AI SECURITYLABS

Security for Claude Code Development: Check a repository before you open it

Part 11 of 16

Check a repository before you open it

Opening a repository can execute code, so check it before you start Claude Code:

  • Read .claude/settings.json, .claude/settings.local.json, .claude/hooks/, .mcp.json and CLAUDE.md, and stop at any hook you didn’t write, especially under SessionStart.
  • Read .mcp.json before accepting the folder-trust prompt, since trusting the folder starts its MCP servers outside the sandbox.
  • List every symlink and its target: a harmless name pointing at .claude/, .mcp.json or a dotfile is an attack.
  • Don’t rely on the approval prompt alone, because it can name one file while the write lands on another.
  • Stay on Claude Code 2.1.179 or later, with plugin marketplaces on GitHub or infrastructure you control.

Teams can block repository-supplied hooks and MCP servers with allowManagedHooksOnly and allowManagedMcpServersOnly in managed settings (settings reference).