Added a tripwire that watches my own Claude config for changes I didn't make.

Every MCP server I have connected is defined in ~/.claude.json. That file is a good target: swap a server's URL or its command and every session afterward quietly talks to something else instead. Nothing in the tooling would say a word.

So a SessionStart hook now hashes every server definition, global and per-project, and warns on anything added, changed, or removed. Silent when clean. It stores key names and one-way hashes only, never values, and the baseline lives outside the repo so a repo compromise can't rewrite the thing that checks the repo. Legitimate change, re-baseline with --accept.

Small piece of a longer hardening list. It's also the one that would catch the thing I'd never think to go look at.