git-guardrails-claude-code

Set Up Git Guardrails

Set up a PreToolUse hook that intercepts and blocks dangerous git commands before Claude executes them.

Sets up a PreToolUse hook that intercepts and blocks dangerous git commands before Claude executes them.

Blocked Commands (What Gets Blocked)

git push(including --force and all variants)

git push (all variants including --force)
git reset --hard
git clean -f / git clean -fd
git branch -D
git checkout . / git restore .

When blocked, Claude sees a message telling it that it does not have permission to access these commands.

When blocked, Claude sees a message telling it that it does not have authority to access these commands.

Steps

1. Ask About Scope

Ask the user: install only tothis project（.claude/settings.json) orall projects（~/.claude/settings.json）？

Ask the user: install for this project only (.claude/settings.json) or all projects (~/.claude/settings.json)?

2. Copy the hook script

The bundled script is located at:scripts/block-dangerous-git.sh

The bundled script is at: scripts/block-dangerous-git.sh

Copy it to the target location based on the scope:

Copy it to the target location based on scope:

Project-level：.claude/hooks/block-dangerous-git.sh

Project: .claude/hooks/block-dangerous-git.sh
Global：~/.claude/hooks/block-dangerous-git.sh

Global: ~/.claude/hooks/block-dangerous-git.sh

Use chmod +x to make it executable.

Make it executable with chmod +x.

3. Add the hook to settings

Add it to the corresponding settings file:

Add to the appropriate settings file:

Project-level（.claude/settings.json）：

Project (.claude/settings.json):

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

Global（~/.claude/settings.json）：

Global (~/.claude/settings.json):

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "~/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

If the settings file already exists, merge the hook into the existing hooks.PreToolUse array — do not overwrite other settings.

If the settings file already exists, merge the hook into existing hooks.PreToolUse array — don't overwrite other settings.

4. Ask Whether Customization Is Needed

Ask the user whether they want to add or remove any patterns from the block list. Edit the copied script accordingly.

Ask if user wants to add or remove any patterns from the blocked list. Edit the copied script accordingly.

5. Verify

Run a quick test:

Run a quick test:

echo '{"tool_input":{"command":"git push origin main"}}' | <path-to-script>

It should exit with code 2 and output a BLOCKED message to stderr.

Should exit with code 2 and print a BLOCKED message to stderr.