
PreToolUse for Edit, Write, and NotebookEdit	Protects .env, private keys, .git/, .claude/, and .mcp.json.
PreToolUse for MCP tools	Flags write, delete, and credential-related calls.
PostToolBatch	Scans files edited in the completed batch, records shell actions, and writes one session report.
ConfigChange	Scans Claude Code settings and skill changes. In block mode, it can block critical findings.
Stop	Shows a short summary when the session produced findings.

Findings and command decisions are stored locally as JSON Lines in a project-specific directory under ${CLAUDE_PLUGIN_DATA}. Direct hook runs use .codefence/logs/. PostToolBatch writes an atomic, session-specific Markdown report beside those logs.

Configuration

Create .codefence.json in a project root to change enforcement:

{
  "mode": "warn",
  "max_inline_findings": 5,
  "allowlist": {
    "commands": ["npm test", "pytest"],
    "paths": ["tests/fixtures/fake_secrets.py"]
  },
  "protected_paths": [
    ".env",
    ".git/",
    ".aws/credentials",
    ".claude/settings.json",
    ".mcp.json"
  ],
  "rules": {
    "dangerous_commands": true,
    "secrets": true,
    "prompt_injection": true,
    "insecure_code": true,
    "mcp_config": true,
    "dependencies": true
  }
}

JSON is the default because it has no extra dependency. Existing .codefence.yml and .codefence.yaml files still work if PyYAML is installed with python -m pip install 'codefence[yaml]'.

• warn is the default. It blocks rules marked deny; other risky command rules are logged as warnings.
• ask keeps deny rules blocked and asks before rules marked ask run.
• block keeps deny rules blocked, denies high- and critical-risk rules, and asks before lower-risk rules run.

The modes are monotonic: choosing a stricter mode never weakens a baseline deny decision.

Text scanners also support these inline suppressions:

codefence: ignore                        # this file, all categories
codefence: ignore secrets                # this file, one category
codefence: ignore-next-line              # next line, all categories
codefence: ignore-next-line insecure-code # next line, one category

Safety and limits

CodeFence runs locally. It sends no telemetry or repository data to an external service. It treats repository content as untrusted input and fails open if an internal error occurs, so a broken check does not interrupt Claude Code. It writes only its logs, reports, and session state; it does not change project source or configuration files.

Claude Code does not fire PreToolUse hooks for @ file references in a prompt, so CodeFence cannot preflight those reads. Use Claude Code's normal review controls for that path.

Detection is based on regexes and heuristics. It is not an AST parser, taint tracker, or replacement for a full SAST or SCA tool. See docs/LIMITATIONS.md for details and SECURITY.md for the security policy.

Documentation

• docs/ARCHITECTURE.md: hook and scanner design
• docs/CLAUDE_CODE_INTEGRATION.md: installation and hook map
• docs/DEMO.md: direct hook-runner examples
• docs/THREAT_MODEL.md: covered risks and boundaries
• docs/RULE_AUTHORING.md: rule format and tests
• docs/ROADMAP.md: scope and future work

Contributing

Most detections live in codefence/rules/*.json. Keep new scanners local, use fake secrets in tests, add focused tests, and run python -m pytest -q before opening a pull request.