foxguard 0.8.0

A security scanner as fast as a linter, written in Rust. 170+ built-in rules across 10 languages.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

# Claude Code Marketplace Release Notes

This package is intentionally scoped to Claude Code. Broader agent or editor
integrations should reuse the scanner behavior where it fits, but they should be
tracked separately from the Claude Code marketplace release.

## Versioning

The initial marketplace version is `0.1.0`, matching
`.claude-plugin/plugin.json`.

Before each marketplace submission:

- Bump the plugin version when any manifest, hook, skill, or bundled prompt
  behavior changes.
- Keep the version in `.claude-plugin/plugin.json` as the source of truth.
- Tag the plugin release only after local smoke testing passes.

## Marketplace Copy

Name:

```text
foxguard
```

Short summary:

```text
Fast local security scanning for Claude Code.
```

Description:

```text
foxguard scans files as Claude Code writes or edits them, then feeds actionable
security findings back into the agent session. It includes slash commands for
full scans, diff scans, post-quantum crypto audits, secrets scans, and TUI
triage, plus secure-coding defaults for common vulnerability classes.
```

Repository:

```text
https://github.com/PwnKit-Labs/foxguard
```

Homepage:

```text
https://foxguard.dev
```

License:

```text
MIT
```

Suggested categories:

```text
security, static-analysis, developer-tools, agent-hooks
```

Suggested demo checklist:

- Start Claude Code with `claude --plugin-dir ./plugins/claude-code`.
- Run `/foxguard:setup`.
- Edit a file with a known command-injection or hardcoded-secret pattern.
- Show the `PostToolUse` stderr finding summary.
- Fix the issue and show the hook staying silent on the clean edit.
- Run `/foxguard:scan .` or `/foxguard:diff-scan main` for an on-demand scan.

## Local Validation

The hook was validated directly with:

```sh
printf '{"tool_input":{"file_path":"tests/fixtures/safe.py"}}' \
  | plugins/claude-code/scripts/scan-edited-file.sh

printf '{"tool_input":{"file_path":"tests/fixtures/vulnerable.py"}}' \
  | plugins/claude-code/scripts/scan-edited-file.sh

printf '{"tool_input":{"path":"tests/fixtures/vulnerable.py"}}' \
  | plugins/claude-code/scripts/scan-edited-file.sh

printf '{"tool_input":{"file_path":"/does/not/exist.py"}}' \
  | plugins/claude-code/scripts/scan-edited-file.sh
```

Expected results:

- Clean supported files exit `0` and stay silent.
- Missing files exit `0` and stay silent.
- Finding input exits `2` and emits a compact finding summary to stderr.
- Both `tool_input.file_path` and `tool_input.path` are accepted.

`claude plugin validate plugins/claude-code` was attempted with Claude Code
`2.1.119`, but did not return and was stopped locally. Treat an in-session
Claude Code smoke test as still required before submission.

## External Submission

Submit through the Anthropic plugin submission flow once the in-session smoke
test has passed. After acceptance, update this file, the plugin README, and the
top-level README with marketplace installation instructions.