@interven/claude-code-hook

PreToolUse hook for Claude Code. Scans every tool call — Read, Write, Edit, Bash, Glob, Grep, WebFetch, MCP — through Interven before Claude Code executes it. Blocks .env reads, denies destructive shell commands, redacts secrets, and routes risky actions through human approval.

No Claude Code source changes. One config file edit, one env var, done.

Install

npm install -g @interven/claude-code-hook
# or use npx -y (no install needed, slower cold start)

Wire it up

Add to ~/.claude/settings.json (user-wide) or <repo>/.claude/settings.json (per-repo):

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "*",
        "hooks": [
          {
            "type": "command",
            "command": "npx -y @interven/claude-code-hook",
            "timeout": 10
          }
        ]
      }
    ]
  }
}

Set your Interven API key:

export INTERVEN_API_KEY=iv_live_xxxxxxxxxxxxxx

Next time Claude Code fires a tool, the hook runs against your Interven policies. Try reading .env — should be denied with the policy-defined reason.

What gets enforced

Depends on your Interven policies. A typical vibe-coder setup (from @interven/policy-packs → vibe-coder-starter.yaml):

• .env, **/secrets/**, *.pem, id_rsa, credentials.json — denied on read
• Destructive shell (rm -rf /, dd if=, mkfs, > /dev/sda) — denied
• git push to main — paused for approval
• Stripe/OpenAI/AWS/GitHub keys in tool args — sanitized in audit log

Customize the policies to your stack via the Interven console or the @interven/policy-cli YAML workflow.

Environment variables

| Variable | Default | Purpose | |---|---|---| | INTERVEN_API_KEY | (required) | Your iv_live_* key | | INTERVEN_GATEWAY | https://api.intervensecurity.com | Override for self-host | | INTERVEN_TIMEOUT_MS | 5000 | Per-scan timeout | | INTERVEN_FAIL_CLOSED | 0 (open) | Set to 1 to deny on hook error |

Decision mapping

| Interven decision | Claude Code response | Effect | |---|---|---| | ALLOW | decision: "approve" | Tool runs normally | | DENY | decision: "block" | Tool blocked, reason shown to Claude | | SANITIZE | decision: "approve" | Approved + scan logged for audit; sensitive fields are sanitized at the network layer if the tool then makes an HTTP call out | | REQUIRE_APPROVAL | decision: "block" | Blocked; approve at app.intervensecurity.com/approvals/<id>. Retry within 10 min hits the approval-grant window and auto-allows |

Behavior on failure

Default: fail-open — if Interven is unreachable, the hook approves the tool call and logs a warning to stderr. This keeps the developer loop unblocked during partial outages.

For environments where blocking on hook failure is preferred (regulated contexts):

export INTERVEN_FAIL_CLOSED=1

How it differs from @interven/copilot-hook

Same wire model (JSON in, JSON out), different agent. Use this package for Claude Code; use @interven/copilot-hook for GitHub Copilot Coding Agent. They share the underlying scan API and can be used together if your team uses both agents.

Source + issues

github.com/intervensecurity/claude-code-hook