ModsCode / Claude Code Mods / Ranking / hy-guard
hy-guard
Routes company MCP tools through a security gateway. Every request is signed with a device-bound key (DPoP); policy decides which tools the model can see.
What it does
- Draws a pane, a band above the prompt
- Adds /mcps
- Hooks session.start
Good points
- No network calls
- Starts no processes
- Small: 264 lines
- Written in TypeScript
Code to start from
A starter ModsCode writes from the drawing it read, and the mod's own lines that draw, where there are any.
Starter (register.tsx)
import type { Register } from 'claude-code'
// Drawn like hy-guard by HackYeah team (pane, band, status, toast), as ModsCode read it from the mod's code:
// https://modscode.com/claude-mods/mods/localhost2137-hy-guard/
// Written by ModsCode from that reading, not copied from the mod: use it as you like.
// Each value below stands for one the mod works out at run time; put in your own.
export const register: Register = on => {
// the pane: open it with $.ui.open({ id: 'my-pane', title: "Company MCP servers" })
on('ui.render', { component: 'Pane', requestId: 'my-pane' }, async ($, e) => {
const { Box, Text, Button } = $.ui.resolve(e)
const length = '…'
const length2 = '…'
const i = '…'
const name = '…'
const tools = '…'
return (
<Box flexDirection="column">
<Text dimColor>
{length}
{" of "}
{length2}
{" on. Applies to this session only."}
</Text>
<Button hotkey={`${i}`} label={`[ ] ${name} (${tools} tool)`} />
<Button hotkey={`${i}`} label={`[ ] ${name} (${tools} tool)`} />
<Button hotkey={`${i}`} label={`[ ] ${name} (${tools} tool)`} />
<Box>
<Button hotkey="a" label="All on" />
<Text>
{" "}
</Text>
<Button hotkey="q" label="Close" />
</Box>
</Box>
)
})
// the band above the prompt; what else goes there is drawn under it
on('ui.render', { component: 'AbovePrompt' }, async ($, e, next) => {
const { Box, Text } = $.ui.resolve(e)
const title = '…'
const tool = '…'
const args = '…'
return (
<Box flexDirection="column" borderStyle="double" borderColor="yellow" paddingX={1}>
<Text bold color="yellow">
{title}
</Text>
<Text>
{tool}
{" "}
<Text dimColor>
(
{args}
)
</Text>
</Text>
<Text dimColor>
Requested by Claude Code on this Mac. Cancel in the macOS prompt if you did not ask for this.
</Text>
{await next(e)}
</Box>
)
})
}
The mod's own code
Its licence text was not found at the commit read, so only the places in the source are linked.
How to build this: Pane (panel), Add a slash command
What its code calls
writes filesenv varssettings hooksships servers
What its code shows
Read from the source at commit 160a3a9420df on 2026-10-11. The first group decides whether a mod is listed; the rest is for you to weigh. A later commit is not read until the next crawl.
| Decides the listing: code you can check | |
|---|---|
| Entry read | Every module hooks/hooks.json names was read.claude-plugin/plugin/hooks/ui.tsx |
| Parses | Every file parses as TypeScript or JavaScript.1 files parsed |
| All its code is in the mod | Every import is a file of the mod or the engine's own module; no packages, no require.all its code is in the mod |
| Readable | No minified lines, no eval or new Function, no import of a computed path, no encoded blobs.no minified code, no eval, no encoded blobs |
| Calls in the open | Network and programs are reached as $.http.fetch and $.process.run in place, never passed around.every call outside goes through $ in the open |
| For you to weigh before installing | |
| Where it draws | The terminal, the desktop app, both, or nothing (hooks only: a guard or a prompt rewriter), as its code says. Shown, never a reason to leave a mod out.draws in the terminal and the desktop app, the same in both |
| Install line | Whether its repository's own .claude-plugin/marketplace.json lists it, so it installs from that marketplace with the lines on its page.its repository's .claude-plugin/marketplace.json does not list it: no marketplace line to give; the page shows how to try the commit read |
| Programs on Windows | Whether every program it starts through $.process exists on Windows (tail, date, open, osascript, /usr/… do not).runs no program a Windows PC lacks |
| Network | Whether every fetch names its https host in the code.no network |
| Programs | Whether every program it starts is named in the code and is not a shell, an interpreter or a network tool.node (a settings hook), node (an MCP server) |
| Reads and sends | Whether it both reads something of yours (files, environment variables, the transcript, settings) and reaches outside (the network, an MCP server, another session, telemetry).reads environment variables, files, but reaches nothing outside |
| Keys in the source | Whether the source holds what looks like an API key or a private key.no keys in the source |
| Licence | An open licence (MIT, Apache-2.0, BSD, ISC, Unlicense, 0BSD, CC0) with its text lets ModsCode show its code; otherwise the code is linked.no licence |
| Settings hooks | Hooks declared in hooks/hooks.json or plugin.json beside the module: a command (a shell when it has no args), an HTTP request, an MCP tool or a model prompt at an event. They run outside $.SessionStart: node; PreToolUse: node |
| Servers it ships | MCP servers (a program, or a URL; a headersHelper is a shell command; a .mcpb bundle is unpacked at run time), LSP servers, monitors (a shell command for the whole session) and bin/ (on the PATH of the Bash tool).mcp gateway: node (a user_config value in its env) |
| Skills, commands, agents | What its Markdown declares beyond text: allowed-tools granted for the turn, hooks added when a skill is invoked, a command run before Claude reads the skill.2 skills: text only |
| Tools and MCP | Whether every tool it calls through $.tool.call and $.mcp.call is named in the code, and none is a shell (Bash through the tool runs a shell without $.process).calls no tool, MCP server or command |
| Asks of the model | Completions it runs ($.model.complete, fork, classify), subagents it spawns, prompts it submits as you, and the tools, commands and agents it adds.adds command mcps |
| Events it hooks | By what a hook there can do: gates (refuse a tool call, a prompt, a setting, another plugin), shapes (what the model reads: the system prompt, tool descriptions, each request), reads (your input, the events of the settings hooks, every event with *), and the rest.gates: command.run (mcps) · also: session.start, ui.render (Pane, ToolGroup, ToolUse (+1)) · timers: clock.every |
| Reads, by name | The environment variables and files it names, and whether it reads the transcript, settings.json, the prompt box or the mouse selection.env: HY_UI_CARDS, HY_UI_STATUS, HY_UI_BAND, HY_DATA_DIR; files: its own folder/.runtime/data-dir, …/ui-state.json |
| Writes, by name | The files and environment variables it names, and whether it changes settings, the prompt box, the clipboard, the conversation (a row the model reads) or another session.files: a path computed at run time |
This is a reading of the code text, not a security review: it does not run the mod, and it cannot see what a program the mod starts does. The check before installing is yours. How mods are chosen
Install it
Check it yourself before you install it. Mods run unsandboxed, with your permissions, and ModsCode does not vouch for what this code does. Read its code (or run claude plugin validate . in its folder), weigh what it reaches, and install the commit you read.
Its repository's .claude-plugin/marketplace.json does not list it, so there is no marketplace line to give.
Try the commit ModsCode read
No marketplace needed. In a terminal, clone the repository, check out the commit read, validate the mod, and load it for one session:
git clone https://github.com/localhost2137/HackNahgit -C HackNah checkout 160a3a9420df9c0ef9fd23f9b3797ff85f2f4755claude plugin validate HackNah/claude-plugin/pluginclaude --plugin-dir HackNah/claude-plugin/pluginThe validate line lists the events the mod hooks and what it asks Claude Code to do, without running it. The last line loads the mod for this session only and writes nothing to your settings. If the author has rewritten history, the commit may no longer exist.
Ask Claude about it
With the ModsCode connector added, Claude can read this mod's code and what it reaches, and build on them. Ask it like this:
Read the ModsCode mod "localhost2137-hy-guard" with its code and make me one like itSearch them from Claude: the MCP connector
Similar mods
- code-modernizationAnthropic★ 37,653
- crit-tuiTomasz Tomczyk★ 1,196
- remctlFederico Viticci★ 595
- task-orchestrator-modJeff Picklyk★ 208
- localvoxtral-modlocalvoxtral★ 59
- localvoxtral-remotelocalvoxtral★ 59
Badge for your README
If this is your mod, paste this into your README. It links to this page.
[](https://modscode.com/claude-mods/mods/localhost2137-hy-guard/)