git-guardrails-claude-code

Set Up Git Guardrails

Set up a PreToolUse hook that intercepts and blocks dangerous git commands before Claude executes them.

Commands that will be blocked

git push(all variants including --force )
git reset --hard
git clean -f / git clean -fd
git branch -D
git checkout . / git restore .

When blocked, Claude will see a message stating that it does not have access to these commands.

Steps

1. Ask about installation scope

Ask the user: install only forthe current project (.claude/settings.json), or forall projects (~/.claude/settings.json）？

2. Copy the hook script

The bundled script is located at:scripts/block-dangerous-git.sh

Copy it to the target location based on scope:

Project: .claude/hooks/block-dangerous-git.sh
Global: ~/.claude/hooks/block-dangerous-git.sh

Use chmod +x to make it executable.

3. Add the hook to settings

Add it to the corresponding settings file:

Project (.claude/settings.json):

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

Global (~/.claude/settings.json):

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "~/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

If the settings file already exists, merge the hook into the existing hooks.PreToolUse array; do not overwrite other settings.

4. Ask whether to customize

Ask the user whether they want to add or remove patterns in the blocked list. Edit the copied script accordingly.

5. Verify

Run a quick test:

echo '{"tool_input":{"command":"git push origin main"}}' | <path-to-script>

It should exit with code 2 and print the BLOCKED message to stderr.