Skip to content
← Bounty Board

Marine HQ · Registry · 2026

Clauden

“Crow's Nest”

฿ 148,000,000

A quiet audit trail for shadow AI usage — it names who in the org reached for a more capable model, and when, without ever reading a prompt, a file, or a tool call. Governance for the question most teams aren't asking yet: who's actually driving the agent.

securityclaude-codepythonobservability
PythonView source →

Once an agentic coding tool is rolled out past one person, a question shows up that nobody assigned to anyone: who's actually using the expensive model, and for what? Not because Sonnet needs watching — it doesn't — but because the moment someone reaches for a more capable, more autonomous model, that's usually the moment the task got more sensitive, more consequential, or more expensive. That's a signal worth having. Most teams don't have it, because the alternative most vendors reach for is logging everything, which trades a real question for a much bigger privacy problem.

Clauden answers the narrow question without opening the wide one. It's a Claude Code plugin that posts to a webhook exactly twice: when someone's first turn of a session lands, and when their model or reasoning effort changes mid-session. That's it. It does not read prompts, files, or tool calls — that's not a policy decision I'm asking you to trust, it's a fact about what the hook payload even contains. There's nothing to exfiltrate because there's nothing being read.

The quiet-by-default design is deliberate. Sonnet is the everyday model, so a session that stays on Sonnet says nothing. Moving to Opus gets reported. Moving back to Sonnet doesn't — you hear about people reaching for more, not about them returning to normal, because that asymmetry is the actual signal. A configurable quiet list lets a team decide what "normal" even means for them.

I was also careful to document what this is not, because a security tool that overclaims is worse than one that's honest about its edges:

  • It doesn't enforce anything. A plugin is installed and removable by whoever's using it. If model choice needs to be tamper-resistant rather than merely observable, that's a job for managed settings pushed by MDM — not a plugin running in someone's own session.
  • It doesn't reliably detect its own removal. A disabled plugin's hooks simply stop firing, and there's no event for "someone uninstalled me." I hook ConfigChange to catch a disable, but it's best-effort, not a guarantee.
  • Configuration is stored in plaintext, in settings.json, on purpose — so an administrator can open the file and see exactly what's configured, rather than trusting an opaque keychain entry they can't audit.

That last one is the point I'd defend hardest. A tool that tells you less but tells you honestly what it can't promise is more useful, in a security context, than one that promises more and quietly can't deliver. Clauden is built to be the first kind.