Free & open-source Claude Code plugin
Fantasia: a safety checkup for Claude Code
Fantasia finds exposed secrets, sensitive files, and loose permission settings, explains every finding in plain English, and helps you fix them. A local script reads your files so Claude never has to: Claude only ever sees masked results like AKIA••••.
One day the sorcerer’s apprentice got bored of doing his chores, so he decided to automate his work... but not before checking his agents for loose permissions.
Install Fantasia in two commands
Fantasia is free and MIT-licensed. Install it inside Claude Code, then run /fantasia-safety-check in any project.
/plugin marketplace add Sawyer-Middeleer/fantasia
/plugin install fantasia@fantasiaThe checkup
One screen: what Claude can reach, and why
A checkup ends in a report you can read in one sitting: a score, five grades, the files Claude can reach, and the settings that put them in reach. Tap any row and it shows its work — what was found, and how the scanner knew.
✦ Fantasia Safety Check
project-workspace
Start here: 3 sensitive files Claude can actually reach. Then a few cleanups.
10 critical · 6 high · 5 medium
These powers come from your settings below — and they put the 3 files below within reach.
What’s exposed · 3 Claude can reach
AKIA••••••••••••line 3wJal••••••••••••line 4ghp_••••••••••••line 5sk-p••••••••••••Why A credential in a readable file can be read by Claude, a subagent, or anything Claude runs — and then used or leaked.
Fix Move the value to an environment variable, add a Read deny rule covering this file, and rotate the exposed credential.
The settings behind this · 13
Why this exists
What can actually go wrong in a Claude Code setup?
Claude Code is a real program on your real computer. It reads files, runs commands, and — depending on your settings — reaches the web. Most setups drift toward convenience: an allow rule here, an auto-approve mode there. None of it is dangerous on its own. The risk lives in the combinations.
Exposed data
API keys sitting in a .env file. A tax return saved next to your marketing copy. A password pasted into an old script. A credential in a readable file can be read by Claude, by a helper agent Claude spins up, or by anything Claude runs, and then used or leaked.
Loose permissions
An unrestricted Bash allow rule. curl and wget pre-approved — the two commands Claude Code deliberately never auto-approves, because they are the main way data leaves your machine. Every tool on every MCP connector waved through with one wildcard.
When the two meet
Neither one is an incident on its own. Put them together and you have one: a live credential, no rule refusing to read it, and a pre-approved command that can send data off your machine. Anything driving Claude — including a malicious instruction hidden in a file it reads — can now find the secret and mail it out.
The misconception to clear up first: .claudeignore is not a deny rule. Claude can still open an ignored file by its explicit path. What refuses the read is a permissions.deny Read rule — and Fantasia writes those for you.
How it works
How Fantasia keeps your secrets away from Claude
The obvious way to audit a project is to have the AI read everything — which defeats the purpose, because now your secrets are in the conversation. Fantasia inverts it. A dumb, deterministic script does the reading; Claude does the reasoning, over masked findings only.
Nothing happens until you say go
The checkup opens with a plain-English disclosure: what it will look at, what it won't do, and what you'll see. It waits for your yes. Every decision after that — each fix, each save — is its own explicit question.
A local script does the reading
A small scanner runs on your machine, fully offline, with zero dependencies. It pattern-matches your files for secrets and sensitive documents, reads your settings, and hands Claude one thing: masked findings. Every checkup ends with the same receipt: read 0 file contents into this conversation.
Fix it together, one item at a time
Findings are handled highest-severity first, with the reasoning shown for each: what was found, how the scanner knew, and what the fix changes. You approve every edit before it happens — then re-run the scan and watch the score move.
The scanner reads bytes. Claude only ever sees redacted, structured findings. Claude never opens a flagged file.
Coverage
What the scan looks for
Four checks, one picture. The first three find things; the fourth asks whether Claude can reach any of them.
Exposed secrets
17 patternsAWS, GitHub, Slack, Stripe, OpenAI, and Anthropic keys; private key blocks; JWTs; webhook URLs; random-looking values assigned to names like password or api_key.
Sensitive documents
3 categoriesFinancial records, medical files, and legal or identity documents — matched by filename wherever possible, so a tax return can be flagged without its contents ever being read.
Settings & permissions
19 checksBypassed permission prompts, unrestricted Bash, pre-approved network commands, wildcard MCP allows, missing deny rules, oversized or missing CLAUDE.md files — across every settings scope Claude Code loads.
Reachability
the cross-checkEverything else feeds this one: for each exposed item, can Claude reach it under your current permissions? A protected secret is a note. A reachable one leads the report.
gitleaks finds credentials, and finds them well. Fantasia also flags the tax return, the medical record, the client list — then checks every finding against your permission settings, because a secret is only a live risk if Claude can reach it.
Three skills
Audit, set up, and ask — one shared standard
All three skills read the same standards file, so what the setup interview writes is exactly what the checkup grades. They can’t drift apart.
/fantasia-safety-checkthe checkup
Scores your setup across five areas, shows what's exposed and what Claude can reach, explains how it knows every finding, and fixes issues one approved step at a time. Saves a visual report you can open in any browser.
/fantasia-safety-setupthe interview
Five questions, no jargon — what is this project, what's sensitive, how cautious should Claude be? Your answers become a CLAUDE.md, an ignore file, and enforced deny rules, each previewed before it's written.
/fantasia-askthe guide
Plain-English answers to questions like “can this thing see my passwords?” — grounded in the official docs and, when you want, personalized to your settings: “in your case, Gmail is connected, so yes.”
Where this came from: at Claude Code workshops, attendees were trading a hand-written 120-word safety prompt — “never touch my passwords, API keys, or .env files...” A prompt is a request. Settings are a rule. Fantasia’s setup interview turns that same intent into enforced deny rules and a permission preset — config Claude Code actually obeys.
The standard
Claude Code security best practices: what each control covers
Most safety advice oversells its controls. Each layer in Claude Code covers something specific and misses something specific — and the honest version of that table is more useful than a false guarantee. This is the standard Fantasia grades against.
| Control | Covers | Doesn’t cover |
|---|---|---|
permissions.deny Read rule | Claude's Read tool, and shell commands routed through its tool layer | Standalone scripts you or Claude run directly at the OS level |
permissions.deny Bash rule | The exact command pattern it names | Reordered arguments, http vs https, shell variables, indirect runners like npx |
Default permission mode | An approval prompt for anything not explicitly allowed | Everything already on your allow list |
.claudeignore | Files discovered while scanning the project folders | Files opened by explicit path |
WebFetch preflight | Known malicious domains, checked before fetching | Domains not yet on the blocklist |
OS-level sandbox | All file, network, and subprocess access, enforced by the operating system | Actions taken by allowed MCP tools making their own network calls |
Deny rules before ignore files
Add permissions.deny Read rules for .env files, key material, and secret folders — the one control that refuses a read no matter how the file is reached.
Keep curl and wget behind the prompt
Claude Code ships with them unapproved on purpose. Leave them there, and approve one-off uses when they come up.
Scope MCP allows per tool
A wildcard mcp__ allow auto-approves every tool on every connected server — and Anthropic does not security-audit third-party MCP servers.
Never bypass permissions on real projects
bypassPermissions removes every gate at once. If a session truly needs it, use a throwaway directory with nothing sensitive in reach.
Rotate anything that was ever exposed
A deny rule protects the file going forward. It does not un-expose a credential that already sat readable — rotate it.
Keep a CLAUDE.md, and keep it small
A short, current CLAUDE.md is a safety control too: it's where Claude learns what this project is and what to leave alone.
Frequently Asked Questions
Run your first checkup tonight
Two commands to install, one to run. Free, MIT-licensed, and the scan itself never leaves your machine.