New Research: Supply Chain Attack on Axios Pulls Malicious Dependency from npm.Details
Socket
Book a DemoSign in
Socket

scopeguard

Package Overview
Dependencies
Maintainers
1
Versions
1
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

scopeguard

Claude Code plugin that prevents AI scope creep — track what you asked for vs. what changed

latest
Source
npmnpm
Version
1.0.0
Version published
Maintainers
1
Created
Source

ScopeGuard

Your AI assistant just modified 47 files. You asked it to fix one bug.

ScopeGuard is a Claude Code plugin that detects AI scope creep in real time. It watches what you ask for, tracks what actually changes, and gives you a clear report at the end of every session.

  • Tracks intent vs. reality -- parses your prompt to understand what you wanted, then monitors every file operation
  • Scores every session -- a 0-100 scope score tells you exactly how focused your AI stayed
  • Zero friction -- installs as a Claude Code plugin, runs silently in the background, reports when the session ends

Quick Start

1. Install the plugin

claude plugin add scopeguard

Or clone and install locally:

git clone https://github.com/Wittlesus/scopeguard.git
claude plugin add ./scopeguard

2. Use Claude Code normally

Just work as you always do. ScopeGuard runs in the background -- no configuration, no prompts, no interruptions.

3. See your scope report

When a session ends, ScopeGuard automatically displays a report:

ScopeGuard Report
==================================================
Prompt: "Fix the login validation bug in auth.js"
Intent: fix | Target files: src/auth.js
--------------------------------------------------
Operations tracked: 14
  Writes:  4 files modified
  Creates: 2 files created
  Reads:   8 files scanned

Scope Analysis:
  Focused operations:  3/6 (50%)
  Unexpected files touched:
    - src/database.js (write)
    - src/config/routes.js (write)
    - test/helpers/mock-db.js (create)

SCOPE SCORE: 45/100
--------------------------------------------------
Verdict: Moderate scope creep detected.
The session drifted into database and routing
changes beyond the original auth.js bug fix.
==================================================

Scope Score Explained

ScoreMeaning
90 - 100Laser-focused. Only touched what you asked for.
70 - 89Mostly on track. Minor tangential changes.
50 - 69Noticeable drift. Several files changed beyond the request.
25 - 49Significant scope creep. The AI went exploring.
0 - 24Total creep. What you got barely resembles what you asked for.

The score is calculated by comparing write operations against the intent parsed from your prompt. Penalties apply for unexpected file creation, touching new directories, and excessive file scanning.

Commands

CommandDescription
/scopeguard:reportView the most recent scope report
/scopeguard:historyView scope scores across past sessions

How It Works

ScopeGuard uses three Claude Code hooks:

  • UserPromptSubmit -- captures your prompt, parses intent (target files, directories, action type)
  • PostToolUse -- monitors every tool invocation (Edit, Write, Read, Bash, Glob, Grep) and classifies file operations
  • Stop -- generates the scope report, calculates the score, saves to history, and displays results

All processing happens locally. No data leaves your machine. No API calls. No dependencies.

Configuration

ScopeGuard works out of the box with zero configuration. Advanced options are coming in a future release:

  • Exclude patterns (ignore test files, generated code, etc.)
  • Custom score thresholds
  • Team-shared baselines
  • CI integration for automated scope checks

Requirements

  • Node.js >= 18
  • Claude Code with plugin support

Building better AI coding workflows? Check out these complementary projects:

  • RulesForge -- Generate better .claude/rules files to reduce scope creep at the source
  • MyUru -- Orchestrate focused AI agents with clear task boundaries

License

MIT -- Copyright 2026 Wittlesus

See LICENSE for details.

Keywords

claude-code

FAQs

Package last updated on 16 Feb 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts