Supply chain security plugin for Claude Code. Blocks compromised packages before they're installed.
Claude Code installs packages on your behalf — often without you reviewing each one. Attach Guard intercepts package installation commands across npm, pip, Go, and Cargo and evaluates them against policy before execution.
attach-guard evaluates:
[email protected] DENY (supply chain score 40, compromised version)
[email protected] ALLOW (supply chain score 71, passes all checks)
Result: ASK + rewritten command
npm install [email protected]
Most security tools just say "no." Attach Guard says "no, but here's a safe alternative."
Package is safe
Install proceeds normally
Latest is risky, older version is safe
Shows safe alternative, user confirms
All versions fail (malware, all too new, etc.)
Blocked with clear explanation
Not an advisory scanner. A hard enforcement boundary that intercepts package installs across npm, pip, Go, and Cargo before execution.
When a risky version is blocked, attach-guard finds the newest version that passes policy and offers it as a replacement. Your flow doesn't stop.
When the risk provider is unavailable, attach-guard denies in CI and asks in local mode. No silent pass-throughs.
Every decision is logged to a local JSONL audit trail with timestamps, scores, and reasons. Complete accountability.
Attach Guard is a Claude Code hook, not a skill or MCP server. The distinction matters:
Hooks
Run automatically on every matching tool call. Enforce rules deterministically — Claude cannot skip or override them.
Skills
Instructions Claude follows when invoked. They guide behavior but cannot block actions.
MCP Servers
Provide advisory context. They inform but do not enforce.
Every package goes through an ordered policy evaluation:
# Install the plugin (one-time)
claude plugin marketplace add attach-dev/attach-guard
claude plugin install attach-guard@attach-dev
# Or from within a Claude Code session
/plugin marketplace add attach-dev/attach-guard
/plugin install attach-guard@attach-dev
# That's it. Claude Code prompts for your Socket.dev API token during install.
# Free token at socket.dev
npm install, npm i, pnpm add and their variants.
pip install, pip3 install with version pinning.
go get with module path and version support.
cargo add with crate version pinning.
Open source Claude Code plugin. Two commands to install, zero config needed.