AI coding agent harness compatibility
Support varies by adapter and event surface. HOL Guard provides native enforcement for harnesses with native approval, browser fallback, and auto-resume (codex, claude-code, copilot, pi). Other harnesses are protected through wrapper or overlay mode with advisory detection. See the limitations for each adapter below.
Legend: support status vocabulary
- Native enforcement
- Guard hooks into the native approval flow, provides a browser fallback, and can auto-resume after a crash or restart.
- Managed hook or proxy
- Guard intercepts actions through a native hook or proxy but cannot automatically resume the session after an interruption.
- Wrapper or overlay
- Guard wraps or overlays the tool and provides a browser fallback, but does not hook into the native approval flow.
- Detect or advisory only
- Guard observes and advises but does not enforce. Manual review is required for actions Guard cannot block natively.
| Tool | Aliases | Status | Integration mode | Native approval | Browser fallback | Terminal fallback | Auto-resume | Event surfaces | Blind spots | Guide | Constraints |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Codex | codex | Native enforcement | Native hook | Yes | Yes | Yes | Yes | shell · prompt · mcp_tool · file_read · tool_result | Inline file edits applied directly by the model without a tool call are not visible to Guard. | Guide → | ~/.codex/config.toml |
| Claude Code | claude-code · claude | Native enforcement | Native hook | Yes | Yes | Yes | Yes | shell · prompt · mcp_tool · file_read · tool_result | Background agent sessions that run without an active terminal do not surface hook events to Guard. | Guide → | ~/.claude/settings.json, ~/.claude/settings.local.json |
| OpenCode | opencode | Wrapper or overlay | Wrapper overlay | No | Yes | Yes | No | shell · mcp_tool | Prompt content is not currently surfaced through hooks. File read/write events bypass Guard unless OpenCode permission rules block them. | Guide → | ~/.config/opencode/config.json |
| GitHub Copilot CLI | copilot | Native enforcement | Native hook | Yes | Yes | Yes | Yes | shell · prompt | MCP tool calls routed through the VS Code extension are not visible to the CLI-level Guard hook. | Guide → | ~/.config/gh/hosts.yml |
| Cursor | cursor | Wrapper or overlay | Wrapper overlay | No | Yes | Yes | No | shell · mcp_tool · file_read | Shell commands issued through Cursor's built-in terminal bypass Guard unless the terminal runs inside an agent session. Prompt submission is not surfaced through native Cursor hooks. | Guide → | ~/.cursor/mcp.json, ~/.cursor/hooks.json, .cursor/hooks.json |
| Gemini CLI | gemini | Wrapper or overlay | Wrapper overlay | No | Yes | Yes | No | shell · mcp_tool | Prompt submission events and file read/write operations are not currently observable through the Gemini hook surface. | Guide → | ~/.gemini/settings.json |
| Hermes | hermes | Wrapper or overlay | Wrapper overlay | No | Yes | Yes | No | shell · mcp_tool · prompt | Hermes is an early-access harness; some event surface coverage depends on the Hermes version installed. | Guide → | — |
| OpenClaw | openclaw | Wrapper or overlay | Wrapper overlay | No | Yes | No | No | mcp_tool | Shell commands and prompt events are not currently observable. Guard only intercepts MCP tool calls via the proxy layer. | Guide → | ~/.openclaw/config.json |
| Antigravity | antigravity | Wrapper or overlay | Wrapper overlay | No | Yes | No | No | mcp_tool · prompt | Shell commands are not currently observable through the Antigravity hook surface. Guard intercepts extensions and MCP registrations via scan at launch time. | Guide → | ~/.config/antigravity/user/settings.json, ~/.gemini/antigravity/mcp_config.json, ~/.antigravity/extensions/extensions.json |
| Kimi Code | kimi · kimi-code · kimi-cli | Wrapper or overlay | Wrapper overlay | No | Yes | Yes | No | shell · prompt | Tool output post-processing and inline edits applied without a tool call are not visible to Guard. Hooks run in parallel and fail open on crash or timeout. | Guide → | ~/.kimi-code/config.toml |
| Grok Build | grok · grok-build · grok-build-cli · xai-grok | Wrapper or overlay | Wrapper overlay | No | Yes | Yes | No | shell · prompt · mcp_tool · file_read | Grok hooks fail open on crash or timeout. --always-approve and bypassPermissions weaken prompt policy but PreToolUse hooks still run when installed. | Guide → | ~/.grok/config.toml, ~/.grok/managed_config.toml, ~/.grok/hooks/ |
| Pi / Oh My Pi | pi · pi-agent · pi-coding-agent · omp · oh-my-pi | Native enforcement | Native hook | Yes | Yes | Yes | Yes | shell · prompt · mcp_tool · file_read · tool_result | Pi package install and update flows happen outside the runtime extension bridge, so Guard observes the configured package surfaces plus the prompt and tool events forwarded by the managed extension. | Guide → | ~/.pi/agent/settings.json, .pi/settings.json, ~/.pi/agent/extensions/*.ts, .pi/extensions/*.ts, ~/.omp/agent/settings.json, .omp/settings.json, ~/.omp/agent/extensions/*.ts, .omp/extensions/*.ts |
| Z Code | zcode · zai · z-code · zai-zcode | Wrapper or overlay | Wrapper overlay | No | Yes | Yes | No | shell · prompt · mcp_tool · file_read | Inline edits applied directly by the model without a tool call are not visible to Guard, and background sessions that run without an active terminal do not surface hook events. | Guide → | ~/.zcode/cli/config.json, ~/.zcode/cli/plugins/ |
Planned
Planned
Goose is on the roadmap but no Guard adapter ships yet. Once Goose stabilizes its hook surface, Guard will provide MCP tool interception and shell event observation. No install command is available today.
Explicitly not supported
- Not supported
VS Code Copilot extension (GUI mode): Guard hooks the Copilot CLI, not the VS Code extension panel. MCP tool calls routed through the extension are not visible to the CLI-level hook. See the Copilot harness guide for the CLI-only integration path.
- Not supported
Goose: No Guard adapter ships yet. Goose is listed as planned above.