DevOps PeachHooks: rules that cannot be forgotten
A line in CLAUDE.md is advice; Claude follows it most of the time. A hook is a command that Claude Code itself runs on an event, every time. Use hooks for things that must never be skipped.
Events you will use most:
| Event | When | Our use |
|---|---|---|
PostToolUse |
after Claude edits a file | run the content validator when a file under content/ changes |
PreToolUse |
before a tool runs; can block it | block edits to tools/preview/drafts.txt (a "never edit" rule) |
Notification / Stop |
Claude is waiting or finished | play a sound so you can do something else during long tasks |
Hooks are configured in .claude/settings.json (team) or settings.local.json (just you). A blocking hook looks like this (simplified):
{ "hooks": { "PreToolUse": [ { "matcher": "Edit|Write",
"hooks": [ { "type": "command",
"command": "python3 tools/hooks/protect_paths.py" } ] } ] } }
The script reads the tool call, and if the path is protected it exits with code 2 and a message; Claude sees the message and picks another way. Start with one hook. The "done" sound alone changes how you work: you stop watching the terminal.
MCP: connecting to the outside
An MCP server gives Claude new tools: a browser, GitHub, a database, your email. In this project the browser pane and the link to the owner's laptop are both exposed as tools this way, which is how Claude could preview the site and edit files on Windows from a cloud session.
The catch: every connected server's tool descriptions sit in the context on every turn, used or not. Ten servers can eat a large slice of the window before you type anything.
Our rule: prototype, then shrink
- Prototype with MCP. Find out what you actually need.
- Convert to a skill or script once the job is clear. We needed YouTube transcripts; instead of keeping a server connected, we wrote
tools/yt_transcript.py(40 lines) and a note on how to call it. Zero context cost until used. - Keep the MCP server only for things that need live interaction (a browser, a ticket system).
Before you install one
- Who publishes it? Prefer the vendor's own server for email, calendar and databases.
- What permissions does it ask for? A file-reading tool that wants internet access is a red flag.
- Is it maintained, and has anyone reported problems?
- Never put real tokens in a committed file. Use environment variables or your local settings.