Claude Code mod
bash-guard
Blocks catastrophic shell commands (rm -rf ~, curl | sh, force-push to main, DROP DATABASE, format C:) and asks before risky ones (git reset --hard, rm -rf, terraform apply), in Bash and PowerShell.
Install
/plugin marketplace add mako-code/gobworks
/plugin install bash-guard@gobworksMods install like plugins. Run /reload-plugins or start a new session to load it.
What it can access
- Reach
- L2Writes or runs: runs processes, reads env vars, reads mod state, draws
- Sees
- Bash|PowerShell calls
- Draws in
AbovePromptPromptHintSessionModePane- Hooks
session.startstate.setui.rendersession.endtool.callcommand.run
From a static scan of the mod's code by awesome-claude-code-mods. It shows what the code asks for, not a security review.
How Claude Code mods work
- A mod is a plugin with a JavaScript or TypeScript module that runs inside Claude Code (version 2.1.287 or later). It can draw panes beside the transcript, a band above the prompt, buttons and toasts, restyle the spinner and tool rows, and watch or rewrite tool calls and prompts.
- It installs like any plugin: add its marketplace with /plugin marketplace add owner/repo, then /plugin install name@marketplace.
- Check what a mod can reach before installing: it runs with your permissions. Reach goes from drawing only, to reading files, to writing files or running processes, to the network. Run claude plugin validate on a clone to list its hooks and calls without running it.
- Turn one off from the Installed tab in /plugin, or start Claude Code with --safe-mode to skip every customization for a session.
Details
- Repository
- mako-code/gobworks
- Folder
mods/safety/bash-guard- Marketplace
gobworks- Author
- mako-code
- License
- MIT
- Last updated
- 4 October 2026
- Listed in
- awesome-claude-code-mods
FAQ
What is bash-guard?
Blocks catastrophic shell commands (rm -rf ~, curl | sh, force-push to main, DROP DATABASE, format C:) and asks before risky ones (git reset --hard, rm -rf, terraform apply), in Bash and PowerShell. It is a mod for Claude Code, from mako-code/gobworks on GitHub.
What can the bash-guard mod access?
Its widest reach is "writes or runs" (runs processes, reads env vars, reads mod state, draws). It sees Bash|PowerShell calls. It draws in AbovePrompt, PromptHint, SessionMode, Pane. Like any mod, it runs with your permissions.
How do I install bash-guard?
Inside Claude Code (v2.1.287 or later), run /plugin marketplace add mako-code/gobworks and then /plugin install bash-guard@gobworks.
Is bash-guard popular?
mako-code/gobworks has 2 GitHub stars and 0 forks, and is included in 1 curated Claude Code list. It was last updated on 4 October 2026.
More guard & safety mods
ssh-guard
3baselane-sh/mods
Asks before a private key in .ssh is read, authorized_keys or the SSH config is changed, or ssh-keygen would overwrite a key. Public keys and ssh -i pass. Reads HOME with printenv.
agent-firewall
3baselane-sh/mods
A live pane of every tool call the agent makes: green when it ran, red when it was blocked, with counters. Open it with /firewall.
stakes-widget
4oMaN-Rod/claude-code-widgets
What a yes would lose, measured from git and written under the permission dialog for a destructive command
audit-pack
3baselane-sh/mods
Three read-only audit commands in one mod: /secret-scan, /conflicts and /licenses. They read git, project files and dependency folders. They copy results to the clipboard.
redact-widget
4oMaN-Rod/claude-code-widgets
Replaces API keys, tokens, private keys and passwords in command output and file reads before Claude sees them
big-file-guard
3baselane-sh/mods
Asks before a Write creates content over 1 MB, or git add names a file over 5 MB. Measures the files with find.
Browse the most popular Claude Code mods, all guard & safety mods, or the skills and MCP server directories.