god-mode-os is a set of bash hooks that run inside your Claude Code sessions. It has access to whatever your Claude Code session has access to. Treat it accordingly.

god-mode-os is designed to defend against accidental damage by AI agents (false "done" claims, accidental config rewrites, runaway routing token spend). It is not designed to defend against a malicious local user with shell access; if an attacker has shell access, they own your config regardless.

• Does: read your ~/.claude/ config files, write logs to ~/.god-mode-os/, register hooks in ~/.claude/settings.json, optionally run a local Postgres+pgvector container (Tier 2).
• Does not: phone home, send telemetry, read project source code outside the indexed scope, modify files outside ~/.god-mode-os/ and ~/.claude/hooks/ (symlinks only).
• Outbound network calls: none by default beyond Claude Code itself talking to Anthropic. The router talks only to localhost Ollama and Postgres. The only opt-in exceptions are the pre-deploy gate's optional osv-scanner CVE lookup (osv.dev) and the session-retro Gemini summary, which is off unless you set GMOS_RETRO_GEMINI=1. Full detail in PRIVACY.md.

• ~/.claude/hooks/: creates symlinks to scripts in this repo. Existing files are not modified.
• ~/.claude/settings.json: adds entries via jq. First run creates a backup at settings.json.gmos-backup.
• ~/.god-mode-os/: created on demand. All state, logs, retros, digests live here.
• capability-manifest runs on Claude Code's SessionStart event and only reads local files.

Open a private security advisory on GitHub. Do not file public issues for security bugs. Expect an initial response within 7 days.

In scope:

• A hook that bypasses its kill switch
• A hook that elevates privileges or escapes the user's shell context
• An install/uninstall flow that leaves dangerous state behind
• A way for a malicious agent prompt to invoke arbitrary code outside the documented hook surface

Out of scope:

• An agent finding the documented GMOS_ADMIN_OVERRIDE=1 escape hatch (this is intended)
• A user with shell access modifying their own config

The Tier 2 routing container ships with user=gmos / password=gmos and binds to localhost:5433. This is fine for the default deployment, where Postgres is reachable only from your own machine. If you publish port 5433 to a wider network, change the password in router/docker-compose.yml and update GMOS_DB_DSN accordingly.

Strongly recommended for any tool that touches ~/.claude/. Specifically read:

• install.sh and uninstall.sh
• Each hook in hooks/discipline/, hooks/routing/, and hooks/capability-manifest.sh
• bin/pre-deploy-gate.sh

The repo is small. A 30-minute audit is enough to verify the hooks do what the README says.