jq is how these loadouts read structured input safely in shell: hook scripts parse the tool call Claude Code sends on stdin and print a deny decision, and the Terraform loadout turns terraform show -json output into a count of creates, updates, replaces and deletes that fails when anything would be destroyed.
Every one installs for Claude Code, Codex CLI, Cursor, Gemini CLI, Antigravity CLI and GitHub Copilot unless its card says otherwise.
Fail-closed PreToolUse, post-edit and Stop hooks that block force-pushes, .env reads and wild deletes, check each edit and run tests before done.
Let agents write Terraform and produce plans but never apply: a guard hook for apply, destroy and state changes, a plan summary that flags deletes, pinned providers.
Looking for something narrower? Search within jq or filter everything.