Security enforcement plugin for Claude Code. Blocks dangerous commands, audits every tool call, detects prompt injection.
Hook
Runs before the agent uses a tool for Bash, Monitor, PowerShell, Write, Edit, MultiEdit, NotebookEdit, Read, CronCreate and ^mcp__ tool calls, executing run-check.sh (7 commands). From QORIS-AI/knox.
Hook
Runs on the PermissionDenied event, running an inline shell check. From QORIS-AI/knox.
Hook
Runs on the ConfigChange event for user_settings, project_settings and local_settings tool calls, running an inline shell check. From QORIS-AI/knox.
Hook
Runs when you submit a prompt, before the agent sees it, running an inline shell check. From QORIS-AI/knox.
Hook
Runs after instructions files are loaded for session_start, include, path_glob_match, nested_traversal and compact tool calls, running an inline shell check. From QORIS-AI/knox.
Hook
Runs after a tool call finishes, running an inline shell check. From QORIS-AI/knox.
Hook
Runs when a subagent starts, running an inline shell check. From QORIS-AI/knox.
Hook
Runs on the FileChanged event for .knox.json and .knox.local.json tool calls, running an inline shell check. From QORIS-AI/knox.
Hook
Runs on the TaskCreated event, running an inline shell check. From QORIS-AI/knox.
Hook
Runs when a session ends for clear, prompt_input_exit, logout, resume, bypass_permissions_disabled and other tool calls, running an inline shell check. From QORIS-AI/knox.
Hook
Runs when a session starts on startup, resume, clear and compact, running an inline shell check. From QORIS-AI/knox.