> ## Documentation Index
> Fetch the complete documentation index at: https://docs.provenlog.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Claude Code Hook

> Audit every tool call Claude Code makes

Capture every tool call Claude Code makes — file reads, writes, bash commands, and more — with zero changes to your workflow.

## Setup

Install provenlog:

```bash theme={null}
pip install provenlog
```

Add hooks to your Claude Code settings. Either edit `.claude/settings.json` (project) or `~/.claude/settings.json` (global):

```json theme={null}
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": ".*",
        "hooks": [
          { "type": "command", "command": "provenlog-hook" }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": ".*",
        "hooks": [
          { "type": "command", "command": "provenlog-hook", "async": true }
        ]
      }
    ],
    "PostToolUseFailure": [
      {
        "matcher": ".*",
        "hooks": [
          { "type": "command", "command": "provenlog-hook", "async": true }
        ]
      }
    ]
  }
}
```

Restart your Claude Code session after adding hooks.

<Tip>
  You can also ask Claude Code directly: *"Add provenlog hooks to my settings — use the `provenlog-hook` command for PreToolUse, PostToolUse, and PostToolUseFailure"*
</Tip>

## What gets captured

Every tool call is captured to `~/.provenlog/events.db`:

| Event         | Action Type   | Details                        |
| ------------- | ------------- | ------------------------------ |
| Pre-tool use  | `TOOL_CALL`   | Tool name, input arguments     |
| Post-tool use | `TOOL_RESULT` | Tool output, success/failure   |
| Tool failure  | `TOOL_RESULT` | Error message, failure details |

## How it works

The `provenlog-hook` command reads Claude Code's hook event data from stdin, converts it to a ProvenLogEvent, and writes it to the local SQLite database. The hook runs synchronously for `PreToolUse` (so it can block if needed) and asynchronously for `PostToolUse` and `PostToolUseFailure` (to avoid slowing down Claude Code).

## Querying hook events

```bash theme={null}
# View recent Claude Code tool calls
plog log --last 20

# Verify the hash chain
plog verify --agent-id claude-code

# Start the dashboard to explore visually
plog serve
```