Skip to main content

Integration

Claude Code Plugin

The Sigil Security plugin for Claude Code provides native slash commands, two specialized security agents, and a Bash guard that redirects git clone and package installs through Sigil quarantine. Requires Claude Code 1.0.33+ and the Sigil CLI.

Why use the Claude Code plugin

The Claude Code plugin is the recommended way to use Sigil with Claude Code. It provides a higher-level interface than the raw MCP server — slash commands instead of tool calls, specialized agents for threat analysis and quarantine management, and hooks that block unscanned clones and installs and suggest scanning when you mention cloning, installing, or security.

FeatureClaude Code PluginMCP Server
Slash commandsYesNo
Specialized agentsYesNo
Auto-scan hooksYesNo
Works with other AI clientsNoYes
Raw tool-level controlNoYes
Note
If you use Cursor, Windsurf, or other MCP-compatible clients, use the MCP Server integration instead. The Claude Code plugin is specific to Claude Code.

Installation

1. Install the Sigil CLI

bash
# curl (Linux / macOS)
curl -fsSL https://sigilsec.ai/install.sh | sh

# Homebrew
brew install nomarj/tap/sigil

# npm
npm install -g @nomarj/sigil

2. Add the plugin to Claude Code

Add the Sigil marketplace, then install the plugin from it:

bash
claude plugin marketplace add NOMARJ/sigil
claude plugin install sigil-security@sigil-marketplace

Or let the CLI run both steps for you:

bash
sigil setup claude

Or install from a local checkout:

bash
git clone https://github.com/NOMARJ/sigil.git
cd sigil
claude plugin install ./plugins/claude-code

3. Verify the installation

bash
# Check the plugin is loaded
claude plugin list

# Check Sigil CLI is available
sigil --version
Requirements
The plugin requires Claude Code 1.0.33 or later and the Sigil CLI installed and available in your PATH.

Slash commands

Six slash commands for security scanning directly in your Claude Code session.

/sigil-security:scan-repo

Scan an entire repository for malicious patterns. Runs all eight analysis phases and returns a verdict with detailed findings.

bash
/sigil-security:scan-repo /path/to/repo

# Scan the current working directory
/sigil-security:scan-repo .

/sigil-security:scan-package

Download and scan an npm or pip package before installation. The package is quarantined and scanned before anything is installed.

bash
# Scan an npm package
/sigil-security:scan-package express

# Scan a pip package
/sigil-security:scan-package requests

/sigil-security:scan-file

Scan an individual file for vulnerabilities. Useful for checking a specific file before running or importing it.

bash
/sigil-security:scan-file src/utils/exec.js

/sigil-security:review-quarantine

Review all items currently in quarantine. Displays status, risk scores, and provides options to approve or reject each item.

bash
/sigil-security:review-quarantine

/sigil-security:fix-finding

Analyze a single scan finding and propose a code fix with an explanation. Accepts a finding from sigil scan output, a file path and line number, or a description of the issue.

bash
/sigil-security:fix-finding src/api/client.js:42

/sigil-security:generate-policy

Generate a Sigil sandbox policy YAML from scan results. Maps findings to filesystem, network, process, and credential restrictions for sandboxed agent execution.

bash
/sigil-security:generate-policy .

Specialized agents

Two purpose-built agents provide expert analysis and workflow management beyond what slash commands offer.

@security-auditor

Agent

Expert analysis of Sigil scan results. The security-auditor agent interprets findings, identifies threats, explains risk levels, and provides remediation recommendations.

text
@security-auditor analyze these scan results

@security-auditor is this eval() call safe in context?

@security-auditor explain the risk of this postinstall hook

@quarantine-manager

Agent

Manages the quarantine workflow. The quarantine-manager agent lists quarantined items, guides approval or rejection decisions based on scan results, and coordinates bulk operations.

text
@quarantine-manager review the latest quarantine

@quarantine-manager approve all low-risk items

@quarantine-manager what's still pending?

Auto-scan hooks

A PreToolUse guard gates every Bash call Claude makes. Commands that pull unscanned third-party code into the environment are denied and redirected to the Sigil equivalent; lower-risk commands that still execute third-party code prompt for confirmation. Prompt-level hooks add advisory suggestions. The guard is a pattern gate — it never touches the network — and delegates to sigil hook pretooluse when the CLI is on your PATH.

TriggerGuard decision
git clone <url>, gh repo cloneDenied — use sigil clone <url>
npm install <pkg>, yarn/pnpm/bun add <pkg>Denied — use sigil npm <pkg>
pip install <pkg>, uv add <pkg>Denied — use sigil pip <pkg>
cargo/gem/go install <pkg>Denied — quarantine and scan the source with sigil clone first
curl ... | shDenied — download the script, run sigil scan on it, then execute
npm install / npm ci / pip install -r (lockfile restores)Asks for confirmation that the lockfile is trusted
npx, bunx, uvx, pnpm/yarn dlx, pipx runAsks for confirmation — one-shot runners execute without a scan
sigil ..., SIGIL_BYPASS=1 ...Allowed
Prompt mentions "clone", "install", "security", "scan", "malware"Advisory only — suggests the matching Sigil command
Tip
The Bash guard denies by default. To allow a single command, prefix it with SIGIL_BYPASS=1. To downgrade every deny to a confirmation prompt, set SIGIL_GUARD_MODE=advise; to disable the guard entirely, set SIGIL_GUARD_MODE=off. The prompt-level hooks are suggestions only.

Configuration

The plugin has no settings.json keys. Its hooks read these environment variables:

VariableDefaultDescription
SIGIL_GUARD_MODEenforceBash guard mode: enforce (deny), advise (deny becomes ask), or off
SIGIL_BYPASSunsetSet to 1 (in the environment or as a prefix on the command) to let one command through the guard
SIGIL_AUTO_INSTALLunsetSet to 1 to let the SessionStart hook install a checksum-verified CLI release when sigil is missing. Default: never downloads
SIGIL_BINARYsigilPath to the CLI used by the bundled MCP server when it is not on PATH

Example workflow

A typical session using the Claude Code plugin to audit a package before installation.

You:    Install the left-pad package
        ↓
Plugin: [guard] npm install left-pad denied —
        use sigil npm <pkg> (quarantine + scan first)
        ↓
Claude: Running /sigil-security:scan-package left-pad
        sigil npm left-pad
        ↓
Sigil:  Verdict: LOW RISK | Score: 0 | Findings: 0
        ↓
Claude: left-pad — no known malicious patterns detected
        (score 0). Approving from quarantine.
        sigil approve <quarantine-id>
        ↓
You:    Now scan the whole project
        ↓
Claude: Running /sigil-security:scan-repo .
        ↓
Sigil:  Verdict: LOW RISK | Score: 4 | Findings: 2
        ↓
Claude: @security-auditor analyze these results
        ↓
Agent:  Two low-severity findings in src/api/client.js:
        1. Outbound HTTP to external domain (line 42)
        2. Base64-encoded config string (line 89)
        Both appear to be legitimate usage patterns.
        No further action required.

Troubleshooting

Plugin not loading

Verify the plugin is installed and Claude Code meets the minimum version:

bash
# Check Claude Code version (requires 1.0.33+)
claude --version

# List installed plugins
claude plugin list

# Reinstall the plugin
claude plugin marketplace add NOMARJ/sigil
claude plugin install sigil-security@sigil-marketplace

Sigil CLI not found

The plugin requires the Sigil CLI binary in your PATH:

bash
# Verify sigil is installed
which sigil
sigil --version

# If installed via Homebrew but not found, check your PATH
echo $PATH | tr ':' '\n' | grep -i brew

Slash commands not appearing

If slash commands don't appear in the autocomplete menu, restart Claude Code and verify the plugin is active:

bash
# After restarting Claude Code, check plugin status
claude plugin list

See also

Previous← Skills.sh SkillNextMCP Server →

Need help?

Ask a question in GitHub Discussions or check the troubleshooting guide.

CommunityTroubleshooting