Evan Cates explains how to gate dangerous Claude Code actions with PreToolUse hooks

Evan Cates's guide focuses on Claude Code's `PreToolUse` hook — the lifecycle event that fires before a tool call runs and is the only hook that can block execution. When the agent is about to invoke a tool, the harness serializes the call as JSON to stdin; the hook reads it, inspects the payload, and returns `exit 0` to allow or `exit 2` to block. Stderr output from the hook is passed back to the model, giving the agent context to change course rather than blindly retry. The guide includes a complete bash example that blocks force-pushes to main by pattern-matching the command string, and shows how to register the hook via a `hooks.json` file using a `matcher` on the `Bash` tool.

Second, blast-radius command gating: patterns like `rm -rf "$DIR"` with an unset variable, `git reset --hard`, `chmod 777`, and `curl ...

Three practical gate patterns are covered in depth. First, pre-push secret scanning: hooks should scan outgoing commits (not just the working tree) for credential-shaped strings and forbidden filenames like `.env` or private keys, using `gitleaks` if available with a regex fallback. Second, blast-radius command gating: patterns like `rm -rf "$DIR"` with an unset variable, `git reset --hard`, `chmod 777`, and `curl ... | sh` should be surfaced to a human before running. Third, shared worktree protection: in multi-agent setups, one session can accidentally destroy another's git worktree; the guide recommends gating writes to `.claude/worktrees/` and blocking `git add -A` in repos containing worktrees.

The post also addresses portability: hooks run in the user's shell where `jq` may not be present, so the guide provides a fallback extraction function using `python3`. A hook that errors due to a missing dependency fails open — the dangerous command runs anyway — making graceful degradation critical. Cates also mentions a free, MIT-licensed Claude Code plugin called `cc-powerpack` on GitHub that packages all three gates, and references a paid handbook called *The Claude Code Operator's Handbook* for deeper coverage.

Key facts

1. 01PreToolUse is the only Claude Code hook that can block a tool call before it executes, via `exit 2`
2. 02The harness serializes the pending tool call as JSON and pipes it to the hook on stdin
3. 03Stderr output from a blocking hook is fed back to the model so the agent can adjust its behavior
4. 04Three recommended gates: pre-push secret scanning, blast-radius command blocking, and shared worktree protection
5. 05A hook that errors due to a missing dependency (e.g., no `jq`) fails open, allowing the dangerous command to run
6. 06The guide provides a `python3` fallback for JSON extraction when `jq` is unavailable
7. 07Cates published a free MIT-licensed plugin called `cc-powerpack` on GitHub implementing all three gates

Topics