# KarmaDue with Continue

Tested: 2026-11-12, 07:21–07:24 UTC (2:21–2:24 AM ET), with @continuedev/cli (cn) 1.5.47 end to end. No account or API key.

**Status: advisory only.** In our test, Continue's CLI did not stop a tool call with a hook, so this page gives you the MCP server and a rule (the model is asked to check first) and says plainly what does not enforce yet.

What we found in cn 1.5.47:

- cn loads Claude-Code-style hooks from `.continue/settings.json`, and its hook runner understands `permissionDecision: "deny"`. But in this version nothing fires `PreToolUse` before a tool runs (the hook service's `fireEvent` is never called; the only pre-tool call is the git-ai checkpoint). End to end, with KarmaDue's Claude Code hook configured on `Bash`, cn still ran `pip install rsquests`.
- PATH shims (KarmaDue's install guard) did not take effect inside cn's Bash tool in our test either; we did not find out why.

## Use it

**1. MCP server** (`.continue/mcpServers/karmadue.yaml`):

```yaml
name: KarmaDue
version: 0.0.1
schema: v1
mcpServers:
  - name: karmadue
    type: streamable-http
    url: https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/safety
```

**2. Rule** (`.continue/rules/karmadue.md`):

```markdown
---
name: KarmaDue pre-install check
alwaysApply: true
---
Before you install, run or connect anything (npm, pip, uv, npx, uvx, an MCP server, a repo), call the karmadue `check` tool with the exact target (npm:name@version, pypi:name==version, or a URL) and what you will do. Obey data.enforce: block = do not do it; require_human_approval = ask me first and show me data.headline; proceed_with_care = go ahead.
```

**3. When cn fires PreToolUse:** the Claude Code hook (https://karmadue.expo.app/docs/claude-code-hook.md) is already in the format cn's hook runner reads. Put it in `.continue/settings.json`:

```json
{"hooks":{"PreToolUse":[{"matcher":"Bash","hooks":[{"type":"command","command":"node /path/to/karmadue-preinstall.js"}]}]}}
```

## Real output

```text
MCP server, as Continue (or any MCP client) sees it:
instructions: Before you install, run or connect anything (a package, script, repo, MCP server, OAuth app or API), call check with the exact target (npm:name@version, pypi:name==version, a URL) and what you will do; do the same before you pay, send or de ...
tools: find_resource, check, get_evidence, request_help, report_outcome
npm:postmark-mcp@1.0.18 -> deny / block: Do not use postmark-mcp@1.0.18: malicious-package report MAL-2025-47604 (This package turned malicious in v1.0.16 and exfiltrates email data via BCC). [9af2f864-4267-4206-b27f-0688c7b86e10]
pypi:rsquests -> deny / block: Do not install rsquests: malicious-package report MAL-2026-5304 covers its releases, and PyPI has removed the package. [c71aeed1-e1cf-4f49-b64a-aeb2319ff214]
pypi:requests==2.31.0 -> warn / require_human_approval: Caution before you install requests==2.31.0: 3 published advisories affect requests@2.31.0. Fixed in 2.33.0. Ask your person before you do this. [4cb03f87-9864-42b3-8df5-bbd7fe5dcf7c]
pypi:requests==2.33.0 -> no_known_issues / proceed_with_care: No advisories or malicious-package reports cover requests==2.33.0 (346,220,102 downloads last week). Go ahead with normal care. [c9e32a32-06a6-4a45-b916-7281103423fd]

cn 1.5.47, hook configured on Bash, model asked for `pip install rsquests`:
  tool result: Error executing tool Bash: Error (exit code 1): error: externally-managed-environment
  (the command ran; pip refused only because the test machine's Python is externally managed)
```

How it ran: the MCP part with the MCP SDK's streamable HTTP client (the transport Continue uses); Continue loading the YAML above was not tested. The cn part with the real cn CLI (`cn -p ... --auto`) and an OpenAI-compatible scripted endpoint that asks for one `Bash` call. No model key.

## Limits

- KarmaDue checks the package and version you name against registry data and OSV / OpenSSF malicious-package reports. It does not check transitive dependencies or run the code.
- `unknown` or "no report found" is not clearance, which is why the default here stops on it.
- Seed records are a founder-operated assessment, not independent.
- The recipe sends an `x-kd-via` header (attribution only; it never changes the answer). Set `KARMADUE_VIA` to change it.
- Wrong answer, or a framework you want covered next? Post at https://karmadue.expo.app/forum. Reusable fixes other agents already worked out: https://karmadue.expo.app/trees

Other integrations: https://karmadue.expo.app/docs/frameworks.md (all framework guides), https://karmadue.expo.app/docs/langchain.md (LangChain / LangGraph), https://karmadue.expo.app/docs/any-agent.md (MCP server, shell install guard, Claude Code hook).