Clear limits for Claude, and a way back.
The guard, the vault, and the Doctor: how ClevSkill sets Claude up with clear limits, keeps your secrets encrypted, and watches your setup. Each item shows whether it is available now, in preview, or planned.
How does ClevSkill put limits on Claude?
In Claude Code, a guard checks every Bash command before it runs. Known destructive commands are stopped, and shell deletes are backed up first; you restore a backup from the command line. Keys you add are encrypted in an AES-256-GCM vault, and Claude Code tool calls go into a hash-chained log on your PC. Cowork has no hooks, so there ClevSkill guides Claude with written rules and you approve deletes and sends.
What is enforced, and what is guidance
Claude Code has hooks, so ClevSkill can stop an action there. Cowork has no hooks, so ClevSkill cannot block an action there. It builds instructions you paste into Cowork and a workspace folder with working rules; Claude follows them, and you approve deletes and sends.
- AvailableWorks in the current release.
- Limited previewWorks with limits, or not released yet.
- PlannedNot built yet.
- Not supportedThe surface does not allow it.
| Protection | Claude Code | Cowork | Third-party MCP servers |
|---|---|---|---|
| Known destructive Bash commands stopped before they run | AvailableA hook in Claude Code | Not supportedNo hooks. Instructions ask Claude to check with you. | Not covered. The guard reads Bash commands only. |
| Shell deletes backed up first, restorable from the command line | AvailableA hook in Claude Code | Not supported | Not covered |
| Folders put off-limits | AvailableApplies to Claude's file tools | Guidance: connect only the folders you choose. | Not covered |
| Local log of tool calls | AvailableA hook in Claude Code, wired at setup | Not supported | To verify |
| Web pages checked before Claude fetches or browses | AvailableA hook in Claude Code, wired at setup | Not supported | To verify |
| Email links and attachments checked | AvailableRuns when you ask | Not supported | Not covered |
| Keys in an encrypted vault | Available | Keys listed, with a guide to move them. Automatic movePlanned. | Keys in their config are listed by the Doctor and moved by hand. |
| Your rules and instructions | Available | AvailableYou paste them | Not applicable |
| Usage cost and quota alerts | Available | Not supported | Not applicable |
The guardrails
In Claude Code, a guard inspects every Bash command before it runs. It does not see PowerShell commands, file edits, MCP tool calls or Cowork:
| Operation | What happens |
|---|---|
| Known destructive commands (wiping home or root, protected folders), disk formatting, raw disk writes, fork bombs, destructive git resets | Stopped before they run. |
| Ordinary deletes, moves, overwrites | Backed up first to a local recycle bin, then allowed. You restore the copy from the command line. |
| Classic mistakes: overwriting a real file with an empty one, truncating a non-empty file | Blocked as mistake traps. |
| Bulk deletes over a size cap | Blocked until a full backup exists. |
| Backups | Recorded with a timestamp and the exact command. Stopped commands are not written to a log. |
The app also tracks what it wrote. Your Claude settings can be changed by another tool, by a project you open, or by you, and ClevSkill remembers the last version it wrote so it can show you exactly what changed since: which permissions, hooks or environment names were added or removed. Seeing a change is not automatically bad, so nothing is reverted for you. You can put the file back to the last version ClevSkill wrote, which keeps the configuration you set through the product and saves a copy of the current file first. If ClevSkill has never written your settings there is no baseline to compare against, and it says so rather than reporting no changes. Secret values never appear in that report; only the names of environment entries.
Separately, you can put a folder off-limits entirely. Name it in Safety > Protect a folder (or pick it with Browse) and Claude's file tools are blocked from it. ClevSkill's own checks honour the same list, so the secret scan will not look inside a folder you marked off-limits, and the Safety screen shows you exactly which folders are protected, flagging any whose folder has since been renamed or deleted. Stated plainly, because it matters: this blocks Claude's own file tools, including searching and file commands like cat. It cannot stop a separate program Claude runs from opening the file itself. It removes accidental exposure, not a determined one.
Around the guard sits the security suite. Email links and attachments are checked when you ask: local checks always, plus VirusTotal if you connect a free key (file fingerprints are looked up; unknown attachments up to 32 MB are uploaded for analysis; files in protected folders are never uploaded; verdicts cached 24 hours). If you also turn on the optional Cloudmersive scanner, the file itself is uploaded to Cloudmersive for a second opinion. Web pages are checked before Claude Code fetches or browses them. Untrusted text is checked for injection patterns, outgoing messages for keys and personal data, and MCP configs are audited after each edit.
What the Doctor monitors, weekly, per desktop
| Area | What we check |
|---|---|
| Skills health | Every installed skill examined for breakage, missing pieces, and rot |
| Setup integrity | Claude installation, paths, and configuration drift |
| Safety floor | The guard and safety hooks are present and wired |
| MCP connections | Server configs audited for problems and unsafe entries |
| Memory hygiene | CLAUDE.md and memory files checked for token-wasting bloat |
| Secrets posture | Plaintext .env files flagged; same-name collisions across projects detected and surfaced for resolution |
| Usage cost | Spend vs your weekly cap, with 50% and 80% alerts |
| Usage quota (tokens) | Rolling 5-hour and weekly token windows vs your plan, with alerts before a hard limit |
| Supply-chain risk | Foreign (non-catalog) skills scanned for risky patterns before you trust them |
| Model deprecations | Deprecated Claude model ids in your config flagged before an update breaks them |
| Machine checks | OS-level snags (on Windows: .claude in OneDrive, long-path support, execution policy, Defender quarantine) |
| Version drift | Claude version vs current, plus our signed update channel |
| Pack reconciliation | Curated pack skills that should be installed but are missing; your own and third-party skills inventoried and kept, never removed |
| Third-party packs | Recognized external packs reported by name, version, and source |
| Deep scan status | Whether the optional deep-scan tooling is set up, and any drift the weekly deep scan found |
| Auth + plan health | Claude sign-in and subscription (plan) checked; auth failures diagnosed and reported. Optional: if you turn it on and set a weekly spend cap, launches through ClevSkill can switch to your vaulted API key when the subscription sign-in fails, and switch back when it recovers. |
On Govern, results land on your team health view (verdict, last scan, must-fix and recommended counts, cost-cap usage per desktop, stale detection at 14 days) and in the Monday "Your AI is healthy" email. What reports out: finding counts, skill and check names, and short finding messages, redacted on your PC and checked again on our server, plus redacted error-log excerpts when the app crashes and the fingerprint of your audit-log signing key if you set one. Never file contents, configs, keys or chat history, and only if you opted in at enrollment. Repairs are always consent-gated.
The Vault: encrypted key storage on your PC, with controlled app launch
Keys you move in, your license, and your seat token live in an AES-256-GCM encrypted vault on your own machine, with the master key held by your operating system's keychain (Windows Credential Manager). Four scopes (personal, project, client, company) resolve at read time, a collision detector catches same-named keys, and every access is written to a local audit log. A key export is always an encrypted, passphrase-protected bundle you create yourself.
Storing a secret
In the installer's Connect or Keys screens: the field is masked, the value travels straight into the vault (never on a command line, never in a log, never echoed back), and where the provider supports it the key is validated live before storing; a wrong key is rejected, not saved. Already have keys in plaintext .env files? The Keys screen finds them, moves the ones you pick into the vault, and retires the file reversibly.
Using it with your tools: VS Code, GitHub, Antigravity, anything
The vault's clevskill-run launcher (a script in the vault skill folder; the installer does not add it to your PATH yet) resolves your keys from the vault and injects them into the process you start, so any tool that reads environment variables just works: clevskill-run -- code . for VS Code, clevskill-run -- gh pr create for GitHub CLI, the same pattern for Antigravity, n8n, or your own scripts. Zero code changes. A per-project manifest lists key NAMES only (safe to commit); when a tool insists on a .env file, an ephemeral one is generated and shredded when the process exits.
How AI agents use it, safely
Claude can see WHICH keys exist (the maintenance connector lists names only, never values), and agents use keys without seeing them: a value reaches a program through the environment of a process launched through the vault. ClevSkill's MCP tools never return key values; a test checks this in every release. In the default Warn mode, an agent can still read a key from the vault command line, and the call is logged. Enforce mode refuses vault reads and changes from an agent session: on Govern it is a button on the Vault screen, and on any plan it can be turned on from the console. Your license is kept safe too: the installer's Enroll step stores it encrypted, with no plaintext copy on disk.
Moving machines
Only the optional keys file in a migration is encrypted. Your settings, CLAUDE.md and any memory you include are copied as plain files, so keep the migration folder as safe as the PC itself. Keys travel inside that encrypted, passphrase-protected file, or you re-enter them on the new machine; the migration tool tells you exactly which keys you actually use.
MCP tool governance: what Claude can and cannot touch
Claude uses MCP tools to interact with your ClevSkill setup. Every tool is classified: read-only tools run freely; write tools require your explicit approval and take a snapshot first.
| Tool class | Examples | Behavior |
|---|---|---|
| Read-only (10 tools) | health check, detect, diagnose, list packs, vault list, cost status, audit, scan, MCP self-audit, Claude version check | Claude runs them any time. No state changes, no prompts. |
| Consent-gated (4 tools) | install pack, repair, self-heal, rollback | Requires your approval before running. A snapshot is taken before the operation. If anything goes wrong, one command reverts it. |
This is the same principle as the guard applied to MCP: Claude can read status freely; anything that changes your setup waits for your approval. The audit log records every tool call, consent decision, and snapshot reference.
Memory management
Bloated memory files silently burn your Claude plan: every session re-reads them. The weekly scan flags CLAUDE.md and memory files that have grown past healthy size, the token optimizer trims them with your approval, our generated configs follow a strict keep-it-short discipline from day one, and your memory travels with you when you move or copy your setup between computers.