MCP & Plugins Intermediate

Plugin Hooks

Add lifecycle hooks to a plugin — restricted to http and prompt types for security

Command

"color:#9CA3AF;font-style:italic"># hooks/hooks.json (at plugin root)
$ {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{
        "type": "prompt",
        "prompt": "Check ">if this bash command is safe: $ARGUMENTS",
        "timeout": 15
      }]
    }]
  }

Response

// Plugin hooks fire alongside project hooks
// Project hooks run first, then plugin hooks

Parsing Code

059669">">// Security restriction 059669">">for plugin hooks:
059669">">// Allowed types: http, prompt
059669">">// Blocked types: command, agent
059669">">// This prevents third-party plugins from executing arbitrary code

Gotchas

! Plugin hooks can ONLY use 'http' and 'prompt' types — 'command' and 'agent' are blocked for security

! This prevents arbitrary code execution from third-party plugins

Command

Response

Parsing Code

Gotchas

Related Recipes