agentmods.dev

PreToolUse

A pre-action check that runs before Bash, Edit, and Write commands in OpenMetadata. It blocks skipping Git's pre-commit checks and prevents direct edits to files produced by code generation.

In plain words
What is it for?
Use it to reject Git commands containing --no-verify and prevent edits to generated OpenMetadata UI, ingestion, and build-output files.
Why use it?
It stops changes that could bypass required checks or be overwritten later by the build process.

Hook for Claude Code

15k +27 today A scan tokens not measured original Apache-2.0
View the source file open-metadata/OpenMetadata
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add hooks/open-metadata/openmetadata/pre-tool-use
Clone the repo
git clone --depth 1 https://github.com/open-metadata/OpenMetadata

Made for: Claude Code.

Per session not measured What this adds to a session before it is invoked.
When invoked not measured Not applicable: nothing here is loaded into a session.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Security

Grade A, and why

PreToolUse scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the commands this hook runs, not an audit. A hook is shell that executes on your machine at the event it names, which is why every command in it is printed with what was found.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/settings.json · 39 lines

How it starts

The opening of the file, as written. The whole thing — 39 lines — stays where its author put it; the contents beside it link to each section on GitHub.

{
  "PreToolUse": [
    {
      "matcher": "Bash",
      "hooks": [
        {
          "type": "command",
          "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -q -- '--no-verify'; then echo '{\"decision\": \"block\", \"reason\": \"Do not skip pre-commit hooks with --no-verify. Fix the underlying issue instead.\"}'; exit 2; fi",
          "description": "Block --no-verify on git commits"
        }
      ]
    },
    {
      "matcher": "Edit|Write",
      "hooks": [
        {
          "type": "command",
          "command": "FILE=$(echo \"$CLAUDE_TOOL_INPUT\" | jq -r '.file_path // empty' 2>/dev/null); if [ -n \"$FILE\" ] && echo \"$FILE\" | grep -qE '(openmetadata-ui/src/main/resources/ui/src/generated/|ingestion(-core)?/src/metadata/generated/|/target/generated-sources/)'; then echo '{\"decision\": \"block\", \"reason\": \"Blocked write to GENERATED output. This file is produced by code generation (jsonschema2pojo / datamodel-code-generator / quicktype / ANTLR); hand edits are overwritten by the next build and, for the committed UI types, reverted by the typescript-type-generation CI job. Edit the JSON Schema under openmetadata-spec/src/main/resources/json/schema/ and run make generate (a repo-root-only target). See .claude/rules/schema-first.md.\"}'; exit 2; fi",
          "description": "Block edits to generated output; direct to the schema + make generate"
        },
        {
          "type": "command",
          "command": "FILE=$(echo \"$CLAUDE_TOOL_INPUT\" | jq -r '.file_path // empty' 2>/dev/null); if [ -n \"$FILE\" ] && echo \"$FILE\" | grep -qE 'docs/generated/(entity-index|api-reference)\\.md'; then echo '{\"decision\": \"block\", \"reason\": \"Blocked write to a GENERATED reference doc. docs/generated/entity-index.md and api-reference.md are produced by scripts/generate_entity_index.py and scripts/generate_api_reference.py; hand edits are reverted by the reference-docs freshness CI job. Change the source instead (JSON Schemas under openmetadata

Read the full file on GitHub · 39 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 39 lines scan A eeef0dcf8463

Subscribe to this mod's changes

PreToolUse is a hook published in the GitHub repository open-metadata/OpenMetadata (15,059 stars, last pushed today), licensed Apache-2.0. Its token cost is not measured: a hook is shell that never enters the context. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

data-catalogdata-profilingdatadiscoverydataqualitymetadatametadata-management
Related

Other hooks, from other repositories

PreToolUse

Runs before the agent uses a tool for Bash tool calls, executing deny-git-no-verify.sh. From datahub-project/datahub.

datahub-project/datahub · not measured

PostToolUse

Runs after a tool call finishes for Edit and Write tool calls, executing auto-format-go.sh, auto-lint-ts.sh and auto-graphql-codegen.sh via bash with --show-toplevel (3 commands). From clidey/whodb.

clidey/whodb · not measured

SessionStart

Runs when a session starts, executing session-context.sh via bash with --show-toplevel. From clidey/whodb.

clidey/whodb · not measured

Stop

Runs when the agent finishes a response, executing verify-build.sh via bash with --show-toplevel. From clidey/whodb.

clidey/whodb · not measured

Stop

Runs when the agent finishes a response, running an inline shell check. From anam-org/metaxy.

anam-org/metaxy · not measured

SessionStart

Runs when a session starts on startup, resume, clear and compact, running an inline shell check. From bigbio/sdrf-skills.

bigbio/sdrf-skills · not measured