Claude Opus 4.7: Complete cc-safe-setup Security Hooks Configuration

One-sentence takeaway

cc-safe-setup provides 910 security hooks that can block Claude Code's destructive operations (such as rm -rf, force-pushes, and git reset --hard) after one-command installation, while surfacing silent failures at tool boundaries, making it suitable for production environments and team collaboration.

Use cases

• Suitable tasks:

  • Production code development (requiring strict security controls)

  • Team collaboration (preventing an Agent from accidentally modifying shared code)

  • Scenarios that require dangerous commands to be blocked (such as file deletion, force-pushes, and code resets)

  • Scenarios that require Token usage monitoring and budget management

  • Scenarios that require credential protection (preventing .env files from being modified)

• Unsuitable tasks:

  • Rapid prototyping (security restrictions may reduce speed)

  • Personal experimental projects (strict security controls are unnecessary)

• Applicable model version: Claude Opus 4.7

• Applicable client, Agent, or API: Claude Code CLI

• Recommended reasoning levels and parameters: high or xhigh (depending on task complexity)

Ready-to-use content

Installation methods

Method 1: One-command installation with npx (recommended)

npx github:yurukusa/cc-safe-setup

Method 2: Install as a Claude Code plugin

/plugin marketplace add yurukusa/cc-safe-setup
/plugin install safety-essentials@cc-safe-setup

Note: Do not use npx cc-safe-setup (the npm version), because the npm version remains at 29.8.0, while the current repository version is 30.0.4; 3 destructive commands are not blocked by the npm version.

Four core plugins

Hook types

cc-safe-setup installs the following types of hooks:

• PreToolUse: Blocks dangerous operations before tools execute

• PostToolUse: Checks for and surfaces silent failures after tools execute

• SessionStart: Initializes at the start of a session

• Stop: Cleans up when a session stops

• SubagentStop: Cleans up when a subagent stops

Installation process

The command is interactive:

1. Displays what each hook does

2. Lets you choose which hooks to install

3. Installs them in ~/.claude/settings.json (globally) or the project's local .claude/settings.json

4. Requires your confirmation for every installation

Custom hook example

You can write your own hooks:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "jq -e 'select(.tool_input.command | test(\"rm -rf\")) | error(\"rm -rf blocked\")' > /dev/null 2>&1"
          }
        ]
      }
    ]
  }
}

Security audits and CI

cc-safe-setup provides auditing features:

• --doctor: Checks the status of installed hooks

• --audit: Generates a security audit report

Team deployment

Rolling deployment to a team:

1. Commit .claude/settings.json to version control

2. Team members automatically inherit the security configuration after cloning the repository

3. Use --doctor to verify that all members' configurations are consistent

Important notes

Installed hooks do not update automatically:

• You need to run the update command manually

• Check the repository's CHANGELOG.md regularly

The npm version is behind:

• The npm version (29.8.0) blocks fewer commands than the current repository version (30.0.4)

• It is recommended to use npx github:yurukusa/cc-safe-setup instead of npx cc-safe-setup

Testing/workflow steps

1. Install cc-safe-setup:

   npx github:yurukusa/cc-safe-setup

2. Choose the hooks to install:

   • Select safety-essentials, git-protection, credential-guard, and token-guard according to the project's needs

3. Verify the installation:

   # Check whether the hooks are active
   cat ~/.claude/settings.json

4. Test the security protections:

   • Try to run rm -rf and confirm that it is blocked

   • Try to force-push and confirm that it is blocked

   • Try to modify .env and confirm that it is blocked

5. Update regularly:

   • Check for repository updates

   • Run the update command

6. Deploy to the team:

   • Commit .claude/settings.json to version control

   • Team members automatically inherit the configuration after cloning

Original evidence and data

• The repository contains 910 hooks

• The npm version 29.8.0 was released on 2026-04-20

• The current repository version is 30.0.4

• The npm version lets 3 destructive commands through, while the current version blocks them

• Provides 4 core plugins: safety-essentials, git-protection, credential-guard, and token-guard

• Supports multiple hook types: PreToolUse, PostToolUse, SessionStart, Stop, and SubagentStop

• Provides auditing tools: --doctor and --audit

• MIT license

Scope and limitations

• Requires a Claude Code CLI environment

• Hooks do not update automatically and require manual maintenance

• The npm version lags behind the repository version; using the GitHub version is recommended

• Some hooks may affect development speed (such as blocking rm -rf)

• Team deployment requires version-control support

Source excerpt or observation (short compliant quotation only)

The README emphasizes: "One command to add safety hooks to Claude Code. It installs a set of PreToolUse, PostToolUse, SessionStart, Stop, and SubagentStop hooks that stop destructive or irreversible operations before they run, and that surface silent failures."

"Why not npx cc-safe-setup? The npm release is stuck at 29.8.0 (2026-04-20) while this repository is at 30.0.4, and the gap is not cosmetic — 29.8.0 lets three destructive commands through that the current code blocks."