bas-guard
Local, offline security scan for AI agent setups — an "antivirus for your Claude Code configuration". It audits everything an agent auto-loads (skills, MCP servers, hooks, permission grants, subagents, slash commands, instruction files) and reports what carries risk.
It never executes what it scans and makes no network calls of its own. Scanning is read-only;
the one command that writes (clean) only ever moves things inside your config root.
Use it
No install needed — the binary ships inside the package, so there is no install script and nothing is downloaded when you install it:
# vet one skill, plugin or zip BEFORE it reaches a directory an agent loads from
npx --yes @bas.io/guard@latest check ./some-skill
# audit everything the agent on this machine auto-loads
npx --yes @bas.io/guard@latest scan --report
check answers about the thing you point it at, so it means the same wherever you run it.
scan answers about the machine it runs on — on your own computer that is your real
~/.claude, which is the point; in a hosted session or a CI container it describes that
container instead, and the report prints a banner saying so rather than letting a near-empty
box score close to 100 unremarked.
Keep it around for repeated use, and for the load-time gate:
npm i -g @bas.io/guard
bas-guard check ./some-skill # vet one skill/plugin/zip before installing it
bas-guard scan --report # audit this machine's ~/.claude + write an HTML report
bas-guard clean # list duplicate, bloated and stale skills (report-only)
bas-guard version
Exit codes: 0 below threshold · 1 a finding at or above --fail-on · 2 runtime error
(the scan did not happen — never read a 2 as a pass) · 3 clean acted partially · 4 a gate
could not be evaluated (with --fail-on, the root held nothing to check or a project's .claude it
did not read; with --fail-on-llm, the judge could not answer for everything). A run cut
short by a signal ends as 128 + signal, like any Unix program: 130 for Ctrl-C, 141 when
the output pipe is closed (bas-guard scan | head). Anything non-zero that is not 1 or 3 means
you did not get a verdict.
The load-time gate needs a stable path
bas-guard hook install registers the absolute path of the binary it was run from, so Claude Code
can call it before each skill loads. Do not install the gate from an npx invocation: that
path lives in npm's temporary cache and is garbage-collected, after which the hook points at a
file that no longer exists — every skill then loads unaudited while the setup still looks
protected (the scan reports this as GATE-001). Install globally, or use a release binary, when
you want the gate.
What it is, and is not
A static scanner: a relative risk signal, not a safety certificate. It cannot prove intent, observe what a program does at run time, read through an encrypted payload, or tell you what a remote MCP endpoint actually does. "No findings" means no findings from the static rules, which is worth reading as exactly that.
More
Full documentation, the rule reference (every finding ID it can print), the Claude Code plugin, and the platform binaries with checksums: https://github.com/basdotio/bas-guard
MIT.