az-brake

A Claude Code plugin that asks before Claude runs an Azure CLI command that creates or starts a resource that costs money.

It only guards commands Claude runs. It does not guard the Azure portal, Terraform, scheduled jobs, or you typing in a terminal. And it reads command text, so it catches well-known shapes, not everything. It is a speed bump, not a security boundary.

Why this matters

Azure bills for what exists and what runs, and the controls are mostly after the fact: a budget alert is an email, it does not stop anything. A coding agent can create a database, a cluster or a VM in one line. This asks you first, and names the resource.

What it asks about

Everything else (reads, list, show, deletes, --help, resource groups, virtual networks, az login) runs without a prompt, because a hook that asks too often gets turned off.

• Creating resources that bill: virtual machines and scale sets, disks and snapshots, storage accounts, AKS clusters and node pools, container registries, SQL databases, managed instances, elastic pools and dedicated pools, PostgreSQL and MySQL flexible servers, Cosmos DB, Redis, container apps and instances, web apps, function apps, App Service plans, Synapse, Data Factory, Event Hubs, Service Bus, AI Search, Azure AI services, Databricks workspaces, Log Analytics, Application Insights, public IPs, gateways, firewalls, NAT gateways, load balancers, Bastion, private endpoints, API Management, Front Door and CDN, and more (about 50 types, listed in src/classify.ts).
• Starting, scaling or resizing them: start, resume, scale, resize, aks nodepool add, and an update that changes a size or tier.
• Commands that can create anything: az deployment ... create, az stack ... create, az resource create, az rest --method put, az webapp up and az containerapp up. The prompt says it cannot see what a template contains. --what-if is not asked about.
• Not asked about on purpose: az group create and az sql server create (free), and data movement such as az storage blob upload-batch (each operation costs a tiny amount).

The prompt names each resource it can see: what it creates, its --name, and the size, SKU and location flags if present. In a chained command (a && b) every billable step is listed. It never shows a price, because the hook cannot see your rates or discounts.

Install

/plugin install az-brake --marketplace thisismairaj/az-brake

Nothing to configure. Needs Node 20 or newer on your PATH.

How it works

A PreToolUse hook on Bash|PowerShell (both, because on Windows without Git Bash only PowerShell exists). If a command looks like it can create or start a billable resource, the hook answers ask, and Claude Code shows its normal approval prompt. Any error inside the hook fails open: the command runs.

Tested live (headless claude -p, Claude Code on Windows)

• A az storage account create command is stopped by the hook in dontAsk and bypassPermissions modes. The command was pointed at a resource group that does not exist, so nothing could have been created if it had run.
• A free command (az group exists) is not stopped.
• 95 unit cases pass, and every command path in the table was checked against the installed Azure CLI (2.91.0) with az <path> -h. Ten of those paths come from Azure CLI extensions that the CLI offers to install on first use.

Headless mode cannot answer a prompt, so these runs show the hook fires and the command does not run. They do not show the interactive approval dialog.

Not verified yet

• The interactive approval dialog itself (approving a flagged command and seeing it run).
• The PowerShell tool path, and Git Bash vs PowerShell on a machine without Git.
• macOS and Linux (development was on Windows only).
• Commands wrapped in another shell, such as bash -c "az vm create ...", are not read.

Development

npm install
npm test        # 95 cases, runs the TypeScript directly
npm run build   # compiles src/ to dist/ (dist/ is committed so installs need no build)