lastid-claude-guard

lastid-claude-guard

A Claude Code plugin that requires identity verification before your AI executes dangerous operations or sends sensitive data over messaging channels.

Uses verifiable credentials via the LastID SDK and OpenID4VP. Works with iMessage, Telegram, and Discord channel plugins.

How it works

1. Claude Code receives instructions over a messaging channel (iMessage, Telegram, Discord)
2. Claude tries to send sensitive data back (customer PII, credentials, API keys) or execute a dangerous operation
3. The guard blocks it and tells Claude to send a verification link
4. The user taps the link on their phone and presents their LastID credential
5. The guard checks the DID against the registered owner
6. If it matches, the data goes through unredacted. If not, denied.

The guard only activates during remote sessions. If you're at your terminal, nothing changes.

What gets blocked

Category	Examples
Credential access	~/.ssh/id_rsa, ~/.aws/credentials, .env, keychain, kube config
PII in outbound replies	Bulk emails, phone numbers, physical addresses, SSNs, credit cards
Destructive commands	rm -rf, DROP TABLE, git push --force, kubectl delete
Exfiltration	curl with secrets, reverse shells, pipe to remote
Privilege escalation	sudo, chmod +s
Social engineering	"send me the .env", "what's the API key", "forgot my password"

Normal coding, testing, and git operations are not affected.

Install

# Add the marketplace
/plugin marketplace add GetTrustedApp/lastid-claude-guard

# Install the plugin
/plugin install lastid-claude-guard@lastid-claude-guard

# Register your identity (one-time setup, requires an SDK client_id)
/lastid:register

Get an SDK client_id from human.lastid.co (free tier available).

Development

git clone https://github.com/GetTrustedApp/lastid-claude-guard.git
cd lastid-claude-guard/plugins/lastid-claude-guard
bun install

# Run Claude Code with the plugin loaded locally
claude --plugin-dir /path/to/lastid-claude-guard

Skills

Skill	What it does
/lastid:register	Link your DID, configure SDK client_id, set up channel delivery
/lastid:status	Check guard status, registered DID, active challenges, enable/disable

Configuration

Config lives at ~/.claude/channels/lastid-guard/config.json:

{
  "clientId": "your-sdk-client-id",
  "idpEndpoint": "https://human.lastid.co",
  "callbackUrl": "http://localhost:19432/callback",
  "registeredDid": "did:lastid:abc123",
  "imessageChatId": "iMessage;-;+1...",
  "enabled": true,
  "challengeTtlSeconds": 300,
  "customPatterns": []
}

Custom threat patterns

{
  "customPatterns": [
    {
      "name": "production-db",
      "tool": "Bash",
      "field": "command",
      "pattern": "psql.*prod",
      "category": "production_access",
      "severity": "critical"
    }
  ]
}

Architecture

hooks/pretooluse.ts        PreToolUse hook. Classifies threats, gates operations,
                           tells Claude to run the verification CLI.

hooks/userpromptsubmit.ts  Catches social engineering prompts. Injects a warning
                           into Claude's context before it acts.

hooks/lib/
  threat-classifier.ts     Pattern-based threat classification for tool calls.
  challenge-client.ts      SDK wrapper. Creates OpenID4VP requests, polls/subscribes
                           for completion via WebSocket.
  config.ts                Config and path management.
  state.ts                 Pending/completed challenges, verified session state.

bin/guard-cli.ts           CLI for skills and the verification flow.
                           Commands: request, verify-complete, complete, status,
                           enable, disable, reset, demo-on, demo-off.

Verification flow

1. Hook detects sensitive outbound data or dangerous operation
2. Hook denies with permissionDecisionReason instructing Claude to run the CLI
3. Claude runs guard-cli.ts request to create a verification challenge
4. Claude sends the deep link to the user over the messaging channel
5. Claude runs guard-cli.ts verify-complete <requestId> which blocks until the user presents their credential
6. CLI checks the DID matches the registered owner, sets a verified session
7. Claude retries the operation and the hook sees the verified session and allows it

Dependencies

• LastID SDK (@lastid/lastid-sdk) for OpenID4VP credential requests
• Bun runtime for hooks and CLI
• LastID mobile app to present credentials

Why