Skip to main content

Govern Claude Code, Cursor, Codex CLI, Gemini CLI

Surfaces used: coding assistant hooks Modes supported: Local Hosted Hybrid Tiers: Free (individual) Teams (org-wide enrollment)

What you'll do​

Put hard policy guardrails on the shell, file, and API operations supported assistants expose through enforceable hooks. On Claude Code, Gemini CLI, Cursor IDE, and direct Kiro CLI tool calls, a deny deterministically blocks the operation before it executes. Every event records its decision and event-level coverage in the audit trail.

Why this is the right path for you​

  • If your developers use Claude Code, Gemini CLI, Cursor IDE, or Kiro CLI and you want to stop rm -rf, secret exfiltration, or production database writes, this is for you. Codex CLI also enforces covered interactive Bash events; its other event paths remain explicitly scoped in Enforcement Coverage.
  • If you are one developer wanting to protect yourself, use Local mode -- no signup, no account.
  • If you are a Teams admin wanting the same policy across every laptop, enroll devices and deploy a signed, tamper-detecting policy bundle.
  • If you are building your own AI app in Python or Node, see Govern an AI app I'm building in Python or Node.js instead.
  • If you want Claude itself to manage policy state via tool calls, see the MCP server.

When NOT to use this approach​

caution

Coding hooks govern the assistant's local tool use. They do not govern:

  • API calls your agents make in production -> use the gateway.
  • Chat traffic in browser UIs like claude.ai or ChatGPT -> use the browser extension.
  • Code an agent is about to commit -> pair hooks with a CI policy scanner.

5-minute setup​

Single developer (Local mode)​

No signup. No account. Everything stays on your laptop.

pip install controlzero
controlzero install claude-code

Expected output:

[Control Zero] Installed hook for Claude Code at ~/.config/claude-code/hooks/
[Control Zero] Default policy loaded from ~/.controlzero/policy.yaml
[Control Zero] Audit log: ~/.controlzero/audit.log

Open Claude Code and try a blocked action:

> run rm -rf /
[Control Zero] Denied: destructive_shell_command matched rule "block_rm_rf"

Teams (org-wide enrollment)​

From an admin laptop already signed into Control Zero:

controlzero install claude-code --api-key cz_live_xxxxxxxxxxxx

Or distribute via your MDM with CONTROLZERO_API_KEY pre-set in the environment. The hook pulls a signed policy bundle on startup and keeps it current.

Verifying it's working​

  1. Tail the audit log:

    tail -f ~/.controlzero/audit.log

  2. In your coding assistant, ask it to run any shell command. The JSON event records decision: allow or decision: deny, event-level coverage, the tool name, arguments (masked on Claude Code or Gemini CLI through the Python SDK; on other hosts or Node hooks, a mask rule is enforced as deny), and the matching policy rule. A deny on a covered event stops the command before it runs.

  3. If you enrolled the device, open the dashboard -> Audit and confirm events flowing in.

Common follow-ups​

Reference​