clef-guard
williamchen0606/claude-mods
Has Cloudflare's Clef decision model judge each Bash, Write, Edit and WebFetch call (risk, kind of risk, whether it is read-only, whether it fits your request), asks you itself before risky or always-ask operations, and can approve plain reads for you.