By getaxonflow
Policy enforcement, PII detection, and audit trails for Claude Code. Govern tool execution, scan outputs for sensitive data, and maintain compliance-grade records of every action.
Search AxonFlow's audit trail for recent tool executions and policy decisions
Create a governed AxonFlow session override with mandatory justification (TTL clamped server-side; critical-risk policies blocked)
Fetch the full reasoning behind an AxonFlow policy decision (matched policies, risk level, override availability)
List active AxonFlow session overrides scoped to your tenant
List recent AxonFlow governance decisions for the current user/tenant — surface "what just got blocked", trace decision history, or drive an appeal flow
Fetch the full reasoning behind an AxonFlow policy decision — matched policies, risk level, override availability, recent hit count
List active session overrides scoped to the caller's tenant — useful for auditing dangling overrides or confirming an override is in effect before retrying
Surface the user's recent AxonFlow governance decisions — answers "what just got blocked", "show me my recent denials", or feeds a decision-history forensic flow
Revoke a previously-created AxonFlow session override — emits an audit event and ensures subsequent policy evaluations no longer consult it
Search the AxonFlow audit trail for recent tool executions, policy decisions, and PII detections — use to answer "what happened recently?" or to gather compliance evidence
Executes bash commands
Hook triggers when Bash tool is used
Modifies files
Hook triggers on file write and edit operations
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Runtime governance for Claude Code: block dangerous commands before they run, scan every tool output for PII and secrets, and keep a compliance-grade audit trail — without leaving your terminal.
→ Full integration walkthrough: docs.getaxonflow.com/docs/integration/claude-code — architecture, policy examples, latency numbers, troubleshooting, and the 10 MCP tools the platform exposes.
Upgrade strongly recommended. AxonFlow ships substantial monthly security and quality hardening; staying on the latest major is the security-supported release line. Latest release · Security advisories
Claude Code is Anthropic's official CLI — a fast, agentic coding assistant that edits files, runs shell commands, and calls MCP servers. It's excellent at developer productivity. It was never designed to be the layer where your security and compliance team lives.
The gaps start surfacing the moment Claude Code moves from one developer's laptop to a team or production setting:
| Production requirement | Claude Code alone | With this plugin |
|---|---|---|
| Policy enforcement before tool execution | Hooks available, no governance logic | 80+ built-in policies evaluated on every governed tool call |
Dangerous command blocking (rm -rf /, reverse shells, curl | bash) | Not addressed | Blocked before execution with decision context |
| PII / secrets detection in tool outputs | Developer responsibility | Auto-scan; Claude is instructed to use redacted version |
| SQL-injection detection on MCP queries | MCP server's problem | 30+ patterns evaluated on every MCP tool call |
| Compliance-grade audit trail | Session logs, not compliance-formatted | Every governed call recorded with policies, decision, duration |
| Decision explainability after a block | Generic hook failure message | decision_id surfaced in deny reason; explain_decision MCP tool returns the full record |
| Self-service, time-bounded exceptions | Not available | create_override with mandatory justification, fully audited |
| Cloud metadata / SSRF / path traversal blocking | Not addressed | Built in |
You get all of that with zero change to how developers use Claude Code. Hooks fire automatically, the deny message tells you why, MCP tools are there when you want to investigate or unblock yourself.
Claude selects a tool (Bash, Write, Edit, NotebookEdit, mcp__*)
│
▼
PreToolUse hook fires automatically
│ → check_policy("claude_code.Bash", "rm -rf /")
│
├─ BLOCKED → Claude receives denial reason with decision_id + risk_level,
│ can call explain_decision / create_override to unblock
│
└─ ALLOWED → Tool executes normally
│
▼
PostToolUse hook fires automatically
│ → audit_tool_call(tool, input, output) [non-blocking]
│ → check_output(tool result for PII/secrets)
│
├─ Sensitive data found → Claude instructed to use
│ redacted version in its reply
└─ Clean → Silent
Governed tools: Bash, Write, Edit, NotebookEdit, and all MCP server tools (mcp__*). Read-only tools (Read, Glob, Grep) are not governed by default — they don't modify state or send data externally.
Fail behavior:
A developer connects an MCP server to a production database for debugging. Claude Code queries customer records. Results flow through the conversation with PII intact. Session logs exist but they aren't structured for compliance queries.
With the plugin: check_policy fires before the MCP query runs (SQL injection scan, policy scan), check_output scans the result for SSN / credit card / email / phone / API keys, and audit_tool_call records the full interaction with matched policies and decision ID.
A developer types "fix the database issue." Claude Code picks a Bash tool and runs a migration against prod. The command ran because nothing stopped it.
npx claudepluginhub getaxonflow/axonflow-claude-plugin --plugin axonflowAchieve flow state safely with Claude Code. Auto-approves routine work, gates risky actions, hard-blocks dangerous patterns. Dual enforcement (skill + hooks), token cap for cost governance, full audit trail. Zero dependencies.
A secure runtime for Claude Code. Intercepts every tool call with policy-based allow/block/ask decisions, evasion detection, path fencing, file snapshots, and audit logging.
AGT governance hooks and MCP tools for Claude Code sessions
APort Agent Guardrails — security policy enforcement for every tool call. Intercepts tool use, evaluates against your passport policy, and blocks unauthorized actions.
Command Line Agent Safety Harness. All interactions with clash policy should go through this plugin
Security controls for AI agents — deterministic policy enforcement, OWASP ASI10 scanning, and audit trails.