Secure coding agents

Arcjet is a runtime security platform for AI agents. For coding agents, it checks each tool call and prompt against your policies before the agent acts, and it records the whole session so that you can see what every agent did.

A coding agent runs shell commands, edits files, fetches URLs, and calls MCP servers with a developer’s credentials. Claude Code, Cursor, GitHub Copilot, OpenAI Codex, and Muse Code fire hooks as they work, including before a tool call runs. Arcjet connects to those hooks, so there’s no SDK to install and no code to change. You write a policy once in the Arcjet Console, and it applies to every supported agent.

Capabilities

Arcjet adds the following controls to a coding agent:

Block risky tool calls before they run, such as destructive shell commands or reads of credential files. Each check is a separate policy, so you publish only the ones you need.
Screen prompts for prompt injection and sensitive information before they reach the model.
Limit outbound requests to approved domains, and deny destinations that Arcjet IP threat intelligence rates as high or critical risk.
Limit which models developers can use.
Record each session in the Console, including prompts, tool calls, tool results, subagents, and session start and end.
Run each rule in dry run first, review what it would have denied, and then set it live.

Use cases

Each use case in the following table has a starter policy that you can publish from the Console and adjust.

Use case	Starter policy
Stop destructive shell commands such as `rm`, `dd`, and `sudo`	`coding-agent.destructive-command`
Keep agents away from SSH keys, `.env` files, and cloud credentials	`coding-agent.credential-access`
Refuse a download piped into a shell	`coding-agent.piped-installer`
Prevent `git push --force` and `git reset --hard`	`coding-agent.rewrite-history`
Protect CI configuration and version-control internals	`coding-agent.protected-paths`
Allow only approved MCP servers	`coding-agent.mcp-allowlist`
Allow only approved outbound domains	`coding-agent.egress-allowlist`
Deny high-risk destinations	`coding-agent.destination-threat`
Block prompt injection in a developer’s prompt	`coding-agent.prompt-injection`
Keep card numbers and Social Security numbers out of prompts	`coding-agent.sensitive-info`
Allow only approved models	`coding-agent.model-allowlist`
Refuse tool calls while the agent skips its own approvals	`coding-agent.no-auto-mode`
Block the AWS CLI, AWS APIs, and AWS credentials	`coding-agent.aws-access`

How it works

┌─────────────┐      hook      ┌───────────────┐    allow    ┌───────────────┐
│ Coding agent│───────────────▶│ Arcjet policy │────────────▶│ Tool runs     │
└─────────────┘                └───────┬───────┘             └───────────────┘
                                       │
                                       │ deny
                                       ▼
                               ┌───────────────┐
                               │ Agent stops   │
                               └───────────────┘

You install the Arcjet hooks through the agent’s managed settings, MDM, or a repository file. Claude Code and Copilot post each event to Arcjet over HTTP. Codex, Cursor, and Muse Code run hooks as commands, so the install adds a small wrapper script that posts the event with curl.
When the agent fires a hook, Arcjet runs every policy attached to that point in the session: Tool call, Prompt, or Model switch. Policies run at the edge in over 300 data centers, so the added latency stays small.
If every policy allows the action, Arcjet answers {} and the agent continues through its own permission flow. If a policy denies it, Arcjet answers in the agent’s own denial format, and the agent stops and reports the rule that fired.
Arcjet records the event, along with the events that no policy runs on, such as tool results and session start and end. The session appears in the site’s Activity in the Arcjet Console.

For the endpoint, the full event list, and each agent’s denial format, see Coding agent hook reference.

Guard policies

Coding agent policies are Arcjet Guard policies. You write them in Rego or assemble them in the Console’s visual builder. Arcjet builds a fixed set of inputs from each hook payload, including the shell command, file paths, domains, the MCP server, the prompt, and the model. It maps each agent’s tool names to one tool_kind, such as shell or file_write, so a single policy covers every agent. A policy can also use Arcjet detectors for prompt injection, sensitive information, and IP threat intelligence.

The hook file doesn’t name any policy. Publishing a policy turns it on, and a change takes effect without touching the hooks. Arcjet runs every policy attached to the same Execute on option in one round trip and applies the most restrictive decision. Each rule can run live or in dry run, which logs the decision without denying anything.

Starter policies

Arcjet includes a starter policy for each use case in the Use cases table. Pick a starter in the Console, edit its Rego to match your environment, and publish it in dry run. For the input contract, the starters, and how to write your own, see Coding agent policies.

Supported agents

Agent	Hook type	Tool call	Prompt	Model switch	If Arcjet doesn’t answer
Claude Code	HTTP	Enforced	Enforced	Enforced	Fails open; a model switch fails closed
Cursor	Command wrapper	Enforced	Enforced	Not available	Fails closed
GitHub Copilot	HTTP	Enforced	Recorded only	Not available	Fails open
Muse Code	Command wrapper	Enforced	Enforced	Not available	Fails closed
OpenAI Codex	Command wrapper	Enforced	Enforced	Not available	Fails closed

Copilot drops hook output on a prompt, so Arcjet records a prompt denial but Copilot doesn’t apply it. Copilot enforcement covers the Copilot CLI and the cloud coding agent, because VS Code agent hooks don’t support the HTTP hook type. Cursor cloud agents run tool-call hooks but not prompt hooks.

Codex and Cursor don’t fire a model switch hook. Instead, an allowed-models policy refuses their prompts and tool calls while a disallowed model is selected. For coverage by agent, see Allowed models.

Limitations

Claude Code and Copilot HTTP hooks fail open on a timeout or an error, so enforcement depends on Arcjet answering in time. The Codex, Cursor, and Muse Code wrappers fail closed: if Arcjet can’t be reached or the key is wrong, the agent’s prompts and tool calls are denied.
Arcjet can’t block what a tool returns. A poisoned web page or MCP response arrives after the tool has run, so Arcjet records it but can’t withhold it.
A hook covers one installed client. To find sessions that never reached a hook, use OpenTelemetry or Compliance API ingest. To keep personal accounts off managed devices, see Block personal accounts.

For every limit by agent, see Enforcement limitations.

Get started

To start, install the hooks for your agent, and then publish a starter policy in dry run.

Claude Code Install the hooks through managed settings, MDM, server-managed settings, or a repository, and reach cloud sessions.

Cursor Install the command wrapper for the IDE, CLI, and cloud agents, and lock it for a team or enterprise.

GitHub Copilot Install the hooks for the Copilot CLI and the cloud coding agent, and lock them with an administrator policy.

Muse Code Install the command wrapper through a repository, user settings, or a managed hooks file.

OpenAI Codex Install the command wrapper through managed requirements, MDM, cloud-managed requirements, or a repository.

Coding agent policies The input contract, the starter policies, and how to write and roll out your own.

Hook reference The endpoint, every event by agent, the denial each agent receives, and where enforcement stops.

Observe agent activity Record agent sessions through OpenTelemetry or the Claude Compliance API, without enforcing.

Block personal accounts Keep personal Claude Code, Codex, Copilot, and Cursor accounts off managed networks.