Use this whenever the user runs /reflex:reflex-add or describes a single new reflex rule in words ("block reads of X", "remind me when editing Y", "pause before running Z"). Translates the description into a reflex.json entry and appends it after user confirmation.
Use this whenever the user runs /reflex:reflex-init or asks to set up, seed, bootstrap, or extend reflex rules for the current project. Proposes a handful of candidate rules for .reflex/reflex.json based on what the project appears to care about, then lets the user pick which to keep.
Hook-based guardrails and prompt injection for Claude Code.
Catch the agent before it reads the wrong file, edits the wrong spec, or runs the wrong command — with a rule you wrote in 10 seconds.
/plugin marketplace add alumkal/claude-reflex
/plugin install reflex
Run /reflex:reflex-init in your codebase to get started.
Claude is fast, confident, and occasionally wrong. You already know the patterns you keep having to correct — reading .env, rewriting your spec doc, re-running rm -rf. Encode that knowledge once, have it applied every time.
{
"name": "disallow-read-env",
"on": "read",
"pattern": ".*\\.env",
"action": "reject",
"message": "DO NOT read .env directly!"
}
Now the agent can't read .env. It sees your message instead.
| Action | What happens |
|---|---|
proceed | Allow the call, append your message to the agent's context. Nudge. |
pause | Block once with your message. If the agent repeats the exact same call, it goes through. Confirm. |
reject | Block the call outright with your message. Hard stop. |
Matches run on file paths (Read, Edit, Write, NotebookEdit) or command strings (Bash). Rules live in .reflex/reflex.json — check it in, share it with your team.
Once installed, bootstrap your rules from inside Claude Code:
/reflex:reflex-init — scans your project, proposes up to 5 candidate rules for you to pick./reflex:reflex-add <sentence> — "pause me before I run rm -rf" → rule, appended.{
"name": "before-commit",
"description": "Double-check staging before committing",
"on": "bash",
"pattern": ".*git commit.*",
"action": "pause",
"message": "Run `git status` first to make sure no junk is staged."
}
First git commit: blocked, reminder shown. Claude checks git status, then retries the exact same commit → goes through.
Because CLAUDE.md is a suggestion. Reflex is a tripwire.
CLAUDE.md gets skimmed, forgotten, or de-prioritized as the context fills up.CLAUDE.md cannot stop rm -rf. A reject rule can.CLAUDE.md can't express.CLAUDE.md costs you those tokens on every turn.CLAUDE.md stuffed with defensive rules is noise when you're reading it and noise when the agent is parsing it. Reflex hides the rules until they matter, so CLAUDE.md stays a document you actually want to read.Use CLAUDE.md for how we work. Use reflex for what must not happen.
One PreToolUse hook, ~200 lines of stdlib Python. It full-matches your regex against the path or command, and the most restrictive matching action wins (reject > pause > proceed). Pause state lives in $CLAUDE_PLUGIN_DATA, capped at 256 entries per project. Malformed reflex.json logs a warning and gets out of the way — your agent never freezes.
See reflex-format.md for the full schema, capture-group substitution (\1, \g<name>), and more examples.
Python 3.10–3.14. No third-party deps.
Executes bash commands
Hook triggers when Bash tool is used
Modifies files
Hook triggers on file write and edit operations
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
npx claudepluginhub alumkal/claude-reflex --plugin reflexCreate custom behavioral rules through markdown configuration files - prevent unwanted behaviors with pattern matching
Block destructive git and filesystem commands before execution
Smart command safety filter for Claude Code — parses shell pipelines and evaluates per-command safety rules to auto-approve safe commands and block dangerous ones
Safety hooks to block or require user approval for dangerous commands (rm, git operations, .env access, file size limits)
5 essential safety hooks for Claude Code. Blocks rm -rf, force-push, hard-reset, .env overwrites, and package publish. The minimum viable safety net from 800+ hours of autonomous operation.
LLM-powered guardrails for Claude Code. Turn every AI mistake into a rule AI can't repeat.