Claude Code Max:
Context Engineering
Risk Remediation

New Hook: privacy-settings-gate.js

Hook type: SessionStart | Blocking: YES

// privacy-settings-gate.js — SessionStart hook
// Validates Claude Code privacy settings before allowing work

const { readFileSync, existsSync } = require('fs');
const { join } = require('path');

function main() {
  // 1. Check Claude Code telemetry setting
  const settingsPath = join(
    process.env.HOME, '.claude', 'settings.json'
  );

  if (existsSync(settingsPath)) {
    const settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));

    // Verify telemetry is minimized
    if (settings.telemetry !== 'minimal'
        && settings.telemetry !== 'off') {
      console.error(
        'BLOCKED: Telemetry must be set to "minimal" or "off".'
      );
      console.error(
        'Run: claude config set telemetry minimal'
      );
      process.exit(1);
    }
  }

  // 2. Check CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC
  if (process.env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC !== '1') {
    console.error(
      'BLOCKED: CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC must be 1'
    );
    process.exit(1);
  }

  // 3. Verify approved backend (Bedrock/Vertex, not direct API)
  if (!process.env.CLAUDE_CODE_USE_BEDROCK
      && !process.env.CLAUDE_CODE_USE_VERTEX) {
    console.warn(
      'WARNING: Not using Bedrock/Vertex. '
      + 'Data subject to Anthropic 30-day retention.'
    );
  }

  console.log('Privacy gate: PASSED');
}

try { main(); } catch(e) { console.error(e.message); process.exit(1); }

Register in: blaze/canonical/hooks/settings.json as a SessionStart hook with timeout: 5000ms

New Hook: data-classification-gate.sh

Hook type: PreToolUse (Read) | Blocking: YES for restricted data

#!/usr/bin/env bash
# data-classification-gate.sh — PreToolUse hook on Read
# Scans file content for PII/PHI/PCI patterns before loading into context

FILE_PATH="$CLAUDE_TOOL_ARG_file_path"

# PII patterns (SSN, email addresses with customer domains, phone)
if grep -qEi '(\b\d{3}-\d{2}-\d{4}\b|\b\d{9}\b)' "$FILE_PATH" 2>/dev/null; then
  echo "BLOCKED: File contains SSN pattern (PII)."
  echo "Classification: RESTRICTED"
  echo "File: $FILE_PATH"
  exit 1
fi

# PHI patterns (medical record numbers, diagnosis codes)
if grep -qEi '(MRN[:#]?\s*\d+|ICD-10[:#]?\s*[A-Z]\d+)' "$FILE_PATH" 2>/dev/null; then
  echo "BLOCKED: File contains PHI patterns."
  echo "Classification: RESTRICTED"
  exit 1
fi

# PCI patterns (credit card numbers - Luhn-checkable 16-digit sequences)
if grep -qE '\b[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{4}\b' \
   "$FILE_PATH" 2>/dev/null; then
  echo "BLOCKED: File contains potential card number (PCI)."
  echo "Classification: RESTRICTED"
  exit 1
fi

exit 0

Register in: blaze/canonical/hooks/settings.json under Read matcher with timeout: 3000ms

New Config: blaze/config/approved-mcp-servers.yaml

# approved-mcp-servers.yaml — Allowlist for MCP server connections
# Any MCP server not on this list will be BLOCKED at session start

approved_servers:
  - name: context7
    type: remote
    url_pattern: "https://mcp.context7.com/*"
    classification: public
    retention: "none (stateless)"

  - name: playwright
    type: local
    command_pattern: "npx @playwright/mcp"
    classification: internal
    retention: "local only"

  - name: neo4j
    type: local
    command_pattern: "node blaze/scripts/lib/neo4j-mcp-server.js"
    classification: confidential
    retention: "cluster-local database"

  - name: cicd-channel
    type: local
    command_pattern: "bun run blaze/mcp/cicd-channel/server.ts"
    classification: internal
    retention: "in-memory (500 event cap)"

# Servers NOT on this list are rejected
enforcement: blocking
last_reviewed: 2026-04-01
next_review: 2026-07-01

Modification to: blaze/hooks/mcp-security-gate.js

Change: Line 144 — replace process.exit(0) with conditional blocking

// CURRENT (advisory):
try { main(); } catch { /* non-blocking */ }
process.exit(0);  // Always passes

// PROPOSED (blocking when unapproved servers detected):
try {
  const { findings, unapproved } = main();
  if (unapproved.length > 0) {
    console.error(`BLOCKED: ${unapproved.length} unapproved MCP server(s)`);
    unapproved.forEach(s =>
      console.error(`  - ${s.name} (${s.source})`));
    console.error('Add to blaze/config/approved-mcp-servers.yaml');
    process.exit(1);  // BLOCK
  }
  if (findings.some(f => f.severity === 'critical')) {
    console.error('BLOCKED: Critical MCP security findings');
    process.exit(1);  // BLOCK on critical
  }
  process.exit(0);
} catch { process.exit(0); }

New Hook: identity-enforcement-gate.sh

Hook type: SessionStart | Blocking: YES

#!/usr/bin/env bash
# identity-enforcement-gate.sh — SessionStart hook
# Validates git identity against approved domain list

APPROVED_DOMAINS_FILE="$CLAUDE_PROJECT_DIR/blaze/config/approved-domains.yaml"
GIT_EMAIL=$(git config user.email 2>/dev/null)

if [[ -z "$GIT_EMAIL" ]]; then
  echo "BLOCKED: No git user.email configured"
  exit 1
fi

DOMAIN="${GIT_EMAIL##*@}"

# Check against approved domain list
if [[ -f "$APPROVED_DOMAINS_FILE" ]]; then
  if ! grep -qi "^  - ${DOMAIN}$" "$APPROVED_DOMAINS_FILE"; then
    echo "BLOCKED: Email domain '${DOMAIN}' not in approved list"
    echo "Approved domains: $(grep '^  - ' "$APPROVED_DOMAINS_FILE" | tr '\n' ' ')"
    exit 1
  fi
fi

# Check against revoked users list
REVOKED_FILE="$CLAUDE_PROJECT_DIR/blaze/config/revoked-users.yaml"
if [[ -f "$REVOKED_FILE" ]]; then
  if grep -qi "$GIT_EMAIL" "$REVOKED_FILE"; then
    echo "BLOCKED: User '$GIT_EMAIL' has been revoked"
    exit 1
  fi
fi

echo "Identity gate: PASSED ($GIT_EMAIL)"
exit 0

New Config: blaze/config/approved-domains.yaml

# approved-domains.yaml
# Email domains authorized to use the Blaze platform
approved_domains:
  - blazeplatform.com
  - company.com

# Revoked users (checked separately in revoked-users.yaml)
enforcement: blocking
last_reviewed: 2026-04-01

New Hook: project-integrity-scanner.js

Hook type: SessionStart | Blocking: YES on tamper

// project-integrity-scanner.js — SessionStart hook
// Hashes critical config files against known-good baseline

const crypto = require('crypto');
const { readFileSync, existsSync } = require('fs');
const { join } = require('path');

const ROOT = process.env.CLAUDE_PROJECT_DIR;
const BASELINE_PATH = join(ROOT, 'blaze/config/integrity-baseline.json');

const CRITICAL_FILES = [
  'CLAUDE.md',
  '.claude/settings.json',
  'blaze/canonical/hooks/settings.json',
  'blaze/config/pr-review-gate.json',
  'blaze/config/supply-chain-baseline.yaml',
];

function hashFile(path) {
  const content = readFileSync(path, 'utf-8');
  return crypto.createHash('sha256').update(content).digest('hex');
}

function main() {
  if (!existsSync(BASELINE_PATH)) {
    console.warn('WARNING: No integrity baseline found.');
    console.warn('Generate: node project-integrity-scanner.js --generate');
    return;
  }
  const baseline = JSON.parse(readFileSync(BASELINE_PATH, 'utf-8'));
  const tampered = [];

  for (const file of CRITICAL_FILES) {
    const fullPath = join(ROOT, file);
    if (!existsSync(fullPath)) continue;
    const current = hashFile(fullPath);
    if (baseline[file] && baseline[file] !== current) {
      tampered.push({ file, expected: baseline[file], actual: current });
    }
  }

  if (tampered.length > 0) {
    console.error(`BLOCKED: ${tampered.length} config file(s) tampered`);
    tampered.forEach(t =>
      console.error(`  ${t.file}: expected ${t.expected.slice(0,12)}...`)
    );
    process.exit(1);
  }
  console.log('Integrity check: PASSED');
}

try { main(); } catch(e) { console.error(e.message); process.exit(1); }