3Hooks and the SDK

Implementing a hook

3 min read462 words

Time: 20 minutes

Build the .env protection hook end to end — configuration, implementation, restart, and testing. By the end of this exercise, Claude Code will refuse to read .env files in your sample project, and you will have seen the feedback loop in action.

Step 1—Wire up the matcher and command in settings.local.json

Open .claude/settings.local.json in the sample project. The file already has a PreToolUse section stubbed out for you — you need to fill in the matcher and the command.

Set the matcher to Read|Grep (the two tools that can surface file contents). Set the command to run the hook script:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Read|Grep",
        "hooks": [
          {
            "type": "command",
            "command": "node ./hooks/read_hook.js"
          }
        ]
      }
    ]
  }
}

Save the file.

1 / 5

You have just implemented your first end-to-end hook — a PreToolUse hook that intercepts tool calls, inspects their arguments, and blocks anything that would expose a sensitive file.

Defining hooks

Gotchas around hooks