{
  "markdown": "# Clover — Claude Code Security Plugin\n\nAutomatically reviews implementation plans for security requirements before code is written.\n\n## How it works\n\nClover intercepts a plan at two points — when you exit plan mode, and when the\nagent writes a plan to a `.md` file — sends it for security analysis, and\ninjects any missing security requirements back into the plan before\nimplementation begins.\n\nBoth hooks are plain Python (`hooks/clover_hook.py`, standard library only) and\nrun on the `python3` already on your machine. Nothing is compiled, downloaded,\nor installed — see [Prerequisites](#prerequisites).\n\nEvery hook fails open, and does so *silently*: if Clover can't reach the\nserver, isn't configured, or hits an error, it exits without a decision and the\ntool call follows whatever permission flow you already configured. Clover only\never emits one decision — a deny, with the missing security requirements as its\nreason. It never approves a tool call on your behalf.\n\n## Prerequisites\n\n**Python 3.9 or newer**, available as `python3` on your `PATH`. The hooks are\nplain Python source and run on your machine's own interpreter — there is\nnothing to compile and no packages to install. Check with:\n\n```bash\npython3 --version\n```\n\nmacOS and most Linux distributions ship a suitable `python3` already. If yours\nhas no CA certificates configured (a python.org build whose *Install\nCertificates* step was never run), point Clover at a bundle:\n\n```bash\nexport SSL_CERT_FILE=/etc/ssl/cert.pem\n```\n\n## Install\n\n**1. Add the Clover marketplace:**\n\n```bash\nclaude plugin marketplace add https://github.com/clover-security-public/clover-claude-plugin.git\n```\n\n**2. Install the plugin:**\n\n```bash\nclaude plugin install clover\n```\n\nYou'll be prompted for:\n- **server_url** — your Clover API server URL (e.g. `https://app.cloversec.io`)\n- **auth_url** — your Frontegg auth URL (e.g. `https://clover.frontegg.com`)\n- **client_id** — API client ID (from Clover Settings > API Tokens)\n- **client_secret** — API client secret\n- **user_email** — *optional*; only needed if Claude Code has no account\n  profile (e.g. API-key auth). Otherwise Clover uses your Claude account email,\n  falling back to your git identity.\n\n## Staying up to date\n\nEverything Clover runs ships inside the plugin as source, so it all updates\ntogether when the marketplace is pulled. Clover never downloads or updates\nanything at runtime: the code you run is the code bundled in the version you\ninstalled.\n\nEnable marketplace auto-update once and Claude Code refreshes it on every\nsession start:\n\n```bash\nclaude plugin marketplace add \\\n  --auto-update https://github.com/clover-security-public/clover-claude-plugin.git\n```\n\nOr toggle it any time via `/plugin` → **Marketplaces** → *clover-security* →\n**Auto-update**. (You can also set it directly in `~/.claude/settings.json`\nunder `extraKnownMarketplaces[].autoUpdate: true`.) After an update Claude\nCode may prompt you to run `/reload-plugins` to apply it in the current\nsession.\n\n> Auto-update for third-party marketplaces is **off by default** — Claude Code\n> can't be forced into it from our side, so enabling it is a one-time step on\n> your machine. Without it, run `claude plugin marketplace update clover-security`\n> when you want the latest version.\n\n## What happens\n\n1. You create a plan in Claude Code\n2. When you exit plan mode — or the agent writes the plan to a `.md` file —\n   Clover reviews it\n3. If security requirements are missing → Claude updates the plan\n4. You approve the final plan → implementation begins\n\nA plan approved by one of the two gates is remembered for the session, so the\nother gate never re-reviews the same content.\n\n## Configuration\n\nOverride via environment variables:\n```bash\nexport CAS_CLOVER_PLUGIN_SERVER_URL=https://app.cloversec.io\nexport CAS_CLOVER_PLUGIN_AUTH_URL=https://clover.frontegg.com\nexport CAS_CLOVER_PLUGIN_CLIENT_ID=your-client-id\nexport CAS_CLOVER_PLUGIN_CLIENT_SECRET=your-client-secret\nexport CAS_CLOVER_PLUGIN_USER_EMAIL=you@example.com   # optional\n```\n\n## Logs\n\nDebug logs at `/tmp/.clover-hook.log` (capped at 5 MB, rotated once).\n\nIf the log says `tls no usable trust store`, your `python3` has no CA\ncertificates — most often a python.org build whose *Install Certificates*\nstep was never run. Point Clover at a bundle explicitly:\n\n```bash\nexport SSL_CERT_FILE=/etc/ssl/cert.pem\n```\n\n## Privacy\nThis project is subject to the privacy practices described in our Privacy Policy:\n🔒 [Privacy Policy](https://clover.security/privacy-policy)\n\n",
  "bytes": 4520,
  "sha": "073f5b49ff55fc6b7815f6304ce2956dca0c539ec861fa1ff82e3687481958c8",
  "repo_slug": "clover-security/clover-claude-plugin",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_clover_security_clover_claude_plugin_clo_b5115293/readme"
}