Add a Claude Code Plugin#447
Draft
owtaylor wants to merge 4 commits into
Draft
Conversation
In many cases, a build that doesn't include the generated mcp-app HTML is sufficient. Add a hatch_build.py to make the inclusion of the generated HTML in the wheel optional.
Add a mode where the gatekeeper evaluation of the script and the decision about whether to prompt are done *external* to the MCP server, for example in "hooks" that are run by the LLM client. This allows: - Reuse of inference from the client, rather than requiring separate configuration of a gatekeeper model - Better integration of prompting with the clients approval system.
Add a plugin marketplace that can be installed in Claude Code, with a single plugin "linux-mcp-server" which has our MCP server, run with --external-script-checks and a set of hooks: - Check run_script input gatekeeper-style - Only confirm for readonly scripts or if LINUX_MCP_ALWAYS_CONFIRM is set - Reconfigure permissions for the run_script tool so that we control the permission decision entirely, and the user doesn't have to know that it's safe to "always allow" it. There is also a userConfig entry to choose the toolset.
Add `eval/gatekeeper/run_eval.py --external-checks` to allow evaluating how the gatekeeper does when prompted in the format we use for the Claude Code plugin (arguments as JSON)
|
For team members: test commit |
Codecov Report❌ Patch coverage is
Flags with carried forward coverage won't be shown. Click here to find out more.
... and 1 file with indirect coverage changes 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a draft of a Claude Code Plugin that achieves out-of-the box "Guarded Code Execution" functionality.
The plugin configures:
PreToolUse"prompt" hook that feeds the tool arguments to a model to do the gatekeeper checks (does the script match thePreToolUse"command" hook that decides whatrun_scriptcalls need confirmationPermissionRequesthook that auto-approvesrun_scriptcalls that don't need explicit permission.Other parts of the patch:
--external-script-checksmakes therun_scripttoolset preset only a singlerun_scripttool disabling the "gatekeeper" and "user in the loop" parts of our guardrails. The implementation is a bit messy - FastMCP 3 would make it easier.eval/gatekeeperframework gains an--external-checksmode that tests things using the plugin prompt rather than the gatekeeper prompt (with the arguments as JSON etc).uvx git+https://github.com/owtaylor/linux-mcp-server.gitto work for demo purposes without needing--external-script-checkssupport on PyPIDemo
Trying it out:
Within Claude Code:
The good
The bad
The ugly
(The "Yes" and "Yes, and don't ask again..." options have exactly the same behavior ... which is that it will continue to ask again only for read-write script and not read-only scripts.)
Other clients?
~/.code/auth_jsonand make direct API calls in a command hook - and probably within the spirit. (It's explicitly OK to use your ChatGPT Plus/Pro account with OpenCode / OpenClaw)