Access Control
for Claude Code
Log every tool call, block unwanted domains, and protect sensitive files. Self-hosted, runs entirely on your machine.
$ pip install krabb && krabb initWhat it does
krabb hooks into Claude Code and gives you visibility and control over what it accesses.
Tool Logging
Log every WebFetch, WebSearch, Bash, Read, Write, and Edit call to a local SQLite database.
Domain Blocklist
Block specific domains with exact match, wildcard patterns, or full regex support.
File Protection
Prevent Claude from modifying sensitive files using flexible glob patterns.
Dashboard
Web UI at localhost:4242 with live event monitoring, session tracking, and stats.
Filtering & Grouping
Search, filter by tool type or decision, and group events by session or domain.
CLI
Manage everything from the terminal — status, logs, blocklist, and configuration.
Use cases
How krabb helps you keep Claude Code in check.
Block suspicious domains
Prevent Claude Code from fetching content from untrusted or malicious websites.
Protect sensitive files
Stop Claude from reading or modifying credentials, environment variables, and secrets.
Audit web access
See exactly which URLs Claude is fetching and what search queries it runs.
Monitor tool usage
Track every Bash command, file read/write, and edit that Claude performs in your project.
Getting started
Requires Python 3.10+. Full docs
Dashboard
Browse events, manage rules, and view stats at localhost:4242.
| Time | Tool | Detail | Status |
|---|---|---|---|
| 14:23:01 | WebFetch | github.com/petricbranko/krabb | Allow |
| 14:22:48 | WebSearch | "react hooks best practices" | Allow |
| 14:22:35 | Bash | npm install lucide-react | Allow |
| 14:21:59 | WebFetch | evil-site.com/payload.js | Deny |
| 14:21:44 | WebFetch | docs.python.org/3/library | Allow |
Installation
Requires Python 3.10+. Works on macOS and Linux.
Frequently Asked Questions
Everything you need to know about krabb.