How AgentKeeper works
The path an agent action takes from a developer's keyboard to a policy decision and an audit record.
An AI agent asks to run a tool. AgentKeeper answers allow, warn, or block before the tool runs, then stores what happened.
The path of one action
The agent emits a hook event
Claude Code, Cursor, Codex and the other supported agents call a local hook before executing a tool. The hook sends the tool name and its arguments to AgentKeeper.
AgentKeeper evaluates it
The evaluate endpoint resolves the workstation, loads the Base Policy plus any Policy Profile that matches the user, group, or repository, and runs the detectors.
The agent gets a verdict
allow runs the tool. warn runs it and records a warning. deny stops
the tool before it executes.
The event lands in Activity
Every verdict is stored with the matched policy, the detector reason, and the workstation that produced it.
Blocking depends on the agent exposing a pre-execution hook. Where it does not, AgentKeeper records the action after the fact. IDE coverage parity lists which agent supports which control.
What runs where
| Piece | Runs on | Job |
|---|---|---|
| Runtime hooks | The workstation, inside the agent | Intercept tool calls, ask for a verdict |
| MCP Gateway | The workstation, as a local proxy | Route and filter MCP tool calls |
| Browser extension | Chrome, Edge, Firefox | Inspect prompts in web AI surfaces |
| eBPF sensor | Linux hosts and containers | Discover AI workloads by process and network |
| AgentKeeper backend | www.agentkeeper.dev | Resolve policy, store evidence, serve the dashboard |
Each piece installs on its own. You do not need all of them.
What leaves the workstation
Tool name, arguments, file paths, command lines, hostname, agent version, and the matched policy. Prompt text leaves only when Prompt Vault is enabled. Raw IP addresses are discarded at ingest — only the country is kept, and that can be turned off.
See What AgentKeeper sees for the full list and Data handling for retention.