Block dangerous actions with hooks

How to do it

Most agents can run a script before a tool call and stop it. Claude Code, for example, blocks a call when a PreToolUse hook exits with code 2. Block force pushes, deleting folders, editing applied migrations and reading secret files. Commit the settings so the whole team gets them.

Example

#!/bin/bash
# .claude/hooks/block-dangerous.sh, run before every shell command
command=$(jq -r '.tool_input.command')
if [[ "$command" =~ (push\ --force|rm\ -rf\ /|DROP\ TABLE) ]]; then
  echo "Blocked by project policy: $command" >&2
  exit 2
fi

How to check

Ask the agent to run a blocked command, such as git push --force. The hook stops it and the agent reports the reason.