Safeguard

Read-only audit of what Claude Code can currently see and do - settings layers, permission rules and modes, connected MCP servers, hooks, additionalDirectories, installed plugins, and sensitive files not covered by deny rules. Use when the user asks "what can you access", "audit my setup", "is anything exposed", or before starting work with confidential material. Makes no changes; never echoes secret or credential values.

Hardens Claude Code permissions with safe defaults for knowledge work. Use when the user wants to protect secrets or sensitive files, control what runs without asking, set up guardrails before working with confidential material, or says "secure my setup", "lock this down", "set up permissions". Writes settings.json rules the harness enforces - stronger than any prompt instruction.