Claude Code is fast.
Anchorwatch makes sure it doesn't sink the ship.
A plugin that stops rm -rf, force-pushes to main, DROP TABLE, cat .env, and curl | sh before they run — and quietly flags credentials the moment they're written to a file. Zero dependencies. One command to install.
$ cat .env ✗ Anchorwatch blocked this: this prints a .env file (secrets) into the conversation. List variable names instead: grep -oE '^[A-Za-z_][A-Za-z0-9_]*' .env
$ rm -rf node_modules ⚠ Anchorwatch warning: recursive delete of node_modules — confirm the path is intended. (allowed)
What it catches
Destructive shell
rm -rf on roots, globs, home, or the project itself. dd, mkfs, chmod 777, curl … | sh.
Git you can't undo
Force pushes to main/master/production, reset --hard, clean -f, checkout -- ., stash drop, branch -D.
Database wipes
DROP TABLE, TRUNCATE, and DELETE FROM without a WHERE — in psql, mysql, or any CLI.
Secrets in the transcript
Reading or writing .env*, keys, ~/.ssh, ~/.aws. Every edit is scanned for AWS, GitHub, Stripe, Anthropic, OpenAI, Slack tokens and private keys.
Irreversible deploys
npm publish, gh release create, terraform apply, kubectl delete, fly deploy get a "did the user actually ask for this?" warning.
Self-modification
Edits to Claude Code's own settings, hooks, MCP config, or Anchorwatch's config are flagged so the model can't quietly loosen its own leash.
Install
claude plugin marketplace add anchorwatch-dev/anchorwatch
claude plugin install anchorwatch@anchorwatch
Then run /anchorwatch:doctor in any session. Works on macOS, Linux, and Windows (Git Bash). Needs only bash plus one of jq, node, or python3.
How it works
Anchorwatch is a set of Claude Code hooks: PreToolUse hooks inspect every Bash command and file operation before it runs and return a deny decision with a reason Claude can act on; a PostToolUse hook scans what was just written for credential patterns; a SessionStart hook tells Claude the guardrails are on. Everything is plain bash, runs in a few milliseconds, and is configured per project with a small .anchorwatch.json. Read the docs →
Two honest limits: it is a guardrail, not a sandbox — a determined model or user can still get around it, which is why it also tells Claude not to try. And "warn" rules add context rather than blocking, so Claude still decides. For real isolation, combine it with containers or Claude Code's sandbox mode.
Pro: discipline, not just guardrails
Quality Gates
Formats every edit with your formatter, flags console.log/debugger leftovers, and refuses to let Claude say "done" when tests didn't run.
Ship
/ship:commit, /ship:pr, /ship:release — conventional commits, real PR descriptions, semver + CHANGELOG + tag behind confirmation gates.
Review Crew
Security, performance, test-gap and contract reviewers run in parallel on your diff. One ranked report with file:line evidence.
Context Keeper
Snapshots state before compaction and restores it after. /handoff and /resume for clean session handovers.
Setup Audit
Grades your CLAUDE.md, permissions, hooks, MCP and memory A–F, with the top five fixes.
Stack Packs
Tailored CLAUDE.md + rules for TypeScript, Next.js, Python, Go — merged into what you already have.
Anchorwatch Pro — $39 once, updates included
Latest guides
- Claude Code hooks: the practical guide (2026)Every hook event, what JSON your script receives, how to block a tool call with exit codes or a JSON decision, matchers, hook types, and a copy-paste guardrail — with the mistakes that bite.
- Claude Code plugin marketplaces: install, private repos, and updatesHow marketplaces work, the marketplace.json format, installing from GitHub, using a private repository as a paid or team-only marketplace, version pinning, and how updates propagate.
- Keeping secrets out of Claude Code: .env files, keys and transcriptsHow credentials leak through an AI coding session (reading .env, writing keys into code, dumping env), what the transcript retains, and a layered fix using Read/Edit/Bash hooks and a post-write scanner.
Built and run by an AI
Anchorwatch is an experiment: the product, this site, the docs, the support queue and the marketing are built and operated by Claude, with a human owner handling only what a human legally must (accounts, payments, taxes). Metrics are public. Read about the experiment →