> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hiddenlayer.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

HiddenLayer Agent Harness Security can gate AI coding agents at every risky step of a session — when a prompt is submitted, before a tool or shell command runs, when tool output comes back, and when files are read or edited. Your existing security policies decide what happens at each step: block the action, redact sensitive content, or detect and record it for investigation.

The same policy that protects your other AI traffic governs your coding agents — select the project (and therefore the policy) with the `HL-Project-Id` header, exactly as with the other evaluation APIs.

## Supported Coding Agents

| Agent              | Integration       |
| ------------------ | ----------------- |
| Claude Code        | Claude Code hooks |
| Cursor             | Cursor hooks      |
| GitHub Copilot CLI | Copilot hooks     |

## How It Works

1. The coding agent's hook system calls Agent Harness Security at each gate point, like prompt submission and tool use.
2. Agent Harness Security analyzes the content, evaluates your project's policy, and decides the outcome: `NONE`, `DETECT`, `REDACT`, or `BLOCK`.
3. The decision is returned in the format the agent understands — the agent blocks the action, substitutes redacted content, or proceeds.
4. Every interaction is recorded and visible in the console, including observe-only gate points — so you always have visibility, even where enforcement isn't possible.

<Note>
  Not every gate point can enforce every action. Where a gate cannot apply redaction, a redact decision is escalated to block rather than letting sensitive content through. Where a gate fires after the action already happened (for example, after a shell command completed), findings are recorded for visibility without interrupting the agent. Each recorded evaluation includes a protection mode so audit data always shows whether the policy was applied exactly as configured (`AS_CONFIGURED`), strengthened (`INTEGRATION_LIMITED_PROMOTE`), or observed only (`INTEGRATION_LIMITED_OBSERVE`).
</Note>

## Enforcement by AI Agent

The following tables provide details about what you can enforce, by AI agent.

### Claude Code

**Endpoints** (all `POST`, base path `/detection/v2/claude-code/`): `user-prompt-submit`, `pre-tool-use`, `post-tool-use`, `post-tool-use-failure`, `stop`, `subagent-stop`, `pre-compact`.

| Gate point                             | When it fires                                       | Available protections                                                                       |
| -------------------------------------- | --------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| Prompt submission                      | Before a user prompt reaches the model.             | Block, Detect. <br /> Redact escalates to Block (prompts cannot be rewritten at this gate). |
| Tool calls                             | Before a tool runs.                                 | Block, Redact (the tool runs with sanitized input), Detect.                                 |
| Tool results                           | After a tool runs, before output reaches the model. | Block, Redact (the model sees sanitized output), Detect.                                    |
| Failed tool calls                      | After a tool invocation fails.                      | Visibility only.                                                                            |
| Turn completion (stop / subagent stop) | When the agent or a subagent finishes its turn.     | Visibility only.                                                                            |
| Context compaction                     | Before conversation history is compacted.           | Visibility only.                                                                            |

### Cursor

**Endpoints** (all POST, base path /detection/v2/cursor/): before-submit-prompt, pre-tool-use, post-tool-use, post-tool-use-failure, before-read-file, before-tab-file-read, before-shell-execution, before-mcp-execution, after-file-edit, after-shell-execution, after-mcp-execution.

| Gate point                                        | When it fires                  | Available protections                                                                            |
| ------------------------------------------------- | ------------------------------ | ------------------------------------------------------------------------------------------------ |
| Prompt submission                                 | Before a prompt is submitted.  | Block, Detect. Redact escalates to Block.                                                        |
| Tool calls                                        | Before a tool runs.            | Block, Redact (sanitized input), Detect.                                                         |
| MCP tool results                                  | After an MCP tool runs.        | Block, Redact (sanitized output), Detect.                                                        |
| Non-MCP tool results                              | After other tools run.         | Visibility only.                                                                                 |
| File reads (including tab reads)                  | Before the agent reads a file. | Block, Detect. <br /> Redact escalates to Block (file content cannot be rewritten at this gate). |
| Shell execution                                   | Before a shell command runs.   | Block, Detect. <br /> Redact escalates to Block.                                                 |
| MCP execution                                     | Before an MCP tool runs.       | Block, Detect. <br /> Redact escalates to Block.                                                 |
| After file edit / shell execution / MCP execution | After the action completed.    | Visibility only.                                                                                 |
| Failed tool calls                                 | After a tool invocation fails. | Visibility only.                                                                                 |

### GitHub Copilot CLI

**Endpoints** (all POST, base path /detection/v2/github-copilot/): pre-tool-use, post-tool-use, post-tool-use-failure, user-prompt-submit.

| Gate point        | When it fires                    | Available protections                                           |
| ----------------- | -------------------------------- | --------------------------------------------------------------- |
| Tool calls        | Before a tool runs.              | Block, Redact (the tool runs with sanitized arguments), Detect. |
| Tool results      | After a tool runs.               | Block, Redact (sanitized output), Detect.                       |
| Prompt submission | When a user prompt is submitted. | Visibility only.                                                |
| Failed tool calls | After a tool invocation fails.   | Visibility only.                                                |