claude-code-hooks

0xDarkMatter's avatarfrom 0xDarkMatter

Claude Code hook system for pre/post tool execution. Triggers on: hooks, PreToolUse, PostToolUse, hook script, tool validation, audit logging.

⭐3stars🔀0forks📁View on GitHub🕐Updated Dec 27, 2025
[Guardrails and Safety]

When & Why to Use This Skill

The Claude Code Hooks skill provides a robust event-driven framework for the Claude Code CLI, allowing developers to execute custom scripts before and after tool invocations. This system serves as a critical infrastructure layer for implementing security guardrails, validating tool inputs in real-time, and maintaining comprehensive audit logs of agent activities. By leveraging triggers like PreToolUse and PostToolUse, users can ensure that AI-driven actions align with project safety standards and operational requirements.

Use Cases

  • Input Validation & Security: Automatically intercept and block dangerous shell commands or unauthorized file writes by validating tool arguments against a predefined security policy before execution.
  • Comprehensive Audit Logging: Record every tool interaction, including inputs and outputs, to external logging systems or databases for compliance monitoring and post-incident analysis.
  • Custom Approval Workflows: Integrate with communication platforms like Slack to trigger manual human-in-the-loop approvals during 'PermissionRequest' events for sensitive operations.
  • Session & Environment Setup: Use 'SessionStart' hooks to automatically initialize project environments, verify dependencies, or inject specific context before the agent starts a task.
nameclaude-code-hooks
description"Claude Code hook system for pre/post tool execution. Triggers on: hooks, PreToolUse, PostToolUse, hook script, tool validation, audit logging."
compatibility"Claude Code CLI with settings.json support"
allowed-tools"Bash Read Write"
depends-on[]
related-skills[claude-code-debug, claude-code-headless]

Claude Code Hooks

Execute custom scripts before/after Claude Code tool invocations.

Quick Reference

Event When Has Matcher
PreToolUse Before tool execution Yes
PostToolUse After tool completes Yes
PermissionRequest Permission dialog shown Yes
Notification Notifications sent Yes
UserPromptSubmit User submits prompt No
Stop Agent finishes No
SubagentStop Subagent finishes No
PreCompact Before context compaction No
SessionStart Session begins/resumes No
SessionEnd Session ends No

Basic Configuration

Add to ~/.claude/settings.json or .claude/settings.local.json:

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{
        "type": "command",
        "command": "$CLAUDE_PROJECT_DIR/hooks/validate.sh",
        "timeout": 5000
      }]
    }]
  }
}

Matcher Patterns

Pattern Matches
"Write" Only Write tool
"*" or "" All tools
"mcp__*" All MCP tools
"Bash" Bash commands

Hook Script Requirements

#!/bin/bash
# Receives JSON via stdin: { "tool_name": "...", "tool_input": {...} }
INPUT=$(cat)
TOOL=$(echo "$INPUT" | jq -r '.tool_name')

# Exit codes:
# 0 = Success (continue)
# 2 = Block with error (stderr shown to Claude)
# Other = Non-blocking error

Common Use Cases

Use Case Event Example
Validate inputs PreToolUse Block dangerous commands
Audit logging PostToolUse Log all tool usage
Custom approval PermissionRequest Slack notification
Session init SessionStart Load project context

Security Checklist

  • Quote all variables: "$VAR" not $VAR
  • Validate paths (no .. traversal)
  • Use $CLAUDE_PROJECT_DIR for paths
  • Set reasonable timeouts
  • Handle jq parsing errors

Troubleshooting

# Debug hook loading
claude --debug

# List registered hooks
/hooks

# Test script manually
echo '{"tool_name":"Bash"}' | ./hooks/validate.sh

Official Documentation

Additional Resources

  • ./references/hook-events.md - All events with input/output schemas
  • ./references/configuration.md - Advanced config patterns
  • ./references/security-patterns.md - Production security

See Also: claude-code-debug for troubleshooting, claude-code-headless for CLI automation