Function Hooks land in the CLI. This release ships the --function-hook flag,
which installs any of the 10 function hooks from the catalog as a local Claude
Code plugin.
Function hooks are Claude Code's proposed fifth hook type
(anthropics/claude-code#91870):
instead of a shell command that can only allow, deny or inject text, you write a
TypeScript module whose hooks take ($, e, next) — Express/Koa middleware, but
for tool calls. They can rewrite a tool's input, return their own result in place
of the tool, keep state, and draw UI.
Install
npx claude-code-templates@latest --function-hook security/secret-redactorThat writes the plugin to .claude/skills/<name>/:
.claude/skills/secret-redactor/
├── .claude-plugin/plugin.json
└── hooks/
├── hooks.json # { "modules": ["./secret-redactor.ts"] }
└── secret-redactor.ts
Then run Claude Code with the experimental flag:
CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1 claude --plugin-dir .claude/skills/secret-redactorThe 10 hooks
| Hook | What it does |
|---|---|
security/block-destructive-commands
| Denies rm -rf /, force push, hard reset, destructive SQL
|
security/secret-redactor
| Redacts keys, tokens, JWTs and connection strings in tool output |
security/protected-paths-guard
| Denies edits to .env, lockfiles, CI workflows, private keys |
security/large-edit-confirmation
| Asks before editing a file over N lines |
productivity/npm-to-pnpm-rewriter
| Rewrites npm/npx to pnpm, yarn or bun |
productivity/webfetch-cache
| Serves repeated WebFetch calls from a session cache |
observability/universal-audit-log
| JSON line per event, including denials |
ui/tool-timing-badge
| Times every tool call, draws a badge on the ToolUse row |
integrations/websearch-to-exa
| Replaces built-in WebSearch with Exa |
enterprise/admin-capability-lockdown
| Withholds http/process from $, allowlists plugins
|
Browse them at aitmpl.com/function-hooks.
Experimental — read this first
Function hooks are not a shipped Claude Code feature. They are a proposal, and
the environment variable, the modules key and every $ API name may change.
That said, the engine is already compiled into Claude Code 2.1.266, and we verified
it: security/secret-redactor runs unmodified against the real binary, redaction
fires on both Bash and Read, and a follow-up command carrying a redacted
placeholder is denied before execution.
Two limits worth knowing about secret-redactor: it matches by shape, so
PASSWORD=hunter2 passes untouched; and its connection-string pattern stops at the
@, so credentials are removed but host, port and database name are not.
The full write-up, including the $ surface found in the 2.1.266 binary:
Function Hooks in Claude Code.
Also in this release
- Blog article corrected against a real 2.1.266 binary (#875)
- Function Hooks section, catalog entries and dashboard listing (#867)
Full changelog: v1.29.2...v1.29.5