Claudia

Why it's ranked here

The credential blocker is the real asset. It checks every file edit against fourteen patterns, from cloud access keys and personal access tokens to database connection strings with embedded passwords, and refuses the write rather than just warning. That behaviour has its own test suite covering each pattern, the file exemptions, repeat hits and malformed input. MIT licensed, a single install command, and a clear per-level switch for how chatty it gets. The coaching half is lighter: fixed phrase lists aimed at beginners.

What's good

Blocking is used sparingly and on purpose: credentials stop the write, while style and accessibility checks only warn. Prompt coaching is capped at three nudges per session and ignores slash commands, so it cannot take over a conversation. The turn-end behaviours run in a single process in a fixed order and only one speaks per turn, which keeps noise down. Users can silence specific topics or whole behaviours in a config file, and the contributing guide forbids network calls in any hook.

Tradeoffs

The credential check exempts any file whose full path contains words like test, spec, mock or fixture as plain substrings, so a folder named inspector or latest skips scanning entirely. It also remembers each file and secret type per session and lets the second identical attempt through, so a retried write succeeds. Coaching matches a short list of exact phrases, which catches only the vaguest prompts. Every hook needs Python 3 on the machine, and the npm package and plugin manifest declare different version numbers.

How to use it well

Fits people new to Claude Code, or teams who want a local backstop against committing keys. Start at the default moderate level, which acts on security and major anti-patterns, and raise it to high only if you want vague-prompt coaching. Keep real config files out of paths containing the exempt words, and treat the block as a first line, not a replacement for a proper secret scanner in CI. Experienced users will likely want to mute milestones and next-step suggestions.

Observed

License

MIT (LICENSE)

Distribution

npm package with a postinstall script (package.json)

Interface

Claude Code plugin: slash commands, skills and hooks (.claude-plugin/plugin.json, hooks/hooks.json)

Hook language

Python 3 scripts invoked via python3 (hooks/hooks.json)

Secret blocking

14 regex patterns, exit code 2 blocks the write (hooks/scripts/check-secrets.py)

Tests

pytest suite configured in pyproject.toml, including tests/test_check_secrets.py

Default proactivity

moderate (config/defaults.json)