Skip to main content
HiddenLayer Agent Harness Security can gate AI coding agents at every risky step of a session — when a prompt is submitted, before a tool or shell command runs, when tool output comes back, and when files are read or edited. Your existing security policies decide what happens at each step: block the action, redact sensitive content, or detect and record it for investigation. The same policy that protects your other AI traffic governs your coding agents — select the project (and therefore the policy) with the HL-Project-Id header, exactly as with the other evaluation APIs.

​
Supported Coding Agents

​
How It Works

  1. The coding agent’s hook system calls Agent Harness Security at each gate point, like prompt submission and tool use.
  2. Agent Harness Security analyzes the content, evaluates your project’s policy, and decides the outcome: NONE, DETECT, REDACT, or BLOCK.
  3. The decision is returned in the format the agent understands — the agent blocks the action, substitutes redacted content, or proceeds.
  4. Every interaction is recorded and visible in the console, including observe-only gate points — so you always have visibility, even where enforcement isn’t possible.
Not every gate point can enforce every action. Where a gate cannot apply redaction, a redact decision is escalated to block rather than letting sensitive content through. Where a gate fires after the action already happened (for example, after a shell command completed), findings are recorded for visibility without interrupting the agent. Each recorded evaluation includes a protection mode so audit data always shows whether the policy was applied exactly as configured (AS_CONFIGURED), strengthened (INTEGRATION_LIMITED_PROMOTE), or observed only (INTEGRATION_LIMITED_OBSERVE).

​
Enforcement by AI Agent

The following tables provide details about what you can enforce, by AI agent.

​
Claude Code

Endpoints (all POST, base path /detection/v2/claude-code/): user-prompt-submit, pre-tool-use, post-tool-use, post-tool-use-failure, stop, subagent-stop, pre-compact.

​
Cursor

Endpoints (all POST, base path /detection/v2/cursor/): before-submit-prompt, pre-tool-use, post-tool-use, post-tool-use-failure, before-read-file, before-tab-file-read, before-shell-execution, before-mcp-execution, after-file-edit, after-shell-execution, after-mcp-execution.

​
GitHub Copilot CLI

Endpoints (all POST, base path /detection/v2/github-copilot/): pre-tool-use, post-tool-use, post-tool-use-failure, user-prompt-submit.