Runtime Shield
Runtime Shield evaluates supported AI agent actions as they pass through each agent's hook surface. For pre-execution hooks it can Monitor, Warn, or Block before the action runs. For after-only or...
Runtime Shield evaluates supported AI agent actions as they pass through each agent's hook surface. For pre-execution hooks it can Monitor, Warn, or Block before the action runs. For after-only or event-dependent surfaces it records and audits what the agent emits. The same policy model follows developers across Claude Code, Cursor, Codex, Gemini CLI, Google Antigravity, Windsurf, GitHub Copilot, and Cowork.
See Policy outcomes for Monitor, Warn, Block, Policy Profiles, Controls, Detectors, Signals, and surface capability labels. See Detections for the full supported detector catalog, coverage states, and signal detail.
See Policy-gated exceptions for the governed workflow that lets admins decide which blocked actions can be reviewed, how developers submit without dashboard access, and how approved scoped leases downgrade eligible retries to warnings.
How It Works
- The agent emits a supported hook event: terminal command, file read/write, web request, MCP call, or prompt submit.
- The local hook sends a compact event to AgentKeeper.
- AgentKeeper checks Base Policy, any matched Policy Profiles, product safety defaults, and Runtime Shield detection rules.
- The hook receives a Monitor, Warn, or Block decision where that hook supports intervention.
- The action and decision are written to the audit trail.
Detection Coverage
| Area | Examples |
|---|---|
| Credential exfiltration | Secret reads followed by network calls, .env uploads, SSH key exposure |
| Dangerous shell activity | Reverse shells, destructive deletes, firewall teardown, history tampering |
| File-system risk | Writes to system paths, startup scripts, CI workflows, git hooks |
| Web and MCP calls | Raw-IP calls, exfiltration endpoints, restricted MCP servers |
| Prompt injection | Instruction overrides, persona hijacks, encoded payloads, data extraction attempts |
Policy Controls
- Block or Warn on specific tools.
- Block command substrings and write-path patterns.
- Flag sensitive reads without breaking normal development.
- Restrict WebFetch and allowed domains.
- Allowlist or deny MCP servers and tools.
- Apply stronger controls to identity-provider groups.
- Mark narrow rules as eligible for exception review when security policy allows it.
Fail-Open Behavior
AgentKeeper is designed to avoid breaking a developer workstation during an outage. If a hook cannot reach the evaluation endpoint, it fails open and records the condition locally where the hook supports local logging.
Setup
Use the dashboard setup flow:
/plugin marketplace add rad-security/claude-code-plugin
/plugin install agentkeeper
/reload-plugins
/agentkeeper:connect
Restart Claude Code after device approval so the connected hooks load at startup. For Cursor, Codex, Gemini CLI, Google Antigravity, Windsurf, and Copilot, use the public installer with the right IDE flag:
export AGENTKEEPER_API_URL="https://www.agentkeeper.dev"
export AGENTKEEPER_API_KEY="ak_live_..."
bash <(curl -fsSL "$AGENTKEEPER_API_URL/install-hooks.sh") --ide codex
Replace codex with cursor, gemini, antigravity, windsurf, or copilot, or follow the agent-specific setup guide for the exact verification steps.