some file

Coding Agents

Coding agents are the AI CLIs your developers already run. You use them but do not build them, so there is no code to embed an SDK into. Netzilo governs them with hooks: the Netzilo client registers itself in each agent's own hook system, and the agent asks the client before every tool call and prompt. A guardrail can block the action before it runs. Results go to the same dashboard as the rest of AIDR.

Watch · 1:30

Govern every AI tool on a laptop

Claude Code and a homemade script with a personal API key get the same guardrails, on the device itself.

All how-to videos →YouTube ↗

Supported agents

AgentSettings the hook is written toEvents sent to Netzilo
Claude Code~/.claude/settings.json (Windows: %APPDATA%\Claude\settings.json)before and after each tool call, a failed tool call, each prompt you submit, session start and end
OpenAI Codex CLI~/.codex/config.tomlbefore and after each tool call, permission requests, each prompt, session start
Google Gemini CLI~/.gemini/settings.jsonbefore and after each tool call, before and after each model call, session start and end
OpenClawa plugin installed with openclaw plugins install (needs openclaw on your PATH)before and after each tool call, before each agent run, session end

Cursor is not a hook framework. Govern it through the Netzilo client's proxy by adding its executable to an endpoint filter's Agents, see General-Purpose Agents.

Before you start

  • The Netzilo client is installed, running and signed in on the machine. The hooks talk only to the client on localhost. See Install Netzilo.
  • The device is in a group matched by an enabled Endpoint filter that binds guardrails, under Edge > Filters. See Filters.

Install the hooks

One command sets up the hooks for whichever of these agents is on the machine:

curl -fsSL https://pkg.netzilo.com/download/plugin/install.sh | sh
  • Linux: the command also installs the Netzilo client if it is missing.
  • macOS and Windows: install the Netzilo client first, then run the command, or register each agent with the client's CLI as below.

Register or check one agent with the Netzilo CLI:

netzilo hook install --framework=claude-code   # or codex, gemini, openclaw
netzilo hook verify --framework=claude-code

Restart the agent CLI after installing. netzilo hook verify reports that the hook is ready, or tells you what is missing: Daemon not reachable … start the Netzilo client. or Hook not registered. Running the install again is safe: it updates what is set up, and repairs the hook after a client upgrade. netzilo hook uninstall --framework=<agent> removes it.

What the agent sees

  • Block: the agent receives the rule's reason, by default Blocked by Netzilo security policy, and does not run the tool call or send the prompt.
  • Allow, report: the agent continues; a report records an AI detected event.
  • Redact: a hook can only allow or block, so a redaction rule cannot rewrite a tool call through a hook. Use a block rule for tool calls, or route the agent's model traffic through the AI Gateway, where prompts and answers can be redacted.

Tool output sent for evaluation is capped at 8 KB.

Fail-open and fail-closed

If the Netzilo client is not reachable, the hooks let the agent continue (fail-open). To stop the agent instead, set NETZILO_HOOK_POLICY=block in the agent's environment; the agent then sees Netzilo unavailable (fail-closed): ….

VariableDefaultMeaning
NETZILO_HOOK_POLICYallowblock makes the hook fail closed
NETZILO_HOOK_TIMEOUT_MS5000How long the hook waits for the client
NETZILO_HOOK_SKIPTool names to skip, for example "Glob Grep LS"

Use the AI Gateway as well

A coding agent can also send its model traffic through the Netzilo AI Gateway: Claude Code with ANTHROPIC_BASE_URL=<gateway>/anthropic, Codex with an OpenAI base URL of <gateway>/v1, each with the user's Netzilo token. The gateway then identifies the user, applies model grants, budgets and guardrails, and counts usage. Keep the hooks as well: they block tool calls on the device as they happen. A call the device sees going to the AI Gateway is recorded once, by the gateway. Users find the exact settings in the Workplace under Agentic Access.

Where the results show

  • Activity > Events, category AI Edge: each verdict as AI blocked, AI redacted, AI detected and so on, naming the agent, the tool or model, the rule and the filter. Allowed calls are not events; they are in the session. See Events.
  • Activity > AI Sessions: when the client also inspects the agent's HTTPS traffic (the agent is in the filter's Agents), the agent's model calls and the hooks' steps of the same Claude Code session are one AI session, with its trajectory and MCP calls. See AI Sessions.
  • The agent's own session id becomes the session in the behavior graph, so everything one Claude Code session did is grouped together. See Behavior Graph & Kill Chains.

Troubleshooting

The hook is installed but nothing happens

Run netzilo hook verify --framework=<agent>. Start the Netzilo client if it is not running, and check that an enabled endpoint filter with guardrails matches the device. Set NETZILO_HOOK_POLICY=block while you test, to see when the client is not reached.

The agent blocks everything while the client is down

NETZILO_HOOK_POLICY=block is set. This is the fail-closed behavior; start the client.

Events appear but are not linked in the behavior graph

The hook was registered by an older client. Run netzilo hook install --framework=<agent> again.

Coding agents are the pre-deployment and run-time integration for agents you do not build. See AI Agent Lifecycle for how this compares to the SDK (Custom Agents), the client (General-Purpose Agents) and the AI Gateway.