Product · Claude Code Plugin
Session-boundary hooks, no daemon, no prompt logging
A plugin with narrow command hooks that run when a session ends, parse the transcript locally for approved identifiers and counters, and stay silent when nothing is wrong.
How it works
Wake at the boundary, parse locally, sleep
The plugin is designed around not being there. It has no opinion during your session, and no presence between them.
- 01
A session ends
A narrow command hook fires at the session boundary. Nothing runs during the session, and nothing runs when Claude Code is closed.
- 02
Parse on the machine
The local transcript is read on your machine and reduced to approved identifiers and counters — which MCP servers and skills were invoked, how often, and against which repository.
- 03
Sync the reduction, not the source
Only the extracted counters and safe identities sync. The transcript stays where it was, and every field that would be sent was previewed before sync was ever enabled.
What we see
Counters and identities, not conversation
A transcript contains almost everything this product promises never to collect. That is exactly why the parsing happens on your machine and the transcript never moves.
Extracted
Claude version, model identifier, session ID, timestamps, token-class counters, which MCP servers and skills were invoked, and canonical repository, branch, and commit identity.
Never extracted
Prompts and assistant responses. Source code and diffs. Shell command text and terminal output. Tool input and output payloads. Secret and environment-variable values. Raw URL userinfo and command arguments. CLAUDE.md contents.
Capabilities
Built to be forgettable
Every property here is about staying out of the way. A tool that reads developer machines earns its place by being unnoticeable when it is working.
Bounded
Hook execution has a ceiling. It cannot run long enough to become something you notice.
Fail-open
If KeepRails breaks, your session does not. A failure here degrades our data, never your work.
Silent on success
No output when nothing is wrong. The plugin has nothing to say most days, and says nothing.
Coverage
What this surface cannot see
The honest limits are structural; KeepRails does not ask this local surface for broader permissions.
Only sessions that ran here
Coverage is per device. A developer with two machines has two coverage windows, and the product says so rather than averaging them into a claim.
Not delivery outcomes
What shipped is a GitHub question, not a transcript question. Joining the two is the job of a different surface, with its own consent.
Not intent
Counters show that a tool ran. They do not show why, and the product will not infer it.
Where it stops
No payloads are read. A tool the collectors cannot defensibly match is counted as unattributable rather than guessed into a category.
Related
Each surface feeds the next: what the scan finds becomes a finding, and a finding becomes a reversible change.
FAQs about Claude Code Plugin
Does the plugin log my prompts or responses?
No, and it cannot be configured to. The integration never enables prompt, response, shell-command, or tool-payload logging. Transcript parsing extracts only approved identifiers and counters, on your machine, and the transcript itself never leaves it.
Is there a background process?
No. There is no daemon and no always-on agent. Hooks fire at session boundaries and exit. Between sessions, KeepRails is not running.
What happens if a hook fails or is slow?
Your session continues. Hook execution is bounded, asynchronous where it is safe to be, fail-open, and silent on success — so a KeepRails problem is never your problem mid-session.
Are these prompt-based or agent-based hooks?
Neither. They are narrow command hooks. Nothing here injects instructions into your context or runs an agent on your behalf.
Why parse transcripts instead of using OpenTelemetry?
Because privacy-safe OTel redacts MCP identity to `custom`, which makes it useless as a source of truth for the one question this product exists to answer. Local transcript parsing plus local configuration inventory is the source of truth instead.
How do I remove it?
`keeprails uninstall` removes hook and plugin state and restores your previous configuration.
See what your fleet is actually running
The scan runs locally and reports in your terminal. No account, no upload.
keeprails scan