Bash control
Shell command policy
Allowlist or deny the commands coding agents may run in the terminal—package scripts yes, destructive or exfil patterns no.
Allow npm test, pnpm lint, scoped git helpers
Deny curl | sh, rm -rf, secrets dumpers
Home
Relay
Claude, Cursor, Codex & OpenCode governance
Coding agent governance
RelayHooks that govern Cursor and Claude Code
Cursor and Claude can shell out, touch secrets, call MCP tools, and reshape prompts from any laptop. Relay sits on that path—org mode and policy packs return allow, ask, or deny before the damage is done.
Relay · decision wire
Every agent action, cleared before it runs
Claude Code, Cursor, Codex, and OpenCode ask Relay before risky actions. Org mode and policy packs return allow, ask, or deny in milliseconds — then the audit trail records the verdict.
Ungoverned IDE agents are an active security risk
Agents ship faster than your controls. Without a shared enforcement layer, every engineer’s agent is an unsupervised toolchain—and security only finds out after credentials leak, a risky MCP call fires, or bad code lands on main.
- Blind: no inventory of bash, path, MCP, or prompt actions agents attempt
- Toothless: policy stuck in chat tips and wikis never intercepts execution
- Unaccountable: incidents with no replay of who ran what under which control
Three jobs Relay owns for IDE agents
Discover the surface, enforce policy and behavior guards from live signals, and keep a replay you can trust
See
Surface, sessions, and signals
Inventory governed tools and active sessions across Cursor and Claude. Watch live signals—session patterns, tool bursts, and risk cues—before you need a forensic hunt.
Control
Channels plus behavior guards
Bash, path, MCP, and prompt channels evaluate every action before it runs. Behavior guards react to those signals and tighten policy when the agent drifts—not after the fact.
Prove
Replay for audits and retros
Tamper-evident events capture who ran which bash, path, MCP, or prompt action—under which policy, which signal triggered a guard, and what the outcome was.
Bash, path, MCP, and prompt controls
Four channels—each with allow and deny examples you can ship as org policy
Path control
Filesystem boundaries
Constrain which paths agents can read or write. Keep work inside the repo; keep secrets and infra out of reach.
Allow src/**, tests/**, draft PR files
Deny .env*, ~/.ssh, production kube configs
MCP control
MCP tool allowlists
Decide which MCP tools and actions agents may call. Draft a PR—yes. Hit prod APIs or secret stores—not without an approval path.
Allow github.read, pr.draft, catalog lookup
Deny secrets.read, kube.apply, unrestricted HTTP
Prompt control
Prompt & context rules
Shape what enters model context and what agents are instructed to do—redact secrets, block risky system prompts, keep org rules sticky.
Allow Repo conventions, approved skill prompts
Deny API keys in context, jailbreak-style overrides
Session policy · live evaluate
ControlRequestResultReason
Bashnpm testallowallowlisted · package scripts
Pathwrite .env.localdenysecrets path blocked
MCPgithub.create_prallowrepo scope · draft only
Promptinclude API keysdenyprompt redaction rule
Every action gets a decision
Allow with execution, or deny with a clear reason—then log either way
- 1
Agent proposes
Cursor or Claude selects bash, a path write, an MCP tool, or a prompt expansion.
- 2
Relay evaluates
The matching control channel runs before any side effect.
- 3
Allow or deny
Approved calls proceed; denied calls return a structured reason.
- 4
Record
Outcome lands in the audit log for replay and compliance.
What you configure in Relay
Concrete controls for Cursor and Claude coding agents
Four control channels
Bash, path, MCP, and prompt rules share one Relay policy surface—so Cursor and Claude sessions stay consistent across the team.
Example: Permit npm test and github.create_pr; deny writes to .env and any prompt that asks to paste secrets.
Behavior guards from signals
Agent behavior guards that react to live signals—session patterns, tool bursts, and risk cues—so policy tightens when the agent drifts, not after the fact.
Example: Spike in denied MCP calls or a burst of shell attempts triggers a stricter guard pack for that session until the signal cools.
Active policy rules
Rules evaluate on every agent action before tools execute—command patterns, path globs, MCP scopes, and prompt redaction.
Example: Block writes to main, strip tokens from model context, and require a second engineer for infra-touching MCP tools.
IDE-native hooks
Built for Cursor and Claude coding agents. Relay does not ask teams to abandon their IDE—it governs the path from agent intent to execution.
Example: Same agent, same editor—different outcome when a disallowed bash or MCP call is requested: structured deny, not a silent failure.
Audit replay
Tamper-evident events capture who ran which bash, path, MCP, or prompt action—under which policy, with what outcome.
Example: Replay a denied shell or MCP call for an incident review—control channel, rule, and result in one record.
Who Relay is for
Platform & security
One place to set bash, path, MCP, and prompt policy for IDE agents—without reviewing every engineer’s local config.
Engineering leads
Keep Cursor and Claude in the workflow while knowing what agents can shell, touch, and call in shared repos.
Compliance & audit
Evidence of agent actions by control channel: who, which rule, what result—exportable when exams ask.
Relay with Marshal
Marshal runs production AI operations—gateway, prompts, skills, and Memory. Relay governs coding agents in the IDE. Buy either alone or Full Platform for both.
Put Relay on your IDE agents
Cursor and Claude can shell out, touch secrets, call MCP tools, and reshape prompts from any laptop. Relay sits on that path—org mode and policy packs return allow, ask, or deny before the damage is done.
- Bash, path, MCP, and prompt controls
- Behavior guards driven by live signals
- Audit replay for every governed action