hydra-package-gate

Hydra

An @enchanter-ai product — algorithm-driven, agent-managed, self-learning.

15 plugins (+ 1 meta-installer). 5 agents. 1,844 patterns. 8 algorithms. 98 CWEs. 20 attack databases. Zero dependencies.

Plugin count breakdown: 5 scanner plugins (each with a Sonnet/Haiku agent), 4 advisory hook plugins, 2 compliance plugins, 4 opt-in / post-filter plugins (capability-shield, egress-shield, reach-filter, state-integrity), and 1 meta-installer (full). Of the 16 directories under plugins/, the full plugin contains no logic of its own — it exists only to install the other 15 as dependencies.

Built from blood — every pattern traces back to a real CVE, a real breach, or a real research paper.

Clone a malicious repo. Open it in Claude Code.

Before you type a single command, config-shield has already flagged the hidden postinstall script in package.json, the API-key-stealing hook in .claude/settings.json, and the Unicode-obfuscated backdoor in .cursorrules.

You start coding. Hydra catches the PostgreSQL connection string on line 12, flags the pickle.loads() as CWE-502, spots the JWT signed with alg: "none", blocks the rm -rf /tmp/*, and quarantines a typosquatted npm package — all before you finish your coffee.

End of session: 6 secrets masked, 4 vulns mapped to CWEs, 1 command blocked, 2 phantom dependencies caught, 0 incidents. Dark-themed HTML report generated.

Total overhead: < 50ms per file write. You didn't notice it running.

TL;DR

In plain English: Your AI just typed an AWS key into a committed file, ran rm -rf ~/, and pip-installed a typosquatted package. Hydra blocks each one before it lands.

Technically: R1 Aho-Corasick pattern engine scans 1,844 patterns across 20 databases (310 secret patterns + 156 OWASP/CWE-mapped vulns + 105 dangerous-ops + more) on every Write/Edit; R2 Shannon entropy analysis catches high-entropy strings that evade regex; R4 Markov Action Classification classifies Bash subcommands and surfaces dangerous ops at PreToolUse via advisory injection (exit 0 + stderr per ../vis/packages/core/conduct/hooks.md). Every finding is keyed to a real CVE or CWE; no finding is fabricated from heuristics alone.

---

Origin

Hydra takes its name from Twilight Forest — the swamp-dwelling multi-headed boss whose heads regenerate faster than they can be severed, forcing the player to strike every weak point at once. Security vulnerabilities work the same way: suppress one surface and two more emerge. Hydra finds them before they find you.

The question this plugin answers: Is it safe?

Who this is for

• Teams who've accepted that AI-assisted development opens attack surfaces traditional scanners don't cover — poisoned .claude/settings.json hooks, prompt-injection-to-RCE chains, typosquatted deps the agent pulled in.
• Security-conscious developers who want findings keyed to real CVEs and CWEs, not vendor branding.
• Engineers running in environments where cloud security SaaS isn't an option — Hydra is bash + jq, no dependencies, no outbound calls.

Not for:

• Replacing your language-native linter / type-checker — Hydra complements them, doesn't duplicate them.
• Environments where advisory warnings are insufficient — Hydra's hooks inform, they don't silently block (see ../vis/packages/core/conduct/hooks.md).

Contents