Darkhunt Guard — Claude Code

Full session trace capture and PreToolUse guardrails for Claude Code.

Capture is on by default. Enforcement ships off and is enabled per rule.

Install

/plugin marketplace add darkhunt-security/darkhunt
/plugin install darkhunt-guard@darkhunt
/darkhunt-guard:setup

/darkhunt-guard:setup needs one thing — a Darkhunt API key — and it will not ask you to paste it into the agent. It picks up the key darkhunt-cli enroll already stored, or DARKHUNT_API_KEY from your shell, and discovers the tenant, workspace and application from it. Then it shows you where sessions will be sent, so you can confirm before anything ships.

Capture starts on your next Claude Code session — hooks are loaded when a session starts.

Upgrade

/plugin marketplace update darkhunt
/plugin update darkhunt-guard@darkhunt

The new version loads on your next Claude Code session. /darkhunt-guard:status prints the version actually running, which is the only reliable answer: an update that resolved against a registry without the new version reports success and changes nothing.

What it captures

The session transcript, mapped to spans: user and assistant messages, thinking blocks, tool calls paired with their results, token usage, attachment metadata (never the bytes), and every Task's own transcript — a subagent writes a separate file that no hook names, grouped under the session that spawned it and labelled with the agent.

Reading the transcript rather than instrumenting the agent is what makes this complete: there is no code path in Claude Code we could have missed.

What it enforces

A PreToolUse hook evaluates each tool call against a policy bundle before it runs, and can allow, deny, ask, or rewrite the input.

Two rules constrain it, both deliberate:

• Bash and command-string rules are advisory — they are recorded, never blocking. Matching a shell string is bypassable, so blocking on it would offer a guarantee it cannot keep.
• The guard fails closed. If policy cannot be evaluated, the call is denied. An install that has never been configured is not a failure and is allowed — there is no policy to bypass yet.

Commands

| | | | -------------------------- | ----------------------------------------------------------------------------------- | | /darkhunt-guard:setup | Connect this machine. Re-runnable; shows current state first. | | /darkhunt-guard:status | Is capture actually working? Routing, hook activity, shipping lag. | | /darkhunt-guard:backfill | Import Claude Code sessions from before this machine was connected. Dry-runs first. |

Both lanes fail silently by design — correct for the agent, unhelpful for whoever operates it — so status is where the truth lives.

Privacy

Session content leaves your machine and is sent to the Darkhunt tenant you enrolled against. status prints that destination; read it before you rely on it.

Hooks never touch the network. Shipping happens in a detached forwarder off a local spool, so nothing in the capture lane can block or slow a tool call.

Configuration

~/.darkhunt/endpoint-config.json, mode 0600, written by setup. One file for every endpoint, with per-endpoint overrides under endpoints.<vendor>.

Turn everything off with "enabled": false. Turn off capture but keep enforcement with "capture": { "enabled": false }.

github.com/darkhunt-security/endpoint-plugins · [email protected]