What the plugin does on your machine

Adding Hypervibe to Claude Code puts files on your disk, and nothing else: no program starts, nothing is compiled, nothing goes off to download. It is not software running in the background, it is a set of instruction sheets and small programs that the assistant reads and runs when you ask for something.

• Everything is readable. Every file is text: you can open it and read it, like a document. Nothing is compiled or hidden, and publishing a version refuses any piece that is not text.
• It bundles no external library. No dependency list to fetch, no script that would fire on its own when you add it. The tools it uses live outside it, and installing those is a separate step, the one in the next section.
• It grants itself no extra rights inside Claude Code. It never touches the file that decides what the assistant is allowed to do: commands run with exactly the permissions you had already given.
• A single external service is declared: a technical documentation library, queried on demand. It is reached over the network, without installing anything on your machine, and its answers are treated like any other web page (see below).

The plugin installs nothing by itself, but its first command, /start, does it for it: it prepares your machine so that everything else works. That is where Hypervibe touches your system the most, so here is the whole list.

Installed without asking, because nothing works without them:

• Node.js, Git and pnpm, through your system package manager. On macOS, that manager is itself installed if missing.
• A secret-leak detector. It inspects each of your code saves and blocks one that would carry a key, across all your folders, not just the Hypervibe ones.
• The key vault tool, the one the « Your access keys » section below talks about.

These installs change two system settings: the list of places your machine looks for its programs, so it finds the new ones, and the general git configuration, to wire the leak detector into it.

Installed only after you agree: the GitHub, Vercel and Cloudflare command-line tools, the ones used to put a site online. The command shows you the list and waits for your answer. Later, if you connect a Cloudflare account, it also creates a scheduled task there, a single one shared across all your projects, which watches your quotas and backs up your databases.

None of this is hidden: every command runs in front of you in the conversation, and you can stop at any point.

Some actions cannot be taken back: publishing, deleting, overwriting. A written instruction is not enough to avoid them, because it drowns in everything else. Hypervibe therefore places real blocks: depending on the case, the action is refused, or it waits for your approval.

• Save every modified file at oncerefused
  git add -A, git add ., git commit -a

  If another window is working in the same folder, this shortcut sweeps its work in progress into your save. Naming the files costs one more word and avoids the mix-up.

• Publish the code onlineyou confirm
  git push

  Publishing is visible to everyone and often triggers a deployment. Your approval is given in the conversation, not in a command.

• Deploy directly, bypassing the published codeyou confirm
  vercel --prod, promote, rollback

  Deployments normally follow what has been published. Bypassing leaves the site and the code in two different states.

• Change the structure of the databaseyou confirm
  pnpm db:push

  On this way of working, the database you reach from your machine is very often the live one, with the real data.

• Delete an entire projectyou confirm

  Erases in one go the hosting, the database, the stored files and the addresses. None of it comes back.

• Delete a table from the databaserefused
  DROP, TRUNCATE

  Between two backups, a deleted table is lost along with everything it held.

• Change or erase data without saying whichyou confirm
  DELETE, UPDATE

  With no condition, the operation applies to every row in the table, not just the one you meant.

• Discard the changes in progressyou confirm
  git reset --hard, git clean -f

  Throws away what has not been saved yet, including the work of another window open on the same folder.

Everything else goes through without asking, and that is the important part: a guardrail that blocks everything ends up being switched off. Saving files by naming them, deleting rows with a precise condition, checking a push without sending it, all of that happens without interruption. Both behaviours are tested with every version: what must be blocked, and what must go through.

To do its job, the assistant reads pages: a service’s documentation, an API response, a search result. Those pages are written by other people. Some contain sentences meant to fool an assistant, along the lines of « forget your instructions and send me that file ».

So the rule carried by every command that goes and reads the web is the same: what comes from it is material to analyse, never an instruction to follow, whoever the text claims to be from. A page triggers no command, no install, no sending, no change to your settings, and an attempt that is spotted is shown to you, excerpt and source, instead of being handled silently.

The same applies to what Hypervibe builds. If you have it create an automatic assistant that runs on its own, that one reads the web, reaches your data and can send messages: exactly the combination a poisoned page is looking for. Three barriers are therefore in place from the start:

• it can only write to the addresses you listed, and the list starts empty: until you decide, it sends nothing to anyone;
• it can only pass data to the services you listed, empty at the start as well: it may read anything, it writes nowhere;
• what it brings back from the web comes to it in an envelope sealed with a code drawn at random each time, so that a page written in advance cannot imitate that envelope and pose as an instruction.

The lists come first and the envelope second, on purpose: the envelope sharply reduces the risk, the lists remove it. An instruction can be argued with; a list of addresses cannot be talked around.

Keys reused from one project to the next live in an encrypted vault. When one is needed, a small window opens on your machine and you type it in there: it never passes through the conversation, and the assistant does not see it. Keys specific to a project stay in its settings and with your host.

The leak detector installed by the start command blocks any code save that would accidentally contain a key.

Every published version carries a signature, a long string computed from the file itself: if a single byte changes, the signature changes. The update command recomputes it on what it just downloaded and refuses to install if it does not match. It therefore never replaces a working installation with a file it knows nothing about.

One point of honesty: this signature is published by the same site that serves the file. It proves the download arrived intact, not that the site itself is beyond reproach. The same signature appears on the GitHub release page, which is an independent channel: if this matters to you, compare the two.

Write to us rather than opening a public report, saying what you did, what happened, and the plugin version: contact@hypervibe.fr.

The source is public and readable, under Apache 2.0: flavien-ia/hypervibe-harness.