Works with your stack.

Claude 4, Claude 3.5, Claude 3. Full streaming, tool use governance, and DLP scanning.

GPT-4, GPT-4 Turbo, GPT-3.5, o1, o3. Full streaming and tool call support.

Gemini Pro, Gemini Ultra, Gemini Flash. Dedicated gateway with streaming, tool call governance, and DLP.

Local models with full policy enforcement. OpenAI-compatible wire format.

DeepSeek Chat, DeepSeek Coder. OpenAI-compatible routing with policy enforcement.

Moonshot v1 models. OpenAI-compatible routing with policy enforcement.

Text Generation Inference. Streaming support, no tool interception.

Bedrock-hosted models over the native wire format with SigV4 request signing. Enabled per deployment.

Vertex-hosted Gemini and partner models with policy enforcement and DLP. Enabled per deployment.

Azure-hosted OpenAI deployments, routed on their own prefix. Enabled per deployment.

Mistral models via OpenAI-compatible routing with policy enforcement.

Cohere models via OpenAI-compatible routing with policy enforcement.

PreToolUse and UserPromptSubmit hooks block every tool family: a deny rule stops the call before it runs. A DLP mask rewrites the tool arguments in place instead of denying. Install in one command. Audit log from day one.

BeforeTool and BeforeAgent hooks block every tool family before the call runs. One of only two hosts where a DLP mask rewrites the tool input and lets the call proceed redacted, rather than escalating to a deny.

A deny rule stops a shell call at the PreToolUse hook before it runs. Shell-only, and the cause is the host: Codex routes its shell tool to PreToolUse, and a deny on an apply_patch write or an MCP tool call is not imposed by Codex today. The other eight tool families are never delivered to Control Zero, so they are neither blocked nor recorded. No maturity tag: this adapter is revalidated against a named Codex build in our vendor canary.

One install covers two surfaces. Cursor IDE blocks every tool family across six deciding events, including beforeReadFile, subagentStart and beforeSubmitPrompt. Cursor CLI (cursor-agent) gates shell execution only: beforeShellExecution is the one gate that surface reliably enforces, and the host does not deliver the other eight families to Control Zero. On both, a DLP mask escalates to a deny and an approval ("ask") gate degrades to a hard deny, because Cursor does not enforce "ask" on the shell path. BETA is about our adapter, not that reach: it has not yet been revalidated against a current Cursor build.

One install covers two surfaces with different reach. Kiro CLI blocks every tool family at preToolUse on direct tool calls, and from Python SDK 1.13.12 a deny on the use_subagent spawn stops the sub-agent being created at all -- on any earlier SDK controlzero install kiro never wires that matcher, so such a rule silently never fires; check controlzero --version before relying on it. A sub-agent’s own tool calls are gated too, but only when that sub-agent runs an agent config carrying our hooks: hooks resolve from the sub-agent’s own config and are not inherited from the parent, so a sub-agent spawned with no explicit agent_name runs its own tool calls ungated once it starts, and pointing chat.defaultAgent at a hooked config does not change that. The spawn itself is still gated: the parent’s hook fires either way. Driven against kiro-cli 2.18.1. That remaining gap is the host’s (kiro #7755, open). use_subagent is the only spawn tool this build exposes. Kiro IDE governs no tool call today, and that is our choice, not a vendor gap: the installer does write the hook Kiro IDE’s current loader reads, but we ship it disabled pending a soak. Kiro IDE’s deterministic block also requires the v2 hook provider; on the default v1 provider a deny is mediated by the model rather than enforced.

PreToolUse hook records every tool family and raises a deny. Our posture is fail-closed: empty output is read as a deny. Separately, and this is the host, not us: Antigravity treats that deny as advisory in its headless and always-proceed modes, so the call may still run. Recorded is not stopped. BETA is ours too -- this adapter has not been revalidated against the shipping Antigravity build.

generic

Hello World policy with comments. Start here if you are not sure what you need.

claude-code

Installs as a Claude Code PreToolUse hook. Allow-by-default with opinionated deny rules.

langchain

LangChain / LangGraph agents. Gates Tool calls and denies destructive DB operations.

crewai

Multi-agent crews with delegation. Allows inter-agent comms, denies publishing / outbound messages.

cursor

Cursor editor MCP + built-in tools. Allows read-heavy tools, denies danger-tagged shell.

autogen

AutoGen with code_execution_config guardrails. Denies bare code execution, allows named tools.

mcp

Generic MCP server catalogue with the most common sanctioned tool patterns.

rag

Retrieval-augmented generation: vector lookups, document fetches, answer writes.

cost-cap

Token budget and cost ceilings per-tool and per-provider.