Claude Code

Why it's ranked here

The ranking rests on adoption surface and operational seriousness rather than openness. This repository carries the machinery of a project being actively run, not merely published: automated issue-tracker hygiene with sensible human overrides, and vulnerability reports routed into a bug bounty program. The plugin marketplace, the fleet-deployment templates, and the guarantee that managed settings outrank anything a user sets are exactly the layer an organization needs before putting an autonomous agent on engineers' machines. The proprietary license is the cost attached to all of it.

What's good

The enterprise controls are concrete rather than aspirational. A ready-made strict settings example disables the permission bypass mode, forces shell commands through an approval prompt, denies web access, and restricts hooks and permission rules to managed sources: an administrator can paste it and get a locked-down agent, then relax from there. The bundled development container drops all network traffic by default, allows only a short hard-coded list of hosts, and verifies itself by trying to reach an outside site and failing if that succeeds. The plugin format is legible: a directory, one manifest, and markdown.

Tradeoffs

The license is proprietary, all rights reserved, and the agent this repository configures arrives as an installed binary, so you cannot read or audit the thing you are adopting, only its configuration surface. The hook layer deliberately fails open: any error while evaluating a rule lets the tool call through instead of blocking it. Rule pattern matching is always case-insensitive with no way to opt out, and only a bare asterisk works as a wildcard when matching tools. The fleet-deployment templates carry their own warning that they are community-maintained and may be unsupported or incorrect.

How to use it well

Treat hooks as guidance and the permission system as the enforcement boundary: put anything you actually need blocked in the deny rules, because a rule engine that never fails closed will not hold. Start from the strict settings example and loosen it, rather than starting permissive. If you run a fleet, deploy settings through device management, where managed configuration sits at the top of the precedence order and users cannot override it. For unattended runs, use the bundled container and add your own package hosts to its firewall allowlist, since the default list covers only a handful of vendors.

Observed

License

Proprietary: all rights reserved by Anthropic, subject to its commercial terms of service

Source availability

The repository gives installation instructions only, with no build steps for the CLI itself; its contents are plugins, examples, scripts and CI configuration

Runtime requirement

Node.js 18 or newer

Installation

Install script, Homebrew, PowerShell or WinGet; the npm package is deprecated

Bundled plugins

13 plugins declared in the built-in marketplace, including code review, feature development, hook tooling and security guidance

Hook events supported

PreToolUse, PostToolUse, Stop and UserPromptSubmit, each with a ten second timeout

Plugin dependencies

The hook plugin requires Python 3.7 or newer and states it has no external dependencies