Claude Code Security

Security auditor for Claude Code configurations, skills, MCP servers, and hooks.

Installation

pip install claude-code-security

Or install from source:

git clone https://github.com/yourname/claude-code-security
cd claude-code-security
pip install -e .

Usage

Scan current directory

ccs scan

Scan specific path

ccs scan --path /path/to/project

Include user configuration

ccs scan --include-user

Output formats

# JSON output
ccs scan --json

# SARIF for GitHub Security
ccs scan --sarif > results.sarif

Filter by severity

ccs scan --severity critical
ccs scan --severity high

Auto-fix issues

ccs scan --fix

List available rules

ccs list-rules

List discovered configs

ccs list-configs

What it checks

MCP Servers

• Hardcoded secrets in environment variables
• Shell injection in commands
• Insecure HTTP URLs
• Dangerous command patterns

Skills

• Missing allowed-tools restrictions
• Dangerous tool access (Bash, Write, Edit)
• Prompt injection patterns
• Sensitive file references

Hooks

• Command injection vulnerabilities
• Auto-approve patterns
• Excessive timeouts
• World-writable scripts

Settings

• bypassPermissions mode
• Wildcard allow rules
• Missing deny rules for sensitive paths
• Overly broad directory access

Memory Files

• Hardcoded secrets
• Prompt injection patterns
• Sensitive path references

Exit Codes

• 0: No critical or high severity issues
• 1: Critical or high severity issues found

Claude Code Security Tool - Overview

What It Does

Claude Code Security is a specialized security auditing tool that scans Claude Code configuration files for security vulnerabilities and misconfigurations. It does NOT scan your application source code (Python, JavaScript, etc.).

---

What It Scans

The tool only scans Claude Code configuration files:

Configuration Files Scanned:

• .mcp.json - MCP server configurations
• .claude/settings.json - Permissions, hooks, and settings
• .claude/skills/**/SKILL.md - Custom skill definitions
• CLAUDE.md / CLAUDE.local.md - Memory files
• .claude/hooks/* - Hook scripts (if referenced)

What It Does NOT Scan:

• ❌ Python source code (.py files)
• ❌ JavaScript/TypeScript files
• ❌ Any application source code
• ❌ General project files

---

When It's Useful ✅

Use Case 1: You Use Claude Code IDE

If you use Claude Code (the IDE/editor) and have configuration files, the tool can help secure your setup.

Use Case 2: Security Checks Needed

The tool checks for:

• Hardcoded API keys/secrets in configuration files
• Overly permissive settings (e.g., bypassPermissions mode)
• Security misconfigurations in permissions
• Dangerous hook scripts with injection vulnerabilities
• Missing security controls (deny rules, tool restrictions)

Use Case 3: Team/Enterprise Deployment

If you're:

• Sharing Claude Code configurations with a team
• Setting up Claude Code for multiple developers
• Deploying Claude Code configurations in production
• Wanting to catch security issues before deployment

---

When It's NOT Useful ❌

Scenario 1: You Don't Use Claude Code

• If you don't use Claude Code IDE, the tool won't find anything to scan
• It's specifically designed for Claude Code configurations only

Scenario 2: Web Interface Only

• If you only use Claude via the web interface (claude.ai), there are no config files to scan
• The tool requires local configuration files

Scenario 3: Application Code Security

• If you want to scan your Python, JavaScript, or other application code for security issues
• This tool is NOT designed for that purpose
• Use tools like bandit, safety, semgrep, or pylint instead

---

Real-World Value

Security Issues It Can Catch:

1. Secrets in Config Files

   • Hardcoded API keys in .mcp.json
   • Credentials in environment variables
   • Tokens in memory files

2. Dangerous Permission Settings

   • bypassPermissions mode enabled
   • Wildcard allow rules (Bash(*), Edit(*))
   • Missing deny rules for sensitive paths

3. Security Misconfigurations

   • Shell injection vulnerabilities in commands
   • Insecure HTTP URLs for MCP servers
   • World-writable hook scripts
   • Auto-approve patterns in hooks

4. Best Practice Violations

   • Skills without tool restrictions
   • Missing security controls
   • Overly broad directory access

---

Quick Check: Is This Tool Relevant for You?

Run this command in your project directory:

ccs list-configs --path /path/to/your/project

Results:

• If it finds files: The tool is relevant and can help secure your Claude Code setup
• If it finds nothing: You're not using Claude Code configurations, and this tool won't help

---

Bottom Line

Claude Code Security is a specialized tool for Claude Code configuration security.

• ✅ Useful if: You use Claude Code IDE and have configuration files
• ❌ Not useful if: You don't use Claude Code or only use the web interface

It's designed to prevent security issues in Claude Code configurations, not to scan your application source code.

---

Installation & Usage

Install

pip install claude-code-security

Basic Usage

# Scan current directory
ccs scan

# Scan specific path
ccs scan --path /path/to/project

# List discovered configs
ccs list-configs

# Output as JSON
ccs scan --json

# Auto-fix issues
ccs scan --fix

---

Summary

Aspect	Details
Purpose	Security auditing for Claude Code configurations
Scans	Configuration files only (JSON, YAML, Markdown)
Does NOT Scan	Application source code (Python, JS, etc.)
Best For	Teams using Claude Code IDE with configs
Not For	General code security scanning

---

For questions or support, refer to the project documentation or repository.

License

MIT