aguard

Local, offline security scan for AI agent setups — an "antivirus for your Claude Code configuration". It audits everything an agent auto-loads (skills, MCP servers, hooks, permission grants, subagents, slash commands, instruction files) and reports what carries risk.

It never executes what it scans and makes no network calls of its own. Scanning is read-only; the one command that writes (clean) only ever moves things inside your config root.

Use it

No install needed — the binary ships inside the package, so there is no install script and nothing is downloaded when you install it:

# vet one skill, plugin or zip BEFORE it reaches a directory an agent loads from
npx --yes @bas.io/guard@latest check ./some-skill

# audit everything the agent on this machine auto-loads
npx --yes @bas.io/guard@latest scan --report

check answers about the thing you point it at, so it means the same wherever you run it. scan answers about the machine it runs on — on your own computer that is your real ~/.claude, which is the point; in a hosted session or a CI container it describes that container instead, and the report prints a banner saying so rather than letting a near-empty box score close to 100 unremarked.

Keep it around for repeated use, and for the load-time gate:

npm i -g @bas.io/guard

aguard check ./some-skill     # vet one skill/plugin/zip before installing it
aguard scan --report          # audit this machine's ~/.claude + write an HTML report
aguard clean                  # list duplicate, bloated and stale skills (report-only)
aguard version

Exit codes: 0 below threshold · 1 a finding at or above --fail-on · 2 runtime error (the scan did not happen — never read a 2 as a pass) · 3 clean acted partially. A run cut short by a signal ends as 128 + signal, like any Unix program: 130 for Ctrl-C, 141 when the output pipe is closed (aguard scan | head). Anything non-zero that is not 1 or 3 means you did not get a verdict.

The load-time gate needs a stable path

aguard hook install registers the absolute path of the binary it was run from, so Claude Code can call it before each skill loads. Do not install the gate from an npx invocation: that path lives in npm's temporary cache and is garbage-collected, after which the hook points at a file that no longer exists — every skill then loads unaudited while the setup still looks protected (the scan reports this as GATE-001). Install globally, or use a release binary, when you want the gate.

What it is, and is not

A static scanner: a relative risk signal, not a safety certificate. It cannot prove intent, observe what a program does at run time, read through an encrypted payload, or tell you what a remote MCP endpoint actually does. "No findings" means no findings from the static rules, which is worth reading as exactly that.

More

Full documentation, the rule reference (every finding ID it can print), the Claude Code plugin, and the platform binaries with checksums: https://github.com/basdotio/guard

MIT.