Bright Lines – a fail-closed guard hook for Claude Code

A new open-source safety system called Bright Lines has been released to add guardrails to Claude Code, Anthropic's AI coding assistant. The tool creates a supervised, fail-closed environment where Claude can read project files freely but must ask permission before making edits, executing commands, performing web lookups, or using helper agents. The system outright refuses a specific list of dangerous actions even if a user mistakenly approves them.

How It Works

Bright Lines operates through four layers of protection. First, Claude Code permissions are configured with reading pre-approved but edits, commands, web access, and agent use requiring permission. Second, a guard hook script (.claude/safe/guard.py) runs before every tool call and refuses dangerous actions regardless of user approval. Third, human approval serves as the final checkpoint. Fourth, backups and version control provide recovery options if all previous safeguards fail.

The system specifically blocks bulk deletions, pushing or publishing code, sending data over networks, reading password files, scheduling background tasks, installing software, financial transactions, and attempts to modify its own rules. It also reminds Claude after web fetches that fetched content is data, not instructions, helping prevent prompt injection attacks.

Limitations and Testing

Despite its protections, Bright Lines has known limitations. It cannot run unattended or on schedules, and it won't let Claude create its own projects or modify its settings. The pattern-matching guard can be bypassed by harmful scripts, complex command construction, archives, shell aliases, or indirect secret access. The developers tested the system against approximately 300 crafted commands and tool calls, catching all issues a hook could reasonably detect.

Requirements and Setup

Bright Lines requires Claude Code and Python 3.8 or higher. It has been tested on Linux with Claude Code versions 2.1.280 and 2.1.322. The system includes a setup checker to verify guards are working before deployment and implements per-session caps to control costs. Installation takes about 15 minutes according to the documentation, which includes plain-language instructions and explanations of what the system will and won't do.

The project is released under an MIT license and is not affiliated with or endorsed by Anthropic. Developers can find the code on GitHub, where it includes comprehensive documentation about its threat model, capabilities, and limitations. The system represents an approach to AI assistance that balances helpfulness with security, allowing developers to leverage AI tools without exposing their entire system to potential risks.