Tatu: Open-source security layer for Claude Code blocks secrets and destructive commands
What Tatu does
Tatu is an open-source security layer built specifically for Claude Code. It functions as a hook system that intercepts every Claude Code action in real time before execution.
Key security features
- Blocks leaked secrets (like AWS keys written to config files)
- Flags PII (personally identifiable information)
- Denies destructive commands (such as 'rm -rf' in wrong directories)
Deployment and setup
Everything runs on your own infrastructure. The installation process is straightforward:
pip/pipx install tatu-hook
tatu-hook initThis puts you in audit mode immediately. The developer notes it's been running in production for them for a while, though it's still early days for the project.
Source information
The tool was created by a developer who has been using Claude Code heavily for months and became concerned about potential security risks. The motivation specifically mentions preventing AWS keys from being written to config files and avoiding destructive commands like 'rm -rf' in incorrect directories.
GitHub repository: github.com/laboratoriohacker-com/tatu
Project site: https://tatu.sh
📖 Read the full source: r/ClaudeAI
👀 See Also
AutoSkillUpdate: A Claude Code Plugin That Detects Outdated Skills
AutoSkillUpdate is an open-source Claude Code plugin that scans your codebase, compares it against existing skills, and identifies drift. It provides drift reports with file paths and line references, then offers to rewrite outdated skills with user confirmation.
Tendril: A self-extending agent that builds and registers tools on the fly
Tendril is an agentic sandbox that autonomously discovers, builds, and registers tools. It starts with just three bootstrap tools and dynamically grows its capability registry without asking the user.
BusyDog Desktop: A Local AI Agent with P2P Networking for Mac
BusyDog Desktop is a local AI agent that runs Claude directly on a Mac, can read/write files, run terminal commands, control browsers, and connect with other agents via a P2P network using Hyperswarm DHT and a custom BDP protocol.
Graph Compose: Hosted Temporal Workflows with Visual Builder and AI
Graph Compose is a hosted platform for orchestrating API workflows on Temporal, letting you define workflows as JSON graphs with three building methods: a React Flow visual builder, a TypeScript SDK, and an AI assistant that converts plain English to graphs.