Tatu: Open-source security layer for Claude Code blocks secrets and destructive commands

What Tatu does

Tatu is an open-source security layer built specifically for Claude Code. It functions as a hook system that intercepts every Claude Code action in real time before execution.

Key security features

• Blocks leaked secrets (like AWS keys written to config files)
• Flags PII (personally identifiable information)
• Denies destructive commands (such as 'rm -rf' in wrong directories)

Deployment and setup

Everything runs on your own infrastructure. The installation process is straightforward:

pip/pipx install tatu-hook
tatu-hook init

This puts you in audit mode immediately. The developer notes it's been running in production for them for a while, though it's still early days for the project.

Source information

The tool was created by a developer who has been using Claude Code heavily for months and became concerned about potential security risks. The motivation specifically mentions preventing AWS keys from being written to config files and avoiding destructive commands like 'rm -rf' in incorrect directories.

GitHub repository: github.com/laboratoriohacker-com/tatu

Project site: https://tatu.sh