Semgrep Guardian

Claude Code: /plugin marketplace add anthropics/claude-plugins-official → /plugin install semgrep@claude-plugins-official

The design decision here is the hook, not the scanner. Guardian ships a compiled hook binary per platform and registers it so analysis fires when a file is written rather than when someone remembers to ask — the difference between a security tool the agent may call and one it cannot skip. Semgrep Code, Supply Chain and Secrets all run over the generated file, so vulnerable patterns, malicious dependencies and hardcoded credentials are covered in a single pass. When something is found the agent is pushed to regenerate until the result is clean or the finding is dismissed on purpose. A small install skill inspects shell configuration first, then puts the binary on the path.