I built a little "police department" for my Claude Code subagents

The idea is dead simple. It installs one logging hook in your \~/.claude/settings.json that records every tool call + permission event — from the main agent *and* every subagent — into a per-session log. Then there's a pd CLI that replays that log and tells you if anything misbehaved. Stuff like: did an agent read \~/.ssh, try to sudo something, edit its own .claude/settings.json to give itself more permissions, use a tool it wasn't supposed to, or wander off the task it was given. The thing I care most about, and the part I'd push back on if someone called it a "security tool": **it** **never** **blocks** **anything.** It's catch-and-report only. It's a flight recorder + a policescanner, not a firewall. If you actually want to *stop* an action, that's still Claude Code's permission prompts or an OS sandbox doing the work. Find it here