FrostWolf for Claude Code

What it protects against

Every engineer running Claude Code has an agent with a shell on a machine that holds cloud keys, deploy tokens, SSH keys and customer data. These are the ways that goes wrong, and what the plugin does about each.

• Secrets in the context window. Risk: A .env, a log line or a kubeconfig is read into context, sent to the model provider, and kept in the transcript. FrostWolf (PostToolUse · PostToolBatch): Every tool result is cloaked first. Keys, tokens and personal data become tokens like [[secret:9c1e07a2b4d1]], and a batch that slipped through stops the turn.
• Prompt injection from the web. Risk: A docs page, issue thread, README or package description carries instructions, and Claude follows them with your shell. FrostWolf (PostToolUse): Fetched pages, files and search results are scanned, and injected instructions are removed before they reach the model.
• Malicious plugins and skills. Risk: A third-party plugin's hooks run as you. A skill's instructions tell Claude to read and send files. Both install in one command. FrostWolf (Plugin & skill vetting): Plugins, skills and MCP servers are checked before they load. One whose hooks or instructions reach for credentials or send data off the machine is blocked.
• Poisoned MCP servers. Risk: A tool description or result smuggles instructions, or the server simply receives whatever Claude passes it. FrostWolf (PreToolUse · PostToolUse): MCP calls are validated before they run, and what a server returns is cloaked and scanned like any other tool result.
• Exfiltrating and destructive commands. Risk: A curl to an unknown host, a force push, an rm -rf. Ordinary commands that a tired approval prompt waves through. FrostWolf (PreToolUse): Shell and web-fetch calls are checked before they run. A command carrying injected arguments or posting local files out is refused.
• Personal data in prompts. Risk: A customer's email, phone or card in a pasted ticket reaches the model and every log downstream of it. FrostWolf (UserPromptSubmit): A prompt or @-attached file carrying personal data is refused, with a cloaked version offered instead. Injection typed or pasted in is blocked.

One turn, step by step

The plugin registers for Claude Code's hook events. Each runs as a short-lived process, and a small local service keeps tokens restorable across them for the length of the session.

1. On load Plugin & skill vetting: Checks third-party plugins, skills and MCP servers before they can run, and blocks one that reaches for your secrets.
2. You send a prompt UserPromptSubmit: Blocks prompt injection. Refuses personal data, in the prompt or an @-attached file, and offers a cloaked version to send.
3. Claude calls a tool PreToolUse: Restores real values into the call, so files and commands get the originals. Validates shell, web fetch and MCP calls first.
4. The tool returns PostToolUse: Cloaks secrets and personal data in the result and removes injected instructions before Claude sees it.
5. Before the next model call PostToolBatch: Checks every result exactly as Claude will receive it, and stops the turn if anything is still uncloaked.
6. Claude replies MessageDisplay: Shows you the real values. Claude and the transcript keep the tokens.
7. The session ends SessionEnd: Erases the session's values.

Built to be trusted on a laptop

• No rules on the machine: Detection runs on the FrostWolf control plane. The plugin ships no signatures or recognisers, so there is nothing local to read, reverse or tamper with.
• Values are never echoed: The control plane answers with types and ranges, never the values. The plugin cuts its own text, so no response or log holds a second copy.
• Fails closed: If FrostWolf cannot check something, it is refused rather than waved through. Set on_unavailable to allow to change that.
• Bound to the session: Tokens restore only within the session that made them, and every value is erased when the session ends.
• Your key stays in the keychain: Installing with --config keeps the API key in your system's secure credential store, not in a dotfile.
• No network rerouting: No proxy and no base-URL change. Claude Code talks to its provider exactly as before.

Configuration

Set these in /plugin or /config. Without the plugin, use the environment variable.

• api_key (FROSTWOLF_API_KEY, default none): Your API key. Required.
• endpoint (FROSTWOLF_ENDPOINT, default https://api.frostwolf.app): Control plane base URL.
• prompt_personal_data (FROSTWOLF_PROMPT_PERSONAL_DATA, default block): block refuses and offers a cloaked version. warn sends as typed and tells you.
• on_unavailable (FROSTWOLF_ON_UNAVAILABLE, default block): block refuses what FrostWolf could not check. allow lets it through.
• display (FROSTWOLF_DISPLAY, default restore): restore shows real values. tokens shows tokens.

Requirements

• Claude Code 2.1.295 or newer
• Node.js 18 or newer on your PATH
• A FrostWolf API key (free)

Questions

Does Claude still write the real values into my files?

Yes. PreToolUse restores the originals into every tool call, so an edit or a command gets the real key. Only the model and the transcript see tokens.

Will I see tokens instead of my data?

No. MessageDisplay shows you the real values on screen. Set display to tokens if you would rather see what Claude sees.

What is sent to FrostWolf?

The text being checked, so the control plane can find secrets, personal data and injection in it. It answers with types and ranges, never the values, and telemetry carries counts only.

What happens if FrostWolf is unreachable?

By default the plugin refuses what it could not check, so an outage never becomes a leak. Setting on_unavailable to allow lets it through instead.

Do I need to change how I use Claude Code?

No. There is no proxy and no base-URL change. Install, start a new session, and work as you did.

What does it cost?

Nothing. The plugin is free and runs on a free FrostWolf key from the console.

Install it in one command

Get a free key, run the install, and start a new session. Every session after that is covered.

claude plugin install frostwolf --marketplace FrostWolfAI/frostwolf-skills --config api_key=YOUR_API_KEY

Plugin source on GitHub