Coding Agent Hooks by Sondera
A reference monitor for AI coding agents that intercepts every shell command, file operation, and web request through Rust hook binaries and Cedar policies, blocking exfiltration and destructive actions across Claude Code, Cursor, Copilot, and other agent tools.
This project enforces information-flow-control policies on AI coding agents by intercepting their shell commands, file operations, and web requests through per-agent hook adapters and a central policy service. Deterministic signature scanning and Cedar policy evaluation combine to return an allow, deny, or escalate decision for each event, and hooks fail closed if the policy service cannot be reached. Optional LLM-based classifiers for data sensitivity or secure-code policy are available but are explicitly probabilistic and configurable separately from the deterministic checks.
Each hook adapter supports a different subset of enforcement actions, including blocking, asking for approval, steering context, redacting tool output, or terminating a run, depending on what its host agent exposes; adapters exist for Claude Code, Cursor, GitHub Copilot, Gemini CLI, and several others including VS Code, Antigravity, Codex, and OpenHands.
It ships as Rust hook binaries with a local harness, and was presented at security conferences alongside an accompanying research paper.