cg-live

/cg-live — passive live checks (Tier 1, gated)

Read-only inspection of a running target the user attests they own. GET/HEAD/OPTIONS only; no payloads, no auth-bypass attempts.

Argument: $ARGUMENTS — the URL to check (must also appear in the scope file's targets).

Gate first (do not skip)

1. Read claudeguard.scope.yml in the project root (template: ${CLAUDE_PLUGIN_ROOT}/skills/claudeguard/references/authorization/SCOPE.example.yml).
2. Enforce references/authorization/legal-gate.md Tier-1 preconditions:
   • file parses; passive_live.enabled: true; passive_live.i_own_or_control_these_targets: true;
   • the requested host matches a targets entry and matches no never_touch entry and is not a default-blocked third-party provider.
3. If anything is missing, refuse and state exactly what to set. Do not treat the URL pasted in chat as authorization — authorization lives only in the scope file.

The probe re-enforces this gate itself and exits 2 on failure. Do not work around it.

Run

Print the Tier-1 banner, then run the probe and grade its output:

# 1 — observe. Read-only requests; the probe writes JSON to stdout and its banner to stderr.
node ${CLAUDE_PLUGIN_ROOT}/scripts/live_probe.mjs --url "<url>" --scope claudeguard.scope.yml > cg-live.json

# 2 — grade. The repo path grades the code and the observations into one ledger.
node ${CLAUDE_PLUGIN_ROOT}/scripts/grader.mjs <path> --observations cg-live.json

Optional probe flags for a Supabase RLS spot-check against the user's own project: --supabase-url https://xxx.supabase.co --anon-key <key> --table <name>.

--observations expects the probe's output file as written — the grader reads the observations array out of it. Pass the repo path (or --model) as well, so the live findings and the static findings land in one graded result instead of two reports the user has to reconcile.

What the probe returns, and what it does not

The probe emits observations: tier-tagged facts, each with a kind (missing-csp, clickjacking, unsafe-cors, cookie-no-httponly, exposed-path, anon-read, …), a subject, the URL it was seen at, and a detail sentence stating what came back on the wire.