lelu
Integrations

Claude Code Plugin

The MCP integration gives your agent a tool it can choose to call. The Claude Code plugin goes further: it hooks directly into every Bash, Edit, and Write call via Claude Code's own PreToolUse hook, so protection doesn't depend on the agent remembering to ask.

Install

Terminal
git clone https://github.com/lelu-ai/lelu.git && cd lelu
claude plugin marketplace add .
claude plugin install lelu@lelu
./plugin-claude-code/install.sh

install.sh builds from source if you have Go, or downloads a prebuilt binary from GitHub Releases if you don't. No account, no cloud dependency — everything runs and stays on your machine.

What it catches

Expansion-aware analysis resolves ~, $VARS, and globs before matching policy — so it catches destructive commands a regex on the raw text misses (reversed flags, long-form flags, separated flags), while staying silent on routine work like rm -rf node_modules. A real, reproducible comparison against hookify's own documented example rule:

benchmarks/report.md
                        hookify    Lelu
Destructive caught        7/10     10/10
False positives (benign)   4/4      0/4

Shadow mode by default

Nothing is blocked on install. Every decision is still logged to ~/.lelu/claude-plugin/ledger.jsonl regardless of mode — run /lelu:lelu-status inside Claude Code to see what it would have done, and /lelu:lelu-enforce when you're ready to turn on real blocking.

Also included

  • Retry-storm detection — the same action repeated too many times too fast in one session gets flagged instead of silently allowed forever.
  • Session wall-clock budget — a session that's been running for hours gets a one-time review prompt, the same failure mode behind real "$6,000 burned overnight" agent incidents.
  • hookify rule import — existing .claude/hookify.*.local.md rules keep working with zero edits, upgraded from a silent notice to an actual pause for review.

Commands

Inside Claude Code
/lelu:lelu-status    Current mode + a summary of recent decisions
/lelu:lelu-enforce   Start actually blocking deny/ask decisions
/lelu:lelu-shadow    Back to observe-only
/lelu <rule>         Turn a plain-English rule into a policy entry
                     e.g. /lelu never touch the prod database
Previous: MCPNext: Vercel AI SDK