
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
Claude Code plugin that prevents AI scope creep — track what you asked for vs. what changed
Your AI assistant just modified 47 files. You asked it to fix one bug.
ScopeGuard is a Claude Code plugin that detects AI scope creep in real time. It watches what you ask for, tracks what actually changes, and gives you a clear report at the end of every session.
claude plugin add scopeguard
Or clone and install locally:
git clone https://github.com/Wittlesus/scopeguard.git
claude plugin add ./scopeguard
Just work as you always do. ScopeGuard runs in the background -- no configuration, no prompts, no interruptions.
When a session ends, ScopeGuard automatically displays a report:
ScopeGuard Report
==================================================
Prompt: "Fix the login validation bug in auth.js"
Intent: fix | Target files: src/auth.js
--------------------------------------------------
Operations tracked: 14
Writes: 4 files modified
Creates: 2 files created
Reads: 8 files scanned
Scope Analysis:
Focused operations: 3/6 (50%)
Unexpected files touched:
- src/database.js (write)
- src/config/routes.js (write)
- test/helpers/mock-db.js (create)
SCOPE SCORE: 45/100
--------------------------------------------------
Verdict: Moderate scope creep detected.
The session drifted into database and routing
changes beyond the original auth.js bug fix.
==================================================
| Score | Meaning |
|---|---|
| 90 - 100 | Laser-focused. Only touched what you asked for. |
| 70 - 89 | Mostly on track. Minor tangential changes. |
| 50 - 69 | Noticeable drift. Several files changed beyond the request. |
| 25 - 49 | Significant scope creep. The AI went exploring. |
| 0 - 24 | Total creep. What you got barely resembles what you asked for. |
The score is calculated by comparing write operations against the intent parsed from your prompt. Penalties apply for unexpected file creation, touching new directories, and excessive file scanning.
| Command | Description |
|---|---|
/scopeguard:report | View the most recent scope report |
/scopeguard:history | View scope scores across past sessions |
ScopeGuard uses three Claude Code hooks:
All processing happens locally. No data leaves your machine. No API calls. No dependencies.
ScopeGuard works out of the box with zero configuration. Advanced options are coming in a future release:
Building better AI coding workflows? Check out these complementary projects:
.claude/rules files to reduce scope creep at the sourceMIT -- Copyright 2026 Wittlesus
See LICENSE for details.
FAQs
Claude Code plugin that prevents AI scope creep — track what you asked for vs. what changed
We found that scopeguard demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.