LoopGrid's purpose is verifiable evidence, not a replacement for Claude Code permissions, a trusted host, or the downstream business system.

• Credentials. Configure the optional service_key using Claude plugin sensitive userConfig (or CLAUDE_PLUGIN_OPTION_SERVICE_KEY for a session-only developer test), using the minimum scopes (ingest for evidence, read for verification, review only in a trusted human review flow). Never place secrets in a skill, MCP tool input, review text, or evidence payload.
• Enforce mode. Only applies to configured tool names and only when the synchronous PreToolUse hook runs successfully. Deny on unavailable policy/Core, missing tool-use IDs, mismatched verdicts, and local ledger errors. Claude Code's own permission and organizational rules still apply; do not change them to make this plugin work.
• Hook failure boundary. Command hooks can be disabled, interrupted, misconfigured, timed out, or superseded by host/admin settings. No third-party plugin is an OS-wide or cryptographically isolated policy enforcement boundary. Protect critical external APIs in the backend as well.
• Policy scope. The v0.8 Core amount_threshold evaluator does not make generic shell commands safe. An auto_allowed result only covers the exact action evaluated, under the Core's current rule. The amount may be model supplied. Do not treat model text or user-provided amount as independently attested business facts.
• Human review. MCP review is disabled by default. The model must not impersonate a human or invent review authorization. This v0.1.0 hook gate blocks human-review-required decisions rather than inventing a resume mechanism.
• Evidence integrity. Signature/chain verification proves only integrity and provenance under a trusted key, not completeness or business truth. MCP service-side verify is not independent offline verification.
• Scope and consent. The plugin registers PreToolUse, PostToolUse, and PostToolUseFailure for matching shell, file-editing, and MCP tool names. By default the handlers exit without reading tool input, persisting records, or contacting Core (LOOPGRID_CLAUDE_MODE=off). An operator must explicitly enable observe or enforce and activate each relevant project using .loopgrid/claude-code.enabled at its root (as given by CLAUDE_PROJECT_DIR). The activation check precedes reading hook JSON, SQLite access, or network activity. Without a trustworthy project-root environment variable, the hook stays inactive. In enabled projects captured tool activity may span matching tools; scope LOOPGRID_CLAUDE_TOOLS narrowly. The marker is a project-selection control, not a tamper-proof enforcement or admin authority boundary. MCP tool calls are user-initiated or model-invoked through Claude Code permissions.
• Hook configuration scope. The hook reads only explicitly named Claude plugin settings and LoopGrid operational variables through os.getenv; it does not enumerate the process environment as its configuration or use an inherited LOOPGRID_SERVICE_KEY. The Python subprocess and package manager still inherit OS environment data from the host, which the hook cannot comprehensively prevent.
• Privacy. When enabled, the hooks make network requests to the operator-configured LOOPGRID_BASE_URL only. They send tool names, canonical SHA-256 commitments of tool inputs/results, hashed session/tool IDs, and numeric amount when present; they do not transmit raw tool arguments or result text via the hooks. Core may receive additional user-approved content through MCP evidence tools. No raw secrets are intentionally persisted in local SQLite. Hashes of low-entropy inputs may leak information through guessing. This plugin has no third-party analytics or telemetry endpoint.
• Dependencies and subprocess isolation. The declared MCP command uses pinned uvx loopgrid-claude-launcher==0.1.0; this separate published Python launcher depends on the unchanged loopgrid-mcp==0.1.0. After uvx starts the package, the Claude-only Python launcher forwards only an allowlist of required OS/runtime settings and explicitly mapped Claude plugin options. It does not forward arbitrary installer environment credentials, machine-wide LOOPGRID_SERVICE_KEY, general PYTHONPATH, or inherited proxy URLs (which may contain credentials). Corporate proxy-dependent networks may require an alternative, explicitly reviewed configuration. Review the pinned package, registry-resolved uv.lock dependency snapshot, and Core endpoint before running the plugin. Important: uvx begins with the installer environment before the launcher can filter it, and direct uvx execution does not honor this project lockfile as a runtime --locked switch; this is a remaining supply-chain boundary.
• MCP transport. The Claude-only launcher accepts http://localhost, http://127.0.0.1, or IPv6 loopback for local Core; remote Core origins must be HTTPS. The upstream MCP client also disables HTTP redirects. The hook already enforces a matching HTTPS-or-loopback origin restriction. Configuration is provided by the operator, not generated by an MCP tool invocation.
• After execution. PostToolUse only reports the tool response. An evidence-write failure marks the local record needs_reconciliation; it cannot roll back an external tool. Never retry payments or other side effects solely because evidence persistence failed.
• Network transport. A remote Core endpoint must use HTTPS. The hook refuses HTTP redirects for signed service-key requests. Keep the service-key environment private.
• Local state. State goes into ${CLAUDE_PLUGIN_DATA} when supplied by Claude Code, otherwise ~/.loopgrid/claude-code/. Files are not tamper-proof against a local privileged user. Secure the host appropriately.

Report vulnerabilities privately via the repository's security advisories when created, or to hello@loopgrid.io.