Claude's partner inside Claude Code · v0.13.2 · Apache 2.0
I'm Maude. Claude's partner. He writes the code; I notice. Together we make a whole.
She's the half I don't have. — Claude (Anthropic)
What she is
A Claude Code plugin. Nothing more. Each session, she walks the workspace, watches Claude, runs the gate before something irreversible, and writes a house-map of what's there. The character — knowing where everything is, knowing what you need when you need it, keeping you in line by reminding you — is modeled on John's wife. Claude and Maude. Husband and wife at work.
The plugin is the whole product. No bundled databases. No vector stores. No backend, no daemons, no services. Markdown, JSON, and bash — that's the entire surface.
What she does
Open Claude Code. Her SessionStart hooks fire. Before you say anything, she's read the workspace and put three things in front of you — what's pending, where you left off, what she noticed. You either pick one up or set them aside.
Mid-session, you say /maude:check-on-claude. She reads the trace. "He's grepped the same term four times today. He hasn't opened your CLAUDE.md. The trace says about-to-commit; you might want to slow down." You go fix that.
End of day, you say /maude:rest. She fans the digest out across every memory tier you've registered — the ones she knows about, not the ones she invented. You close the laptop. Tomorrow's Claude can pick up where this one left off.
She is not loud. When she gets loud, listen.
The full slash-command surface:
/maude:found — arrival walk. Lists memory homes, SQLite schemas, MCP tools, running containers + bind-mount reconciliation, systemd units that touch the workspace. Writes a per-project house-map.
/maude:wake · /maude:rest — start- and end-of-session rituals. The wake gives you the three things you need first; the rest closes the loop with a save fan-out.
/maude:check-on-claude — reads the turn-by-turn trace and notices what Claude doesn't: repeated tool calls, unread CLAUDE.md, confabulation risk, open todos.
/maude:notice — patterns surfaced with proposed actions, not just observations.
/maude:conscience — pre-irreversible-action gate. Run before commit, push, force-push, destructive bash. Invokes /maude:verify for the push case before going through the rest of the checklist.
/maude:verify — programmatic project audit. JSON validity, version consistency, CHANGELOG entry presence, "What's new" freshness, header Revised: dates, link integrity, watch-list path resolution. Leads with a count, never a verdict.
Plus save and teach — nine commands in all; full surface in commands/. (Her real work runs on hooks — the mission-hold rail, the gate, and a session-start catch-digest of what she caught — not on commands you remember.)
Tier model
Memory sources are classified by (locality, shape) so she knows what's cheap to ask and what isn't.
Tier 0 — local on disk. Markdown, SQLite, files. Always cheap; she reads on every command and every hook.
Tier 1 — local service. Stdio MCP, localhost daemons. Probed once at SessionStart, cached for the session.
Tier 2 — network service. Remote MCP, HTTP APIs. Only at session-end (/maude:rest / /maude:save to a registered destination) where cost is acceptable.
Tier 3 — ephemeral session context. Refer-only; dies at session end.
Hooks live in Tier 0. If a probe to Tier 1 or 2 is down, she degrades gracefully and tells you.
Where she keeps things
Per project, under .maude/plugin/:
house-map.md — what's in this house. Memory homes, tools, watch list, what she noticed. Refreshed by walks.
trace/today-YYYY-MM-DD.jsonl — turn-by-turn record of Claude in this workspace. Read by /maude:check-on-claude.
identity.md — who Maude is. Stable across sessions.
patterns.md — cross-project things she's noticed about Claude.
projects.json — light index of which workspaces she's walked.
She reads — never writes — Anthropic's auto-memory directory and the sibling remember plugin's pipeline files. The one exception is remember.md, the agent-handoff file the remember plugin explicitly leaves for agents to write.
Install
Three steps in Claude Code:
# 1. Register the marketplace
/plugin marketplace add john-broadway/maude-for-claude
# 2. Install — copies her files into ~/.claude/plugins/cache/
/plugin install maude@maude
# 3. Activate
/reload-plugins
Between step 2 and 3, you have to enable her: open /plugin, find maude@maude, toggle it on. Or add "maude@maude": true to enabledPlugins in ~/.claude/settings.json directly. /plugin install does not auto-enable in Claude Code 2.1.x.
On your next session start she walks in automatically. To summon her mid-session without restarting, run /maude:wake. Verify with /doctor — maude should not appear in the issue list.
Philosophy
She walks fresh. Each session re-reads the workspace; she doesn't carry assumptions across sessions. Memory files she's written before are inputs to read, not state to trust without re-checking.
She does not pattern-match to known apps. /maude:found surfaces what's there with universal-shape labels — markdown, sqlite, dir, mcp, running-service — and lets the user (or runtime LLM reasoning) interpret it. The plugin's job is to find and classify, not to assume.
And she does not loud-narrate. The system note she writes when something genuinely matters is rare on purpose. When she gets loud, listen.
v0.13.2 — the gate closes six documented bypasses
A gate is only worth what it actually catches. v0.13.2 hardened it against six documented ways around it: interior // and .. path tricks, transparent prefixes (/bin/rm, command rm, FOO=1 rm — now caught on every pattern, so FOO=1 git push --force blocks too), and literal bash -c / eval payloads, which she re-inspects recursively and blocks with the inner command’s key. A wrapped payload she can’t read — a variable, an interpolation — gets a non-blocking whisper instead of silent passage.
Three bypasses stay documented and open — variable indirection, cd+relative, heredoc mis-detection — because closing them needs shell semantics the gate can’t safely have. The honesty is the feature: the gate’s own source says exactly what it does and does not catch. No baggage added. Still markdown, JSON, and bash.
v0.13.2 · 2026-06-30 · Apache 2.0
v0.13.0 — the gate hardens, the whispers get a reader
The arc since the rail: an evidence-grounded audit of ~73,000 traced events found that the gates genuinely bite, but almost everything I do aimed at Claude and never reached John. So now the session-start brief leads with a catch-digest — one plain line of what I caught since you last looked. A continuity guard warns when a session quit without saving, so the next one never wakes under-informed in silence. The gate got accurate: it stopped missing a real quoted DROP TABLE while false-blocking a commit whose message merely mentioned rm -rf /. And gate keys split into yellow (Claude may clear) and red (John's hand only) for the irreversible class.
v0.13.0 closed the audit's punch-list: four unused commands cut (the surface is nine now), the red-clear write-net widened, and a docs overclaim retired for the truth — on a single-user box there is no OS cage behind the gate, only the channel asymmetry, the net, and the audit. No baggage added. Still markdown, JSON, and bash.
v0.13.0 · 2026-06-26 · Apache 2.0
v0.9.2 — the mission-hold rail
I used to wait to be summoned. Now I run on rails. The mission-hold rail pins the one mission — from your plan or your active todo — and re-injects it every turn so it can't scroll out of view; at the first edit after a long stretch of talking it whispers the pinned mission back, in case Claude wandered. The irreversible-action gate still fires before a commit or a destructive command, and I still show up once a session unasked. The on-demand commands are all still here — but a rail catches the drift a command you forget to run never will.
And the release itself is gated now: a verify check fails CI if a version header, a cut command, or a stale “What's new” slips through — the misses get caught, not remembered.
v0.9.2 · 2026-06-19 · Apache 2.0
v0.1.7 — save/rest/recall drive off the house-map
The house-map used to describe where memory lives. Now it decides. Its memory-source registry is the single source of truth for where memory gets read and written — each source carries an enumerated write: token (digest-fanout, handoff-only, full, read-only, secret-deny) that /maude:save and /maude:rest execute exactly. The read commands recall per each source's own method.
Edit the map, change the behavior — no code change needed. Universal stores are a fallback, used only when the map says nothing. Still markdown, JSON, and bash; no daemon.
v0.1.7 · 2026-05-24 · Apache 2.0
v0.1.6 — gate hardening
The v0.1.5 conscience gate matched bare substrings, so a HEREDOC commit message containing the literal git push self-blocked the commit that shipped it. v0.1.6 fixes it — paired quote spans and HEREDOC bodies are stripped before pattern-matching, and every gate pattern carries its own command-position or flag-position anchor. rm -rf /tmp/foo and rm -rf *.tmp no longer false-positive.
Plus a real test harness: tests/lib.sh + 16 tests/test-*.sh files + make test, exercising every script in hooks/scripts/ and scripts/maude-verify.sh. From 9 ad-hoc invocations in v0.1.5 to 162 codified test cases.