claude-seatbelt

Run Claude Code in --dangerously-skip-permissions mode without the "dangerously" part.

YOLO mode is the fastest way to work with an AI coding agent - it stops asking before every command and just goes. The catch is that "just goes" also applies to the two commands you can never take back:

• wiping a database (DROP TABLE, TRUNCATE, DELETE with no WHERE, db.dropDatabase(), FLUSHALL, ...)
• committing a secret (an API key or private key slipping into git)

These guardrails let the agent keep full speed everywhere it is safe, and pause for a one-key confirmation only where a mistake is permanent. Nothing else changes.

> agent decides to "clean up test data"
  psql $DATABASE_URL -c "DELETE FROM users"

  ⚠  Guardrails: this command can IRREVERSIBLY destroy data (DELETE FROM without WHERE).
     No undo, no rebuild path. Confirm manually if this is intentional.   [y/N]

Zero dependencies, one file per guard, works on macOS / Linux / Windows.

Install

From the root of your project:

npx claude-seatbelt

That copies two hooks into .claude/seatbelt/, registers the database guard in .claude/settings.json, and installs the secret-scan git pre-commit hook. It is idempotent - run it again any time, it never clobbers an existing pre-commit hook. Commit .claude/ and your whole team is covered.

What you get

1. Database delete guard (db-delete-guard.mjs)

A Claude Code PreToolUse hook. It inspects every Bash / PowerShell command before it runs and forces a confirmation prompt only when the command would irreversibly destroy data. In every other case the command runs untouched - even in bypass mode.

Guarded by default:

| Engine | Caught | |---|---| | SQL | DROP DATABASE/SCHEMA/TABLE/INDEX, TRUNCATE, DELETE/UPDATE without WHERE | | MongoDB | dropDatabase(), .drop(), deleteMany({}) / remove({}) | | Redis | FLUSHALL, FLUSHDB | | Migrations | alembic downgrade base, prisma migrate reset, manage.py flush |

It is deliberately narrow. A confirmation prompt only means something if it is rare - a guard that fires on routine work gets approved on reflex, and reflex is not a safety mechanism. So filesystem and infra teardown are off by default and opt-in (below).

2. Secret scan (secret-scan.mjs)

A cross-platform git pre-commit hook. It scans your staged changes and blocks the commit if a credential is about to land in git - AWS / Google / GitHub / Slack / Stripe / OpenAI / Anthropic keys, private-key blocks, and generic long api_key = ... assignments. Placeholders (<YOUR_KEY>, ${VAR}, example, ...) are ignored.

If a matched value is already in git history, the commit is not the leak - the hook warns and lets it through, and tells you the real fix (rotate the credential).

Configure

Optional .seatbelt.json in your project root:

{
  "dbDelete": {
    "filesystem": true,
    "infra": false,
    "extraPatterns": ["\\bmy-prod-cli\\s+wipe\\b"]
  }
}

• filesystem - also prompt on rm -rf, Remove-Item -Recurse, git clean -f, git reset --hard.
• infra - also prompt on terraform destroy, kubectl delete, docker system prune, aws s3 rb --force.
• extraPatterns - your own regexes (case-insensitive) for commands specific to your stack.

Catch your own secrets

The format patterns catch well-known token shapes. To also catch your specific values (a legacy token that does not match any public format, a customer key), point the scanner at a git-ignored file:

export SEATBELT_SECRETS_FILE=.secrets-denylist   # one NAME=value (or value) per line

The values are read from that git-ignored file at commit time and scanned for literally - they are never embedded in the tracked hook.

Manual setup

Prefer to wire it by hand? Copy hooks/ where you like and:

• add the block in examples/settings.json to your .claude/settings.json
• add node "$(git rev-parse --show-toplevel)/.claude/seatbelt/secret-scan.mjs" to your pre-commit hook

Design notes

• Fails open. A bug in a guard must never wedge your session or block a legitimate commit, so on any internal error both guards get out of the way (the DB guard exits clean, the commit proceeds). The guards reduce risk; they are not a vault.
• No network, no telemetry, no dependencies. Two small .mjs files you can read in full in two minutes.
• Not a replacement for backups or least-privilege database roles. It is the seatbelt, not the airbag.

Who made this

Built and battle-tested by ScrapeUnblocker - we run fleets of autonomous coding and ops agents in bypass mode every day, and these are two of the guards that let us sleep. Open-sourced because everyone running an agent unattended needs them.

License

MIT