A Claude Code PreToolUse hook can deny a matching Bash tool call before it runs. It is a targeted guardrail, not a complete filesystem security boundary: it only evaluates calls that reach the configured hook and match its conditions. For stronger policy, use Claude Code permission rules as well, and do not treat a Bash check as coverage for every tool or shell.
What a PreToolUse hook does
Claude Code runs a PreToolUse hook before the selected tool call executes. The hook can inspect the incoming tool data and return a structured deny decision to block that call. For a Bash tool call, the JSON arrives on standard input, and the command text is in tool_input.command. See Anthropic’s Hooks reference.
As an Amazon Associate I earn from qualifying purchases.
A hook is useful when you want a specific check and a clear explanation for the block. It is not equivalent to parsing and safely evaluating every possible shell command. Anthropic describes Bash if filtering as best-effort and recommends the permission system for hard allow/deny enforcement.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Configure a targeted Bash hook
Choose the settings scope first. Use .claude/settings.json for a project setting that can be shared with the project, or ~/.claude/settings.json for a user-level setting local to your machine. The documented pattern registers a PreToolUse hook with a Bash matcher, then runs an executable script. An optional if filter such as Bash(rm *) can narrow which Bash calls invoke the hook, but it should not be mistaken for a complete command parser.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Here is the shape of the settings entry; replace the script path with the actual executable path you install for your project or account:
{
"hooks": {
"PreToolUse": [
{
"matcher": "Bash",
"hooks": [
{
"type": "command",
"command": "/absolute/path/to/block-rm-rf.sh"
}
]
}
]
}
}Anthropic’s reference also documents an optional if condition on the hook configuration. If you add one, test its behavior in the Claude Code version and on the platform you actually use; the documented Bash filtering is best-effort.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Example hook script
This example performs a literal substring check for rm -rf. It is a deliberately narrow check, not shell parsing. It requires jq to be installed and available on PATH, as in Anthropic’s documented example. Save the script at the configured path and make it executable.
Free tools Windows power users keep installed
One-click scans. No signup required.
#!/bin/sh
input=$(cat)
command=$(printf '%s' "$input" | jq -r '.tool_input.command // ""')
case "$command" in
*"rm -rf"*)
printf '%sn' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Blocked by the rm -rf safety hook."}}'
;;
esacWhen the check matches, the script prints JSON to standard output with hookSpecificOutput, the event name PreToolUse, and permissionDecision set to deny. The reason gives Claude Code an explanation to display. When the script produces no decision, normal permission handling continues; silence does not approve the call.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How the hook relates to permission rules
Hooks and permission rules are complementary, not interchangeable. A hook adds custom logic around a tool call; permission rules provide Claude Code’s built-in allow, ask, and deny controls. A hook’s allow result does not override a matching deny rule, and applicable ask rules still prompt even if a PreToolUse hook returns allow or ask. Review Anthropic’s permission configuration documentation when deciding what policy to enforce.
- Use a hook for a targeted check and a tailored reason when the relevant tool call reaches that hook.
- Use permission rules for explicit allow, ask, or deny policy; do not rely on a hook allow decision to bypass them.
- Consider managed policy when controls need organization-wide scope. Anthropic documents IAM and managed settings separately: Claude Code IAM documentation.
What this hook does not cover
The hook only protects calls that reach the configured event handler and satisfy its matcher and any filter. A Bash rule is not a universal block across shells or tools: Anthropic’s reference shows a separate PowerShell handler. Rules and checks should be designed for the execution paths you intend to control.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The sample above searches command text for one exact substring. It does not establish that every destructive command will contain that text in that form. Shell syntax, quoting, compound commands, command substitutions, wrappers, and alternate deletion mechanisms are reasons to test matching behavior rather than assume the literal check sees every risky operation. The documentation describes the hook mechanism, not a guarantee that this sample safely interprets shell syntax.
Tool-level policy is not an operating-system boundary either. The permissions documentation notes limits to recognizing some indirect file reads and writes through arbitrary subprocesses. Do not assume a Bash hook alone can stop malicious commands, commands using alternate tools, misconfigured hooks, or activity outside the hooked calls.
Test the guardrail before relying on it
- Confirm the settings file is at the scope you intended: project-shared
.claude/settings.jsonor local user-level~/.claude/settings.json. - Check that the configured script exists, is executable, and can find
jqon itsPATH. - Use a harmless test command containing the target text to confirm the hook receives the Bash call and returns a deny decision. Do not test by running a destructive command against real files.
- Test relevant variations of command formatting and shell behavior in a safe environment. A literal substring check should only be relied on for cases you have verified.
- Review the active permission rules separately. A hook does not replace deny/ask policy or extend itself to other tools.
Anthropic’s documentation pages are live references and do not establish a fixed behavior version in the cited material. Check the current Hooks reference and permission documentation if you adapt the configuration, especially as hook schemas or product behavior may change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
