Runtime tool-call governance for Claude Code. Layer-1 regex deny on Bash/WebFetch/WebSearch. Layer-2 conformal risk classifier on mcp__* tools. Hash-chained SQLite audit trail at ~/.vaara/claude-code/audit.db.
Add the marketplace (inside Claude Code):
/plugin marketplace add vaaraio/vaaraInstall the plugin:
/plugin install vaara-governance