# Third-party AI tools · Neural Inverse Govern

> Govern compiles one policy into each tool's own controls and states, tool by tool, what it enforces, what it only configures and what it can only observe.

Source: https://neuralinverse.com/govern/third-party-tools/

---

![](/photos/hangar.jpg)

[Neural Inverse Govern / Third-party AI tools](https://neuralinverse.com/govern/)

# Govern the AI tools your teams already use, and know exactly how far that reaches.

Govern compiles one policy into each tool's own controls and states, tool by tool, what it enforces, what it only configures and what it can only observe.

Enforced

Claude Code, Cursor, Windsurf, GitHub Copilot CLI

In verification

Codex

Managed configuration

Gemini CLI

Monitored

Kiro CLI, Cline, Amazon Q Developer

Levels verified

October 2026

Overview

Govern governs third-party AI coding tools as far as each tool's own mechanisms allow, and no further. The endpoint agent installs the compiled policy where each tool reads it, every hook asks the same decision service, and model traffic can be routed through the AI Gateway. Where a tool has no control point, Govern says so and shows the gap.

[Control levels ↓](https://neuralinverse.com/#levels)[What it does ↓](https://neuralinverse.com/#capabilities)[How it works ↓](https://neuralinverse.com/#workflow)[Enforced and recorded ↓](https://neuralinverse.com/#enforcement)[Where it runs ↓](https://neuralinverse.com/#where)[Get started ↓](https://neuralinverse.com/#get-started)

Control levels

## How far Govern reaches inside each tool.

Only an Enforced tool blocks reliably; a Managed configuration tool blocks what its locked configuration removes. The levels assume the endpoint agent has installed the compiled policy in the tool's managed location, and were verified against each vendor's mechanism and version in October 2026.

Enforced

A blocking pre-action hook in a managed location the developer cannot remove or disable.

Managed configuration

Govern installs and locks the tool's configuration. Any hook it also runs is advisory.

Network

Holds only while the tool's traffic goes through the Govern model gateway or MCP proxy.

Monitored

Vendor audit or telemetry only. Nothing is blocked.

Not controlled

Govern has no control. Listed so administrators see the gap.

| Tool | Agent actions | What it covers and what it does not |
| --- | --- | --- |
| Claude Code | Enforced | On devices where Govern's managed settings are installed: user and project settings cannot add allow rules or hooks, and bypass modes are off. Hooks a developer adds in their own settings are advisory. |
| Cursor | Enforced | Shell commands, MCP calls and file reads. Not covered: file edits, Cursor's own web search and fetch tools, and file reads in the cursor-agent CLI. |
| Windsurf | Enforced | Commands, code reads and writes and MCP calls. Not covered: web search and other tools without a pre-action hook. An ask is a block. |
| GitHub Copilot CLI | Enforced | A root-owned policy hook. Rules that name a specific MCP server cannot be applied, and the hook must answer before its deadline. |
| Codex | In verification | Policy is compiled into Codex's managed requirements and configuration. Enforcement through its managed hooks is not yet verified against a released version, so treat it as advisory. |
| Gemini CLI | Managed configuration | Denied tools are excluded in locked settings. The hook is advisory: a developer can disable it or work in an untrusted folder. An ask is a deny. |
| Kiro CLI | Monitored | Advisory hook in the user's own directory. Deleting the hook file removes it; Kiro has no managed location. |
| Cline | Monitored | Advisory hook script. No effect while Cline's hooks setting is off or the script is removed. |
| Amazon Q Developer | Monitored | IDE plugins have no hook interface. Activity arrives through the vendor audit connector. |
| Continue | Not controlled | No hook and no audit interface. Model traffic can be routed through the gateway (Network). |

### Model traffic through the AI Gateway.

| Tool | Model traffic | How |
| --- | --- | --- |
| Claude Code | Network | Base URL and a credential helper that fetches a short-lived token. |
| Codex | Network | A model provider entry in its configuration, with a short-lived token. |
| Aider | Network | OpenAI-compatible base URL. |
| Continue | Network | OpenAI-compatible base URL of a model. |
| Cline, Roo Code | Network | The OpenAI Compatible provider, with a short-lived token. |
| Cursor | Network (partial) | Custom models only, through a custom base URL that must be reachable from the internet. Tab completion and Cursor-hosted models never reach Govern. |
| Gemini CLI | Monitored | OpenTelemetry events to vendor audit; the gateway does not serve the Gemini API. |
| GitHub Copilot | Monitored | Seats, usage and metrics through the vendor connector. |
| Windsurf | Not controlled | No custom endpoint and no audit feed of model requests. |

Product names belong to their owners.

What it does

## What Govern does for third-party tools.

One policy, compiled into each tool's own mechanism, with the limits stated.

- **One policy, every engine:** The agent policy you write is compiled for each tool: Claude Code's managed settings, Codex's requirements and configuration files, or a vendor tool's native hook file.
- **Gaps are listed, never dropped:** Every rule a tool cannot express exactly is listed as a gap with its severity in the preview, so you see per tool what holds before you rely on a rule.
- **Managed locations:** The endpoint agent installs the compiled file in the tool's managed, root-owned location where one exists. A hook file in user or project configuration is not locked and only advisory.
- **Same decision service:** Every hook asks the endpoint agent, so every tool is decided by the same rules, approvals and decision log. A tool name the agent does not recognise is denied.
- **Model traffic through the gateway:** Tools that accept a custom endpoint can send their model requests to the AI Gateway, so model access, budgets, DLP, guardrails, rate limits and request logs apply (Network level).
- **Short-lived tokens for tools:** Tools call the gateway as the person using them, with a token of at most one hour bound to their session or enrolled device, never a long-lived key.
- **Vendor audit: pull:** Govern polls vendors' audit and usage APIs with credentials held in its vault, among them Anthropic, OpenAI, Azure OpenAI, Amazon Bedrock, Google Cloud, Microsoft 365 Copilot, Amazon Q Developer, GitHub Copilot, Cursor, GitLab Duo, Slack and Box AI.
- **Vendor audit: push:** Claude Code, Gemini CLI and OpenAI Codex send OpenTelemetry events, and any service can post JSON records, each with a revocable ingest token. From the OpenTelemetry tools, prompt text and tool details are withheld unless you choose to store them.
- **How the levels were proven:** GitHub Copilot CLI and Gemini CLI were run for real, offline, with the compiled file and the real endpoint agent. For Cursor, Windsurf, Kiro and Cline, their documented hook input was run through the real enforcement hook; the tools themselves were not run.

How it works

## How policy reaches each tool.

1.  Write
    
    An administrator writes one agent policy in Govern.
    
2.  Compile
    
    Govern compiles it for each engine and lists every gap.
    
3.  Deliver
    
    The endpoint agent verifies the signed manifest and installs the files at the tool's managed location.
    
4.  Decide
    
    Each hook calls the endpoint agent, which decides by the same rules and approvals for every tool.
    
5.  Report
    
    Decisions go to Govern's decision log, with the target stored only as a hash.
    

Who uses it

## Built for every role that answers for AI.

- **Security teams:** Write one policy for every tool, read the gaps per engine and decide which tools to allow.
- **Endpoint and IT teams:** Enrol machines with the endpoint agent and deploy managed settings with your device management tool.
- **Engineers:** Keep the tools they already use, with the same rules and approvals wherever they work.
- **Compliance and audit:** Read vendor audit records beside Govern's own, and export them with a signed manifest.

Enforced and recorded

## What blocks, what is configured and what is only observed.

The control level of each tool says which of these applies. Only an Enforced tool blocks reliably.

Enforced

- **Enforced tools:** The tool runs a blocking pre-action hook from a location the developer cannot change, and honours its deny.
- **Managed configuration:** What the locked configuration removes, such as excluded tools, stays removed. Any hook the tool also runs is advisory.
- **Network:** Model access, budgets, DLP and guardrails, while the tool's traffic goes through the AI Gateway.

Recorded

- **Hook decisions:** Decisions made by a tool's hook are reported to the decision log, also for monitored tools whose hook a developer can remove.
- **Vendor records:** Vendor audit and usage records show what the vendor reported. They observe; they do not block.

The levels assume the endpoint agent has installed the compiled policy in the tool's managed location. Without an egress lock on developer machines, a person can bypass the gateway with another key or endpoint. Pull connectors call the vendor's service, so in an air-gapped installation only services reachable inside your network can be used.

Where it runs

## On the machines where the tools run.

[Deployment options](https://neuralinverse.com/deployment/)

- **Linux, macOS and Windows:** The endpoint agent installs each tool's compiled file at the tool's managed path for that operating system.
- **Tools without a managed location:** Kiro and Cline hook files can be previewed and distributed by you; the endpoint agent's system service does not install them.
- **Air-gapped:** Hooks and gateway routing work inside your network. Cursor's custom-model routing needs an address reachable from the internet, so it is not available air-gapped.
- **Hosted by us:** We run it for you, with the same controls and audit record.

Get started

## Set it up with the documentation.

-   [Third-party AI coding tools](https://neuralinverse.com/docs/govern/third-party-tools/)
-   [Claude Code](https://neuralinverse.com/docs/govern/tool-claude-code/)
-   [OpenAI Codex CLI](https://neuralinverse.com/docs/govern/tool-codex/)
-   [Cursor](https://neuralinverse.com/docs/govern/tool-cursor/)
-   [Windsurf](https://neuralinverse.com/docs/govern/tool-windsurf/)
-   [GitHub Copilot CLI](https://neuralinverse.com/docs/govern/tool-copilot-cli/)
-   [Gemini CLI](https://neuralinverse.com/docs/govern/tool-gemini-cli/)
-   [Kiro CLI](https://neuralinverse.com/docs/govern/tool-kiro/)
-   [Cline](https://neuralinverse.com/docs/govern/tool-cline/)
-   [Vendor AI audit connectors](https://neuralinverse.com/docs/evidence/vendor-connectors/)
-   [Push receivers](https://neuralinverse.com/docs/evidence/push-receivers/)

Related

[Agent policy and approvals →

Allow, ask and deny rules for coding agents, with named approvers.](https://neuralinverse.com/govern/agent-policy/)[AI Gateway →

Approved models, DLP, guardrails, budgets and rate limits for every model request.](https://neuralinverse.com/govern/ai-gateway/)[Audit and evidence →

A hash-chained audit log you can verify offline, and evidence toward your frameworks.](https://neuralinverse.com/govern/audit/)

![](/photos/team.jpg)

## Talk to our team.

Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.

[Request access](https://neuralinverse.com/contact/?topic=access)[Contact us](https://neuralinverse.com/contact/)