Give Claude a real terminal — without giving Claude the keys.
We run the safe tasks automatically so you don't have to. Reading files, checking logs, running builds, deploying, diagnosing errors — Claude handles those directly, no copy-pasting required. High-risk operations stay permanently blocked and in your hands by design. Every call is checked against a three-tier security model, and every decision is logged.
Two plugins, one trust model
local-terminal
- 8 structured tools — file listing, read, search, git, npm, system info, escape hatch.
- Runs as a Windows Service via NSSM, bound strictly to
127.0.0.1. - 450+ RED patterns across 27 categories block deletion, shutdown, code exec, exfiltration, credential access, persistence.
- Sensitive files protected —
.env,.ssh, credential stores blocked even from read tools.
vps-control
- 17 structured tools — PM2 status, deploy pipeline, git, stdout & error logs, file reads, system health, audit log.
- OAuth 2.0 + bearer token, TLS via sslip.io + Let's Encrypt out of the box.
- 275+ RED patterns across 26 categories block deletion, reboot, shell invocation, DB writes, package install, privilege escalation.
- Symlink realpath check and path allowlist keep file reads inside declared directories.
See it in action
local-terminal — RED-tier block intercepting a dangerous command before it reaches the shell.
vps-control — full deploy pipeline: git pull → build → PM2 restart, driven by Claude.
How we keep Claude from doing the wrong thing
Every command Claude tries to run passes through a three-tier classifier before the plugin executes anything. No shell is invoked. No single tool bypasses the check. Audit logs go to disk with token and secret redaction.
RED — hard-blocked
File deletion, shutdown, code exec via PowerShell/bash -c, curl/wget/scp/ssh, database writes, privilege escalation, Unicode homoglyphs, newline injection. No override, no flag, no escape.
AMBER — dry-run gate
Bulk copies, find -exec, wildcard renames, package updates. First call forces dry_run=true with a visible warning; a second explicit call is required to execute.
GREEN — allowed & logged
Everything else. Rate-limited, timeout-capped, redacted audit log, and a hard cap on the escape-hatch tool. The boring tier by design.
Pricing
All plans include a 14-day free trial — no charge during the trial period. No refunds after trial ends.
🖥 Windows 10 / 11 only — these plugins run on Claude Desktop for Windows. macOS support is planned for a future release.
- All tools for your chosen plugin
- Email support, 1 business day
- All local-terminal tools
- All vps-control tools
- Email support, 1 business day
- Individual plugin — $9.99/mo locked for life
- Bundle — $14.99/mo locked for life
- Monthly billing only — no annual option
- First 100 subscribers or 3 months post-launch — whichever comes first