Enforce in Claude Code (hook)

The MCP connector gives Claude Vulnify tools, and Claude decides when to call them. That is guidance, not enforcement. In Claude Code you can enforce it: a PreToolUse hook runs before each matching tool call and asks Vulnify first.

Vulnify result	What Claude Code does
ALLOW	Normal permission flow. VULNIFY_HOOK_ALLOW_MODE=allow auto-approves instead
REVIEW	Denied with “waiting for approval in Vulnify” and the event id. Approve at app.vulnify.io/approvals, then ask Claude to retry
BLOCK	Denied with Vulnify’s reasons
Vulnify unreachable, bad key, timeout	Denied (fail closed). VULNIFY_HOOK_FAIL_OPEN=true lets it run with a “degraded” warning

Set it up (one command)

npx @vulnify/cli hook claude-code

Run it in your project. It copies the hook to .claude/hooks/vulnify-hook.mjs and adds it to .claude/settings.json. Add --user to install it in ~/.claude for every project, or --uninstall to remove it.

The key comes from VULNIFY_API_KEY, or the command asks for it with hidden input. It is never printed. A key you type is saved in .claude/settings.local.json, which is git-ignored and readable only by you. With --user it goes in ~/.claude/settings.json. A TEST key from app.vulnify.io/api-keys works for trying it out.

Set it up by hand

1. Download vulnify-hook.mjs into your project as .claude/hooks/vulnify-hook.mjs. It is one Node 18+ file with no dependencies.
2. Export your key in the shell you start Claude Code from: export VULNIFY_API_KEY=vln_.... Don’t commit it.
3. Add the hook to .claude/settings.json, or ~/.claude/settings.json for every project:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash|Write|Edit|MultiEdit|NotebookEdit|WebFetch|mcp__.*",
        "hooks": [
          {
            "type": "command",
            "command": "node",
            "args": ["${CLAUDE_PROJECT_DIR}/.claude/hooks/vulnify-hook.mjs"],
            "timeout": 30,
            "onFailure": "block"
          }
        ]
      }
    ]
  }
}

onFailure: "block" (Claude Code 2.1.295 or later) keeps the call blocked even if the script can’t start. Run /hooks in Claude Code to check that it loaded.

What gets checked

• Bash: rm, DROP TABLE, git push --force become DELETE_DATA (curl -X DELETE, aws s3 rm and kubectl delete go to EXTERNAL_API). Mail sends become SEND_EMAIL to EXTERNAL_EMAIL: mail, sendmail, swaks, msmtp, curl smtp:// or --mail-rcpt, aws ses send-email, the SendGrid, Mailgun, Resend and Postmark APIs, and smtplib. Uploads such as curl -F/-T/-d, scp, rsync, git push, npm publish, aws s3 cp and Slack webhooks become EXPORT_DATA to EXTERNAL_API. Other commands that can change things become WRITE_DATA. Read-only commands such as ls, cat, grep, and git status are skipped.
• Write, Edit, MultiEdit, NotebookEdit: WRITE_DATA on the resource local files.
• WebFetch: READ_DATA to EXTERNAL_API on the resource web.
• MCP tools (mcp__<server>__<tool>): judged by the tool name. Send and post tools become SEND_EMAIL to EXTERNAL_EMAIL when the server is a mail server or the input has email addresses in to, cc or recipients, and EXPORT_DATA otherwise. Delete tools become DELETE_DATA. Create and update tools become WRITE_DATA. Read tools are skipped unless VULNIFY_HOOK_CHECK_READS=true. The resource is mcp:<server>.
• Read, Glob, Grep, TodoWrite, WebSearch, and Vulnify’s own tools are skipped.

recordsAffected is an estimate. It comes from SQL LIMIT n, flags such as --limit, -n or --count, and the number of email recipients or files. A DELETE or UPDATE without WHERE, DROP or TRUNCATE counts as 10,000, and a recursive or wildcard rm as 100. For MCP calls it uses limit and count fields and the length of id or recipient lists. Anything else counts as 1. Policies on record counts, such as “more than 1,000 records goes to REVIEW”, apply to these estimates.

For send, export, delete, and WebFetch calls, the command or tool input is sent as content for the sensitive-data scan. It is scanned in memory and not stored. Set VULNIFY_HOOK_SEND_CONTENT=never to turn that off.

The agent name defaults to claude-code (VULNIFY_AGENT). New agent names register on first use and count toward your plan’s agent limit.

Every setting is listed in the example README.

Also: the Claude skill

The vulnify-guard-actions skill tells Claude to call decide_action before consequential actions with any connector, in Claude and Claude Code. It is guidance for the model. The hook is the enforced path.