Claude Code integration

PreToolUse checks a WebFetch target before the request is sent. PostToolUse filters WebSearch results as defense in depth.

Failure semantics

The client treats empty output, invalid JSON and non-zero hook exit status as distinct failures. It never silently substitutes unfiltered documents. Short-lived account tokens belong in process memory or an operating-system credential facility, not project files or browser storage.

{
  "hooks": {
    "PreToolUse": [{"matcher":"WebFetch","hooks":[{"type":"command","command":"python scripts/pretool_url_check.py"}]}],
    "PostToolUse": [{"matcher":"WebSearch","hooks":[{"type":"command","command":"python scripts/filter_search.py"}]}]
  }
}