Claude Code hooks for security
Hooks are commands Claude Code runs at set points, such as before a tool call. A hook can block the call and tell Claude why. Muzzle installs a set of security hooks in one click.
● Read(~/.ssh/id_ed25519)
⎿Muzzle blocked this: it reads your SSH key (~/.ssh/id_ed25519). To allow it, click Allow on this entry in Muzzle's Activity.
The hooks Muzzle adds
PreToolUseRuns before a tool call. Muzzle blocks commands, writes, fetches and MCP calls that would send a key or your details out, reads of credential files, and changes to its own settings.
FreePostToolUseRuns after a tool call. Muzzle flags instructions aimed at the agent in what came back.
ProSessionStartRuns when a session starts. Muzzle checks CLAUDE.md and other instruction files, and sessions started in Downloads, Desktop or your home folder.
ProQuestions
Can I keep my own hooks?
Yes. Muzzle adds its entries next to yours and takes out only its own when you switch it off. Type /hooks in Claude Code to see them.
Can Claude Code remove Muzzle's hooks?
No, while the settings lock is on (it is by default). It blocks the agent editing settings.json.
Does Codex have hooks?
Yes. Muzzle adds its checks to Codex on Pro. Type /hooks in Codex to turn them on.
Related
Put Muzzle between your agents and the internet
Download for Mac
Free · Apple Silicon · macOS 12 or later
Pro from $8/month, or free while you contribute to the Threat Feed