AI Install Guard

A Claude Code mod that steps in when you or Claude install a plugin, skill, marketplace or MCP server. It fetches the exact version, reads every file without running any of it, and holds the install until you approve. Install it once: nothing to run, nothing to remember.

/plugin install ai-install-guard --marketplace ziniman/ai-install-guard

To update it, refresh its marketplace first, since the plugin's update is looked up there, then run /reload-plugins:

claude plugin marketplace update ai-install-guard
claude plugin update ai-install-guard@ai-install-guard

What it does

Everything you add to Claude Code runs with your permissions: a plugin's hooks run every session, an MCP server can download and launch a package, a skill can carry hidden instructions. Checking it is usually a separate step you have to remember, and it never sees what Claude installs by itself.

AI Install Guard lives inside Claude Code instead. When something new is about to be added, it fetches the exact version, reads every file without running any of it, and holds it until you press Install or Reject.

• Automatic. No command to run first: from the moment it is installed, it is in the way of every install.
• It catches Claude too. A plugin, marketplace or MCP server Claude installs on its own is checked like one you install, and waits for you.
• Pinned. A verdict belongs to one commit and content hash, and only that version installs.
• Local and open. No account or server, and every check is in this repository.

It holds /plugin install and /plugin marketplace add, and, when Claude does them: claude plugin install, claude plugin marketplace add, claude mcp add, and an MCP server it writes into your configuration. What arrives another way is checked before it first runs: a mod that loads with files you never approved (picked from the /plugin menu, updated on its own, changed in place) is kept off until you approve it, and a skill that came with no install (from a repository you cloned, copied in by hand) is checked as it is first used. A plugin that is on but new or changed since the guard last looked (updated on its own, installed from a terminal) is checked as a session starts, as are the MCP servers in your configuration (brought by a git pull, written by another program's installer). A plugin picked from the menu is not scanned before it installs, so type /plugin install <name>@<marketplace> instead. Where it steps in has every case.

Using it

Install plugins as you always do. The guard answers with a verdict in its pane:

• No red flags: nothing suspicious. The "It can" line says what it would be able to do, so you can judge whether that fits.
• Worth a look: something specific deserves a look first.
• Do not install: a red flag. Installing it anyway asks twice.
• Could not verify: the guard could not tell what would be installed. Installing it anyway asks twice.

Press Install (i) or Reject (r). When it holds a command Claude ran, approve it in the pane, then tell Claude to run it again.

To check something before you install it anywhere:

| Command | What it does | |---------|--------------| | /guard scan <folder or repository> | Scan it without installing it | | /guard report | Reopen the last report | | /guard list | Your approved and rejected versions | | /guard held | The mods kept from loading, and the plugins and configuration that wait for your decision | | /guard forget <name> | Forget a decision, so it is judged again |

The same scanner also runs in Claude chat, as a skill: Use it in Claude chat. For everything else, see How it works, Commands and the pane and the rest of the documentation.

Review badge

If you publish a plugin, scan your repository and run /guard badge for a badge that names the verdict and the exact content scanned. A badge is a picture anyone can paste, so the guard never trusts one: to know, scan the repository yourself. See Review badge.

What the guard itself can do

A security tool should be held to its own rules. Everything this mod uses, as claude plugin validate . lists it:

| Capability | Why | |------------|-----| | process.run | Runs git to fetch the exact commit being scanned into its own temporary folder, the claude command to validate a candidate, to find where a plugin comes from and to list the plugins that are on, readlink to see where a link points, and printenv to find your home folder. It never runs anything from a candidate. | | fs.read, fs.list, fs.stat | Reads the files it scans, an MCP configuration Claude is about to write, and, as a session starts, the MCP servers in your configuration. It writes no files itself. | | command.run | Intercepts /plugin to hold an install, and runs your own /plugin command again once you approve it, or /plugin disable when you turn off a plugin it found on. Sees every other slash command too, to check a skill or command by that name before it runs, and answers only one it holds. | | tool.call | Reads each shell command Claude is about to run for an install, and each file it writes for an MCP server added to your configuration, and refuses those until you approve. Checks each skill Claude is about to run the same way, and refuses the tools of an MCP server you rejected. Every other command and file goes on untouched. | | classic.CwdChanged | Notes the folder Claude's shell commands run in, so a skill in that folder's .claude is checked too. | | plugin.register | Checks each mod Claude Code is about to load, and keeps out one whose files are not a version you approved. | | skill.prompt | Checks a skill that came with no install (yours, a repository's) again as its instructions load, for one found where the slash command and the Skill tool did not look, and holds one with a red flag until you approve it. | | http.fetch | Reads a GitHub repository's public details (age, stars, whether the commit is signed) and, only if you turn them on, the outside lookups. | | store, state, ui, command.register | Remembers your decisions, draws the pane, and adds the /guard command. |

Every detail is in What the guard itself can do, and what it cannot promise is in What it is not.

Uninstall

/plugin uninstall ai-install-guard@ai-install-guard

To turn it off for a while, use /plugin disable ai-install-guard@ai-install-guard. The guard fails closed, so a bug could hold something that should have gone through. If it ever gets in your way, turn it off from a terminal outside Claude Code, where it sees nothing, and open an issue:

claude plugin disable ai-install-guard@ai-install-guard

More, including your stored decisions and installs for one project only: Uninstall and troubleshooting.

Status

Early development. The gates above work today; next, an update shows what changed since the version you approved, and an optional model review can add warnings. See the roadmap.

Contributing

Issues and pull requests are welcome. See CONTRIBUTING.md.

License

Apache 2.0, see LICENSE.