Log Every Action Claude Takes with a PostToolUse Audit Hook

When Claude works on your codebase, it might run dozens of commands, edit multiple files, and search across directories. A PostToolUse hook lets you log every single action to a file so you always know exactly what happened.

Create a script at .claude/hooks/audit.sh:

#!/bin/bash
INPUT=$(cat)
TOOL=$(echo "$INPUT" | jq -r '.tool_name // "unknown"')
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')

# Log the tool name and key details
case "$TOOL" in
  Bash)
    DETAIL=$(echo "$INPUT" | jq -r '.tool_input.command // empty' | head -1)
    ;;
  Edit|Write)
    DETAIL=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
    ;;
  *)
    DETAIL=$(echo "$INPUT" | jq -r '.tool_input | keys | join(", ")' 2>/dev/null)
    ;;
esac

echo "[$TIMESTAMP] $TOOL: $DETAIL" >> .claude/audit.log

Register it in your settings.json:

{
  "hooks": {
    "PostToolUse": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash .claude/hooks/audit.sh"
          }
        ]
      }
    ]
  }
}

After a session, your audit log reads like a timeline:

[2025-03-28 14:02:11] Bash: git status
[2025-03-28 14:02:15] Read: src/auth/login.ts
[2025-03-28 14:02:18] Edit: src/auth/login.ts
[2025-03-28 14:02:22] Bash: npm test

Add .claude/audit.log to your .gitignore so it doesn't clutter your repo. For team environments, you could extend the script to POST logs to a central server instead of writing locally.

If you can't see what Claude did, you can't review it — an audit hook makes every session fully transparent.

via Claude Code