Skarn guard: agent plugins

The Skarn guard is a pre-execution hook: before your agent runs a shell command, applies a patch, writes a file, fetches a URL, calls an MCP tool, or sends a prompt, the Skarn detection engine returns deny, ask, or allow. It scans locally, makes no network call, and prints no raw secret.

Install

Install the skarn binary first; every hook calls skarn guard on PATH.

brew install skarn-security/tap/skarn

The buttons add the local MCP server; the table installs the guard.

Both buttons register the server as skarn and run skarn mcp from your PATH, so install the binary first. If you would rather not install it, the pinned launcher form works with only Node present: Cursor or VS Code - it downloads @skarn-security/skarn@0.31.0 on first run and reuses the npx cache afterward; a newer Skarn needs a newer link.

Both guard plugins carry the skarn-audit skill. skarn-recall, a skill-only plugin in the same marketplace, reconstructs your past work from transcripts: claude plugin install skarn-recall@skarn, or codex plugin add skarn-recall@skarn.

Related MCP server: netallion-mcp-lite

Local MCP server

The four guard units declare the same stdio MCP server, started with skarn mcp.

{
  "mcpServers": {
    "skarn": {
      "command": "skarn",
      "args": ["mcp"]
    }
  }
}

It exposes four read-only tools: scan_sessions, vet_configs, list_sessions, and session_stats. Findings are redacted; metadata and aggregates carry no message content. Two content tools, search_sessions and get_session, appear only under skarn mcp --enable-recall, which these declarations omit.

Without the binary, a pinned launcher works:

{
  "mcpServers": {
    "skarn": {
      "command": "npx",
      "args": ["-y", "@skarn-security/skarn@0.31.0", "mcp"]
    }
  }
}

Keep the version pinned; skarn vet reports the unpinned form as vet-mcp-unpinned.

Audit first, then enforce

Both guard plugins ship in audit mode. Audit reports the would-be verdict and changes nothing. SKARN_GUARD_LOG=<path> in the agent's environment logs one redacted record per flagged call. Once the log is clean, change --guard-mode audit to --guard-mode enforce in the plugin's hook entries. skarn setup --update --mode enforce flips only the skarn guard hooks in a host's own config, so it leaves these plugins in audit. Enforcement runs on any paid tier; without one the guard stays in audit, so a lapsed license does not break your editor.

Updating

claude plugin marketplace update skarn
claude plugin update skarn-guard@skarn

codex plugin marketplace upgrade
codex plugin add skarn-guard-codex@skarn

Plugin and binary updates are independent.

Safety

The guard only tightens a decision. Claude Code, Codex CLI, and Gemini CLI fail open: a guard error yields allow, unless a licensed enforce runs --strict, which also gates Read. The Antigravity CLI fails closed on every outcome except an explicit allow, in audit as well as enforce: a crash, a timeout, invalid JSON, or a missing skarn binary blocks the matched call. Install skarn before wiring that hook, and remove the entry before uninstalling it.

Transcript content the recall skill reads leaves your machine for the model provider serving the agent; redaction masks the credentials Skarn detects, not everything you would call sensitive.

License, privacy, and support

This repository is MIT licensed and carries configuration only; see LICENSE. The skarn binary is a separate, closed-source download under the Skarn End User License Agreement at https://getskarn.com/terms/, which running it accepts. What it reads and what stays on your machine: https://getskarn.com/privacy/. Support: hello@getskarn.com. Vulnerability reports: security@getskarn.com.