Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/intentdriven/abcd/guardgit clone --depth 1 https://github.com/intentdriven/abcdWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00030 | $0.01643 |
| Opus 5 | $0.00015 | $0.00822 |
| Sonnet 5 | $0.00006 | $0.00329 |
| Haiku 4.5 | $0.00003 | $0.00164 |
Grade B, and why
guard scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
guard does not name (`sudo -u bob <hazard>` is seen; the bundled short form How it starts
The opening of the file, as written. The whole thing — 140 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/abcd:guard shell-hazard check
Decide whether a shell command is safe to run, using abcd's hazard registry —
the bundled hazard entries merged with this repo's .abcd/guard.json. This
command performs zero writes.
check — decide one command
Pass the candidate on stdin, inside a quoted-delimiter heredoc:
"${CLAUDE_PLUGIN_ROOT}/abcd" guard check --json <<'ABCD_GUARD_EOF'
<the command line, verbatim, on one or more lines>
ABCD_GUARD_EOF
Never interpolate the candidate into --command "…". The shell expands a
double-quoted argument before abcd ever starts, so a candidate containing
$(…) or a backtick would execute at check time — the exact moment the check
exists to prevent — and an embedded " would break the quoting outright. The
quoted delimiter (<<'ABCD_GUARD_EOF', quotes included) switches expansion off,
so the candidate reaches the guard as written. Use --command only for a literal
you typed yourself.
Then report the JSON to the user:
verdict—allow,warn, orblock.entry_id,tier— which hazard matched, and how severe it is.why— the plain-language reason, written for a non-expert.successor— the safe form to run instead.matches— every entry the command tripped, blockers first.
Exit codes: 0 for allow and warn, 1 for a block, 2 when the guard could
not be evaluated at all (an unparsable command line, or a .abcd/guard.json
that does not load). Treat 2 as a fault to report, never as a clearance.
On a block, do not run the command. Tell the user the why, then run the
successor instead — the refusal is the lesson, so pass it on in full. On a
warn, the command may run; surface the warning first so the user can stop it.
hook — the host adapter
"${CLAUDE_PLUGIN_ROOT}/abcd" guard hook
Reads a host pre-tool-use hook payload on stdin and applies the same decision before a shell command executes. It is invoked by the plugin's hook manifest, not by hand; a blocker returns the host's blocking status with the successor and the why as the message, and a warn or an allow lets the command run.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 140 lines · 30 tokens per session scan B 196e80e85e45
guard is a command published in the GitHub repository intentdriven/abcd (3 stars, last pushed 2d ago), licensed MIT. It adds 30 tokens to every session and 1,643 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
legal
Primary entry point for all BetterCallClaude requests — classifies intent, resolves jurisdiction (via swiss-legal-research), runs inline briefing for complexity 4–6, activates full briefing session when complexity ≥ 7 (via legal-intake skill), and routes to specialist agents or workflow pipelines. Invoked explicitly…
briefing
Structured pre-execution briefing session -- collects case context through specialist panel, builds execution plan, supports resume and depth control.
help
Show complete BetterCallClaude command reference, available agents, skills, and usage examples.
legal-5step
Execute the BetterCallClaude 5-step Swiss legal framework: intake → research → strategy → adversarial → draft. A complete end-to-end pipeline for any Swiss legal matter, from document analysis through final legal output.
legal-loop
Iterate a worker-evaluator cycle against a Goal Record until the success condition is met or a stop limit is reached. The evaluator (a different agent than the worker) judges each iteration using MCP verification tools. Produces an auditable verdict trail and a final MET / NOT MET status.
workflow
Define and execute multi-agent legal workflows -- due diligence, litigation prep, contract lifecycle, real estate closing.