Install the Clawkeeper Plugin

Add real-time threat detection to Claude Code in 60 seconds. No account, no API key, no configuration. Just install and go.

What you get instantly

✓Threat detection patterns — credential exfiltration, reverse shells, prompt injection, SUID manipulation, DNS exfiltration, and more
✓4 lifecycle hooks — UserPromptSubmit, PreToolUse, PostToolUse, SessionStart
✓9 slash commands — /clawkeeper-code:audit, /clawkeeper-code:secrets, /clawkeeper-code:inspect, and more
✓Zero network calls — everything runs locally on your machine. No telemetry.

Add the RAD Security marketplace

In Claude Code, run:

/plugin marketplace add rad-security/claude-code-plugin

This registers the RAD Security plugin catalog with your Claude Code installation. You only need to do this once.

Install Clawkeeper

/plugin install clawkeeper-code@clawkeeper

Claude Code registers 9 new slash commands in your session. Hooks are written to ~/.claude/settings.json but do not activate until Claude Code starts up fresh.

Restart Claude Code

Quit Claude Code and reopen it. Hooks are loaded once at startup, so a full restart is required before Clawkeeper begins intercepting tool calls.

Try it out

Run a security audit of your Claude Code setup:

/clawkeeper-code:audit

This checks 10 security dimensions — sandbox mode, root execution, secret exposure, git signing, hook coverage, permissions, and more — then gives you a letter grade with actionable recommendations.

Then scan for exposed secrets:

/clawkeeper-code:secrets

And audit your installed plugins for threats:

/clawkeeper-code:inspect

Connect your dashboard

Link the plugin to a free Clawkeeper account so threats surface in your dashboard and every session contributes to fleet visibility.

/clawkeeper-code:connect

Opens your browser to approve the device. Sign up at clawkeeper.dev/signup first if you don't already have an account — free, no credit card.

Prefer local-only?

You can skip this step by running /clawkeeper-code:setup --local instead. Detection still runs against bundled threat patterns, but nothing leaves your machine and you won't see events in a dashboard. You can connect later at any time.

Configure warn or block mode

/clawkeeper-code:setup

Default mode is warn — threats are flagged but execution continues. Switch to block to prevent dangerous commands from executing.

Need team-wide coverage?

The plugin protects individual developers. For fleet-wide policy enforcement where every developer who pulls a repo is automatically covered, use push-hooks for teams.

Source code

The plugin is open source: github.com/rad-security/claude-code-plugin

Automate these checks with Clawkeeper

One command scans your entire OpenClaw deployment and gives you an A-F security grade.