Security for Claude Code

Microsoft Sentinel SIEM/SOAR and Defender XDR — incident triage, KQL threat hunting, analytics rules, SOAR playbooks, advanced hunting, and unified security operations center workflows

Microsoft Entra access review automation - stale privileged access detection, review cycle drafting, remediation ticket generation, and status reporting.

Microsoft Entra ID administration via Graph API — full user/group lifecycle, directory roles, PIM, authentication methods, admin units, B2B guest management, license assignment, named locations, and entitlement management

Microsoft Entra ID identity governance and security — app registrations, service principals, conditional access, sign-in logs, and risk detection

Exchange Online mail flow diagnostics and deliverability — guided 'email not received' troubleshooting, transport rules, quarantine, connectors, and SPF/DKIM/DMARC checks with client-safe explanations

Microsoft Fabric Security Governance — workspace RBAC, RLS/OLS patterns, sensitivity labels, lineage controls, and audit readiness

Microsoft Graph Investigator — unified user investigation, mailbox forensics, activity timelines, device correlation, and forensic reporting across all M365 services

Microsoft 365 Lighthouse tenant health scorecard — green/yellow/red dashboard for security posture, MFA coverage, stale accounts, and licensing anomalies across managed tenants

Device lifecycle and compliance management for Microsoft Intune and Endpoint Manager - non-compliant device detection, lost device actions, compliance policy rollout, and app protection policy review.

Microsoft Purview compliance workflows — DLP review, retention planning, sensitivity labels, eDiscovery readiness, and guided compliance playbooks with audit-ready change logs

SharePoint and OneDrive external sharing auditor — find overshared links, anonymous access, stale guest users, and auto-generate approval tasks for safe revocation

Runtime tool-call governance for Claude Code. Layer-1 regex deny on Bash/WebFetch/WebSearch. Layer-2 conformal risk classifier on mcp__* tools. Hash-chained SQLite audit trail at ~/.vaara/claude-code/audit.db.

Intercepts npm/pnpm install commands and enforces package risk policies before execution.

Decyzje Prezesa UODO z oficjalnego API Portalu Orzeczeń UODO (orzeczenia.uodo.gov.pl): kary za naruszenia RODO, upomnienia, nakazy. Wyszukiwanie pełnotekstowe i po tytule/dacie; pełna treść decyzji po sygnaturze. Read-only, bez klucza.

GPT-5.2 strategic advisor with deep reasoning. Read-only access for architecture decisions, security analysis, and complex debugging.

Block destructive shell commands before execution. Prevents rm -rf, git push --force, AWS deletions, and more.

AI-powered threat modeling toolkit with STRIDE/PASTA framework support. Analyze architecture, discover threats, verify controls, and generate comprehensive security reports.

Recipe skill that turns Claude Code's built-in /batch into a security-migration tool: 7 copy-paste batch recipes (XSS innerHTML→textContent, HTTP→HTTPS, SQLi parameterization, input validation, log PII redaction, secret rotation, dependency CVE patches), each with a safety tier and false-positive trap, plus scan_diff.py — a before/after plugin-security-checker gate that fails on any new HIGH/CRITICAL finding.

Professional cybersecurity policy document generator using 51 industry-standard templates from SANS and CIS Controls. Creates complete, framework-compliant policy documents (Markdown, Word, HTML, PDF) customized for your organization. Covers 15 security categories with mappings to ISO 27001, SOC 2, NIST CSF, CIS Controls v8, and GDPR.

Comprehensive GDPR compliance auditing plugin that analyzes static code files, database schemas, and configurations for EU data protection regulation compliance. Includes 8 reference documents, 5 automated scanning tools, and generates detailed compliance audit reports.

5 security enforcement hooks for vulnerability scanning and compliance

Professional incident response playbook generator based on NIST SP 800-61r3 (April 2025). Creates comprehensive, customized IR documentation for ransomware, data breach, and phishing incidents with GDPR Article 33/34 and HIPAA breach notification guidance. Includes NIST CSF 2.0 function mapping and 110KB of authoritative reference data.

Advanced security scanner for Claude Code plugins with 91 specialized pattern detection agents. Performs static code analysis using IntelligentOrchestrator with consensus voting, AccuracyCache shared learning, and MITRE ATT&CK/ATLAS framework mapping. Detects vulnerabilities, code obfuscation, hardcoded credentials, and security anti-patterns. Successfully scanned 987 real-world plugins with 100% accuracy. Includes adaptive routing, auto-evolving rules, and comprehensive reporting.

Auto-approve safe bash commands using safecmd's allowlist validation

Security review guidance for agent configs, MCP and filesystem exposure, red-team scenarios, and audit prompts.

Ready-made Claude Code hooks for security and compliance: a ConfigChange audit trail (JSONL log of every settings/skills change), PreToolUse guards for destructive shell commands and sensitive-file writes, and an optional HTTP security-event notifier. Covers command, prompt, and http hook types.

Pre-built Claude Code auto-memory templates for security/compliance: false-positive suppressions for the plugin-security-checker, npm/PyPI supply-chain hardening rules, and an org compliance-context skeleton.

Professional security report generator with HTML, PDF, and DOCX output. Transforms raw plugin-security-checker results into executive-ready reports with context-aware analysis reducing false positives by 85-90%. Features MITRE ATT&CK/ATLAS/OWASP/CWE framework mappings, customizable branding, and three report templates (Executive, Technical, Compliance). Includes unified version system and comprehensive severity adjustment rules.

ServiceNow MCP server — 67 tools, plan-and-apply write safety, capability preflight and an ACL security scan. Add with: /plugin marketplace add IvanBBaev/servicenow-mcp-ai

PreToolUse hook — validates Bash commands through agent-callable deny-by-default policy before execution

AI skill for Python backend development - FastAPI, SQLAlchemy, Redis, security patterns

Intelligent permission gate for shell, file, search, Skill, and MCP tool surfaces. AST-parses Bash commands, guards file reads/writes, and blocks configured tool invocations. Tracks manually approved commands for permanent rules.