Review the dependencies they install. Set boundaries around credentials and deployment tools. Keep evidence of the actions your controls evaluate.
Follow a dependency update, a credential request or a release. See where to inspect, where to enforce and what to verify.
The new version runs an install script that downloads and executes another payload.
A tool response tells the agent to read a production credential outside the workspace.
The agent moves from editing code to running a privileged deployment command.
Evaluation scenarios, not customer incidents or live product results.
Choose the connection path before choosing the policy. Confirm the client version and test both allowed and denied actions in your environment.
| Integration | What can be evaluated | Boundary to verify |
|---|---|---|
| Claude Code / Node hooks | What can be evaluatedSupported pre-action tool events, with post-action observations. | Boundary to verifyThe client must emit the event and honor the decision. Check enforcement mode and timeout behavior. |
| Codex / Node hooks | What can be evaluatedSupported pre-action events through the dedicated Codex connection. | Boundary to verifyConfirm hook support in the installed client and which tools actually emit events. |
| Cursor, VS Code and supported MCP clients | What can be evaluatedMCP tool calls routed through the configured stdio proxy. | Boundary to verifyA wrapped MCP server does not cover every built-in shell command, file operation or direct API call. |
| MCP gateway | What can be evaluatedTool requests sent through the gateway to configured servers. | Boundary to verifyDirect connections around the gateway are outside that boundary. |
Behavior depends on the deployment profile, enforcement mode and client. Default hook failures can allow execution; configured fail-closed behavior can deny block-capable events, while client timeouts still need separate testing. Post-action observations cannot stop an action that already ran. On the hook path, queuing a quarantine item does not itself pause the tool call.
Use open-source checks in development and evaluate commercial controls where your agents act.
Check known malicious packages, installation behavior and agent configuration locally.
Scope, build, review, test and prepare a release with persistent evidence.
Inspect supported inputs and trace findings to source before approval.
Evaluate supported actions at the configured integration point.
Check policy assignments, system reports and exceptions.
Reproduce an attack under agreed conditions and verify remediation.
Bring one repository, the coding client and the tools it can reach. Define the permitted task and the action that must be stopped.
Run allowed and denied requests. Check bypass routes, unavailable services and client timeouts.
Review the policy and observed result. Identify which events produce logs or signed receipts.
Record review and investigation time against your current process, using the same scope and outputs.
No. MCP wrapping covers calls through that connection. Built-in shell commands, file operations and direct API calls require their own supported integration. Discovery alone does not establish enforcement.
Claude Code and Codex have dedicated Node hook connection paths. Cursor, VS Code and other supported MCP clients can route MCP calls through a configured proxy. The evaluation checks the client version, emitted events, mode and failure behavior.
Aguara is an open-source engine for local supply-chain checks. nanostack organizes development, review, security and QA. Signal offers supported dependency inspection; Control and Cloud provide configured runtime policy and operating evidence. Their capabilities and releases are distinct.
Yes. Agree a baseline and record time spent reviewing a dependency, investigating an exception or preparing evidence. Compare the same scope and outputs during the evaluation. No fixed time-saving claim is assumed.