A coding agent has a shell, the filesystem, git, the network, and whatever credentials sit on the machine. kyvvu-claude brings Kyvvu policies to Claude Code. It is the first coding agent we cover; the others are being built now.

Where the check runs

Claude Code has permission settings: allow this tool, deny that one, ask before Bash. They work per tool and carry no state, so they can answer “may this agent run Bash?” and not “may this agent run Bash after it has just read .env?”

Claude Code also has a hook system, and that is where kyvvu-claude sits. Hooks are invoked by Claude Code, not chosen by the model. PreToolUse runs before a tool call executes and can deny it. An MCP tool, by contrast, runs when the model decides to call it, so nothing that lives in an MCP tool can enforce a rule. Hooks exist in the Claude Code CLI, the VS Code extension, the JetBrains plugin and claude-code-action in GitHub Actions, and those are what kyvvu-claude covers. Claude Desktop uses MCP rather than hooks and is not covered.

What it does

pip install kyvvu-claude
kyvvu-claude init

init connects to the API, registers your Claude Code instance as a Kyvvu agent, fetches the policies assigned to it, and installs the hooks. There are no code changes and no daemon: each hook invocation is a short-lived process, and session state — task ID, step history, policy cache — is kept in ~/.kyvvu-claude/.

The SessionStart hook fetches and caches the policies. The PreToolUse hook replays the session history into the engine, evaluates the intended tool call, and returns allow or deny. PostToolUse records the completed call, and SessionEnd flushes the trace. A denied call is refused, recorded as blocked, and posted as an incident. The session carries on, and the model may look for another route, as it does when a user denies permission.

The Claude Code Safety manifest

The recommended manifest is nine policies covering credential exfiltration, destructive commands, scope containment, runaway prevention and PII scanning.

When Claude Code reads a secret file — .env, .pem, .key — the step is classified as secret. From that point in the session, No exec after secret read blocks Bash and No network after secret read blocks reads outside the project. Reading the file is allowed. Running Bash is allowed. The rule is about the two in that order. The classification holds for the rest of the session; /clear starts a new one.

The manifests are not specific to Claude Code. A rule you write for a LangChain or LangGraph agent governs your coding agents too, and the other way round.

The other coding agents

Claude Code works today. Cursor, GitHub Copilot, OpenAI Codex and OpenCode are being built, in the order the beta teams need them (see below). The engine and the policies stay the same across agents. What has to be built per agent is the place where the intended action can be caught before it runs, and every harness puts that somewhere different. We simply have to ensure every coding agent harness transmits AAG shaped “next actions”.

Where this comes from

We wrote a small tool to see what our own developers’ Claude Code sessions were doing, because we were not comfortable not knowing, and it has been running internally for months. Enough security officers we spoke to have described the same gap since then that we want to find out whether it is useful outside our own team. The engine underneath already governs custom agents at financial services, insurance and healthcare organizations in the Netherlands. The integration with common coding agents is the new part.

Give it a try

Our first release is private: 40 teams, free for six months, one setup call to get a team running in watch-only mode. Details and the form are at Secure your coding agents. Everything starts on warn, so nothing blocks and nothing breaks. After two weeks you have a factual picture of what your coding agents did, and you decide which rules block.

kyvvu-claude currently needs Python 3.10+ on macOS or Linux, but we are actively developing. As is, it governs the actions that pass through Claude Code’s hooks; an agent running outside that harness is outside its reach, which is why process isolation stays underneath it.

Setup and configuration are in the docs. Bugs and questions go to github.com/Kyvvu/issues.