agentrigs
+ submit rig
~ / rigs / sonomoshq / Canary

sonomoshq/Canary

Privacy plugin for Claude Code — counts every piece of PII you expose across all sessions. 16 regex detectors with checksum validation + 70+ semantic categories via Claude self-scan. Local-only, zero config, the number only goes up.

↗ GitHub ★ 2 MIT updated 1mo ago project Claude Code Claude plugin
share on X
ARCHETYPE
Pragmatist
A balanced, no-drama setup: some rules, some tools, nothing extreme.
CONTEXT TAX · EVERY TURN
~228 tokens
Featherweight · median rig: 2.3k · breakdown
GUARDRAILS
0/5
No committed guardrails · details

Copy this rig

$ git clone --depth 1 https://github.com/sonomoshq/Canary

MCP servers are added to Claude Code at local scope; env vars are shown as YOUR_… placeholders — we never store values. Files are fetched with degit into a separate folder so you can review before merging.

$ npx degit sonomoshq/Canary/canary/skills/audit .claude/skills/audit
$ npx degit sonomoshq/Canary/canary/skills/leaked .claude/skills/leaked
$ npx degit sonomoshq/Canary/canary/skills/scan .claude/skills/scan
$ npx degit sonomoshq/Canary/canary/skills/<redacted>
$ npx degit sonomoshq/Canary/canary/skills/wrapped .claude/skills/wrapped

This rig commits no guardrails. Here is the community baseline instead — the deny/ask rules most often found across all 7,204 rigs:

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(**/.env)",
      "Read(~/.ssh/**)",
      "Bash(rm -rf *)",
      "Read(**/*.pem)",
      "Bash(rm -rf /)",
      "Bash(git push --force:*)",
      "Bash(sudo *)",
      "Read(.env)",
      "Bash(rm -rf /*)",
      "Read(./.env.*)",
      "Read(~/.aws/**)",
      "Bash(git push --force*)",
      "Bash(rm -rf:*)",
      "Read(**/*.key)",
      "Read(**/.env.*)",
      "Bash(sudo:*)",
      "Bash(git reset --hard*)",
      "Bash(git reset --hard:*)",
      "Read(.env.*)"
    ],
    "ask": [
      "Bash(git push:*)",
      "Bash(git push *)",
      "Bash(git commit:*)",
      "Bash(rm *)",
      "Bash(rm:*)",
      "Bash(git rebase *)",
      "Bash(wget *)",
      "Bash(npm publish:*)",
      "Bash(git commit *)",
      "Bash(gh pr merge *)"
    ]
  }
}

Skills (5)

auditleakedscantokenwrapped

Similar rigs

quisbaum-prog/occam
Occam's razor for Claude Code and Codex: a 30-line rule set. Benchmarks vs base: 51-55% lower estimated task cost on Opus/Sonnet 5.5 max with more tests passed. 8.3% fewer tokens in a Sol 6.1 max pilot. Raw data, Docker setup and comparison
★ 17 project Claude Code 2 skills 10d ago
Minimalist 67 tok ·
fALECX/agentic-harness-tips
Claude Code setup tips: one tip, one picture, one snippet — plus a plugin that audits your repo against the list.
★ 5 setup Claude CodeCodex 2 skills 2d ago
Minimalist 393 tok ·
dheerajjha/show-your-work
Your coding agent says "all tests pass". Show your work. A Claude Code plugin that holds the agent's final message up against what actually ran, plus a skill for Codex, Cursor, Copilot and others.
★ 0 project Codex 2 skills today
Minimalist 421 tok ·
MasterPlayspots/motionspec
MCP server and CLI for web animation accessibility: deterministic GSAP + CSS, reduced-motion defaults and static WCAG 2.2.2/2.3.3 checks. MIT core.
★ 0 project CodexCursorCopilot 1 mcp 2 skills today
Pragmatist 4.7k tok ·
copied ✓