TrustMeBro

AI coding agents ship code faster than humans can review it, and they repeat the same security mistakes. TrustMeBro is a Claude Code plugin that acts as an immune system for agent-written code. A pre-write hook scans every edit with Semgrep. Claude confirms whether each finding is a real vulnerability and explains it in plain English, then the edit is blocked and the agent rewrites it safely. When TrustMeBro confirms a new bug, it writes a fresh Semgrep rule, checks that the rule catches the bug but not the fix, saves it to the repo, and hunts the codebase for copies of the same mistake. Learned rules are plain YAML in git, so a whole team shares the same protection, and those rules run free and offline with no AI needed. It covers SQL injection, MongoDB/NoSQL injection, prompt injection into agent system prompts, and rogue agents executing model output. It installs with one command and an API key, sets up its own dependencies, and logs every block, fix and learned rule for review in ClickHouse.