bas-guard: a local offline security scanner giving Claude Code setups an "antivirus for agents"
victor_explore · x · 2026-11-06
Open-source bas-guard (Go, MIT) positions itself as an "antivirus for agents": coding agents auto-load skills, MCP servers, hooks, subagents and CLAUDE.md files — each handed your real tools and permissions, and any could hide a malicious directive, yet nothing reviews them at install time.
Highlights:
- Local-first, offline: never executes scanned content, no network; scan/check are strictly read-only
- Single binary: pure Go, CGOENABLED=0, curl and run
- 10 detection dimensions: injection, excessive permissions, data exfiltration, code execution, supply chain, obfuscation, backdoor, resource abuse, filesystem, intent mismatch (optional LLM enhancement, off by default)
- Cleanup never deletes: clean only MOVES items into a trash directory inside your config root, records every step, --undo replays; targets duplicates, context bloat (quantifies reclaimable tokens), zombie skills
- Permission audit: inline secrets, wildcard arbitrary-command execution, over-broad paths, missing deny fallback
- Load-time gate: registers as a Claude Code hook, auditing a skill before an agent loads it
Positioned as a body-check + alerting + cleanup tool, not "guaranteed removal"; the score is a relative risk signal, not a safety certification.
More from coding & agent
- Making games with PlayAstrocade: AI copies recipes well but can't innovate — andrey_kurenkov · 2026-11-07
- 8 Types of LLMs Powering AI Agents, from GPT Backbones to LAM Action Models — mdancho84 · 2026-11-07
- gemini-cli PR fixes orphan /dev/ptmx master FD leak on macOS PTY spawn — ugorla-dev · 2026-11-07
- Deleting 7,500 lines of CI workflow code cut costs 40% and sped up runs 15% — DanielLockyer · 2026-11-07
- A PE Board Seat's View: The 8-Stage Cycle of Replacing Engineers With AI Agents — alex_verem · 2026-11-07
- Meta researcher: model never tuned for Codex, will improve harness randomization — JoshPurtell · 2026-11-07