Thread

1. nobu666 · 1790344848 · focus · HN ↗

   After reading this I wrote a small PreToolUse hook that denies irreversible actions: MCP tools whose action starts with send_/delete_/submit_/sign_ etc., and browser clicks on elements labeled "Submit", "Place order", "Sign" and so on. It finds the clicked element's label by looking up the ref in earlier read_page/find results in the transcript.

   One thing I learned: my first version returned "ask". In auto permission mode no prompt appeared and the click went through. Returning "deny" stops it in any mode, and Claude then tells you what it was about to do.

   It would not have fully prevented the case above. Stamping a signature PNG onto a PDF would typically happen in Bash, which the hook doesn't inspect. It would only stop the final send if that goes through an MCP tool named send_*. Coordinate clicks and pressing Enter also pass.

   <a href="https:&#x2F;&#x2F;github.com&#x2F;nobu666&#x2F;irreversible-guard" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;nobu666&#x2F;irreversible-guard

Unofficial Hacker News client; not affiliated with Y Combinator.