---
title: "Third-party AI coding tools"
---

# Third-party AI coding tools

The control level Neural Inverse Govern has over each third-party AI coding tool, with its caveats, and how policy reaches each one.

Govern governs third-party AI coding tools as far as each tool's own mechanisms allow, and no further. This page states that limit for each tool. The console shows the same levels, and `GET /api/v1/orgs/{orgID}/agent-policy/coding-tools` returns them, with the vendor mechanism, failure mode, lock and uncovered actions of each tool.

## Control levels

| Level | Meaning |
|---|---|
| Enforced | The tool runs a blocking pre-action hook and honours its deny, and the hook sits in a managed location the developer cannot remove or disable. |
| Managed configuration | Govern installs and locks the tool's configuration (tool exclusions, MCP servers, model and base URL). Any hook it also runs is advisory. |
| Network | Control holds only while the tool's traffic goes through the Govern model gateway or MCP proxy. Without an egress lock on developer machines it can be bypassed. |
| Monitored | Vendor audit or telemetry only. Nothing is blocked. |
| Not controlled | Govern has no control. Listed so administrators see the gap. |

Only an Enforced tool blocks reliably; a Managed configuration tool blocks what its locked configuration removes. The levels below assume the endpoint agent has installed the compiled policy file at the tool's managed location.

## Setup pages per tool

| Tool | Policy control | Model traffic through the gateway |
|---|---|---|
| [Claude Code](https://neuralinverse.com/docs/govern/tool-claude-code/) | Enforced, with managed settings | Yes (Network) |
| [OpenAI Codex CLI](https://neuralinverse.com/docs/govern/tool-codex/) | Advisory until verified | Yes (Network) |
| [Cursor](https://neuralinverse.com/docs/govern/tool-cursor/) | Enforced, with the enterprise hooks file | Partial |
| [Windsurf](https://neuralinverse.com/docs/govern/tool-windsurf/) | Enforced, with the system hooks file | No |
| [GitHub Copilot CLI](https://neuralinverse.com/docs/govern/tool-copilot-cli/) | Enforced, with the policy hook directory | No |
| [Gemini CLI](https://neuralinverse.com/docs/govern/tool-gemini-cli/) | Managed configuration, advisory hook | No |
| [Kiro CLI](https://neuralinverse.com/docs/govern/tool-kiro/) | Monitored, advisory hook | No |
| [Cline](https://neuralinverse.com/docs/govern/tool-cline/) | Monitored, advisory hook | Yes (Network) |

Every tool page follows the same order: write the policy, enrol the machine, check the preview for the tool's engine, then add model routing and audit where the tool supports them.

## Tools with policy hooks

The vendor tool levels were verified against each vendor's mechanism and version on 2026-10-15.

| Tool | Level | Mechanism | When the hook fails | Not covered |
|---|---|---|---|---|
| Cursor | Enforced | Enterprise `hooks.json` (beforeShellExecution, beforeMCPExecution, beforeReadFile) with failClosed, in the root-owned enterprise location | A crash, timeout or invalid output blocks the action | File edits (Cursor has no hook before an edit); Cursor's own web search and fetch tools; beforeReadFile in the cursor-agent CLI, which Cursor's forum reports as not implemented |
| Windsurf (Devin Desktop) | Enforced | System-level Cascade `hooks.json` (pre_run_command, pre_read_code, pre_write_code, pre_mcp_tool_use), which needs root to change | The compiled command turns every failure into a block | Cascade's web search and other tools without a pre-hook. Hooks answer only allow or block, so an ask is a block |
| GitHub Copilot CLI | Enforced | Policy hook in `/etc/github-copilot/policy.d`, root-owned, not turned off by `disableAllHooks` and run regardless of folder trust | A crash or non-zero exit denies; a timeout lets the call through, so the hook answers before its deadline | MCP rules that name a server: the hook input does not name the MCP server separately |
| Gemini CLI | Managed configuration (advisory hook) | System overrides `settings.json`: a BeforeTool hook, and `tools.exclude` for kinds the policy denies outright | A timeout lets the call run; other failures are turned into a deny | Every action when the developer disables the hook by name in user settings, or works in a folder they have not trusted. An ask is a deny |
| Kiro CLI | Monitored (advisory hook) | PreToolUse hook file in the user's `~/.kiro/hooks` | Any exit status but 2 lets the call run | Every action once the developer deletes the hook file; Kiro has no managed hook location. An ask is a block |
| Cline | Monitored (advisory hook) | Global PreToolUse hook script in `~/Documents/Cline/Hooks` | The script answers a cancel when the agent does not answer | Every action while Cline's "Enable Hooks" setting is off or the script is removed. An ask is a cancel |
| Amazon Q Developer (IDE plugins) | Monitored | Vendor audit connector and endpoint discovery; the plugins have no hook API | Nothing is blocked | Every action |
| Continue | Not controlled | Endpoint discovery only; no hook API and no audit API | Nothing is blocked | Every action |

Kiro and Cline have no managed location, so their hook files are compiled and can be previewed, but the endpoint agent's system service does not install them.

How these levels were proven differs by tool. GitHub Copilot CLI and Gemini CLI were run for real, offline, with the compiled file and the real endpoint agent: a denied `rm -rf` was refused and an allowed `ls` ran. For Gemini CLI, the same deny was bypassed when the developer disabled the hook, which is why it is not Enforced. Cursor, Windsurf, Kiro and Cline are closed source or have no offline build; their documented hook input was run through the real enforcement hook and daemon, but the tools themselves were not run.

### Claude Code

Govern compiles the policy into Claude Code's `managed-settings.json`, which the endpoint agent installs at the operating system's managed path. The managed settings:

- carry the permission rules Claude Code can express (`permissions.allow`, `ask` and `deny`);
- set `allowManagedPermissionRulesOnly` and `allowManagedHooksOnly`, so user and project settings cannot add allow rules or hooks;
- disable bypass-permissions mode and auto mode, so an ask reaches a person;
- run Govern's enforcement hook on every tool call, which enforces the rules Claude Code cannot express itself.

Govern treats Claude Code as Enforced on devices where these managed settings are installed. Hooks a developer adds in their own user settings are advisory.

### Codex

Govern compiles the policy into Codex's `requirements.toml` (hard constraints a user cannot override, including managed hooks only), `config.toml` and a rules file under `/etc/codex`. Enforcement through Codex's managed hooks has not yet been verified against a released Codex CLI that runs managed hooks and honours a deny, so treat it as advisory until it is. Developers' own exec rules can allow commands no organisation rule matches, but cannot loosen an organisation rule.

### Where the hook file is not in the managed location

The levels above depend on the managed, root-owned location. A Cursor `hooks.json` in user or project configuration is not locked and Cursor runs the action when the hook script fails, so it is advisory. A GitHub Copilot CLI hook file in a repository (`.github/hooks`) is not locked either.

## Tools routed through the model gateway

A tool can send its model requests to the Govern model gateway with a short-lived gateway token, so model access, budgets, DLP, guardrails, rate limits and request logs apply to its traffic. This is Network-level control.

| Tool | Level | How |
|---|---|---|
| Claude Code | Network | `ANTHROPIC_BASE_URL` and `apiKeyHelper` |
| OpenAI Codex CLI | Network | `model_providers` in `config.toml` |
| Aider | Network | `OPENAI_API_BASE` |
| Continue | Network | `apiBase` of an `openai` model |
| Cline, Roo Code | Network | OpenAI Compatible provider |
| Cursor | Network (partial) | Custom OpenAI base URL for custom models only; Tab and Cursor-hosted models never reach Govern |
| Gemini CLI | Monitored | OpenTelemetry events to vendor audit; the gateway does not serve the Gemini API |
| GitHub Copilot | Monitored | Connector seats, usage and metrics |
| Windsurf | Not controlled | No custom endpoint and no audit feed of model requests |

Without an egress lock that blocks the providers' APIs from developer machines, a person can bypass the gateway with another key or endpoint.

## Tools that are monitored through vendor audit

Vendor audit connectors bring a tool's own audit and usage records into Govern, where administrators read and export them. They observe; they do not block.

- **Pull connectors** (Govern polls the vendor's API with credentials held in its vault): Anthropic Compliance API, Anthropic Admin API, OpenAI Compliance API, OpenAI Admin API, Azure OpenAI, Amazon Bedrock, Google Cloud (Vertex AI, Gemini Code Assist), Gemini for Workspace, Microsoft 365 Copilot, Amazon Q Developer, GitHub Copilot, Tabnine, Cursor, GitLab Duo, xAI, Mistral, OpenRouter, Atlassian, Slack and Box AI.
- **Push receivers** (the tool sends events to Govern with a revocable ingest token): Claude Code, Gemini CLI and OpenAI Codex over OpenTelemetry, and any service that posts JSON to `POST /api/v1/vendor-audit/webhook`.

Pull connectors call the vendor's service, so in an air-gapped installation only connectors whose service is reachable inside your network can be used. Setting up connectors is covered under [Evidence](https://neuralinverse.com/docs/evidence/).

## How policy reaches each tool

1. An administrator writes one agent policy in Govern. See [Agent policy](https://neuralinverse.com/docs/govern/agent-policy/).
2. Govern compiles it for each engine: Claude Code's managed settings, Codex's requirements and config files, or a vendor tool's native hook file. Every rule the engine cannot express is listed as a gap with its severity, never dropped silently.
3. The endpoint agent (`keystone-agent`) fetches the compiled policy as an Ed25519-signed manifest, verifies it, and installs the files at the tool's managed location.
4. Each hook calls `keystone-agent policy enforce --engine <tool>`, so every tool is decided by the same rules, approvals and decision log. A tool name the agent does not recognise is denied.
5. Decisions are reported to Govern's decision log, with the target stored only as a hash.

Use the preview (`GET /api/v1/orgs/{orgID}/agent-policy/preview?engine=<tool>`) to see the gaps for a tool before you rely on a rule.