Bash control
Shell command policy
Allowlist or deny the commands coding agents may run in the terminal—package scripts yes, destructive or exfil patterns no.
Allow npm test, pnpm lint, scoped git helpers
Deny curl | sh, rm -rf, secrets dumpers
Home
Relay
Cursor & Claude coding-agent governance
Coding agent governance
RelaySee, control, and prove what Cursor and Claude do in your repos
Relay sits between IDE coding agents and the tools they want to call. Bash, path, MCP, and prompt controls evaluate before side effects—engineers keep velocity; the org keeps the audit trail.
Coding agents ship faster than your controls
Cursor and Claude can run shell, touch files, call MCP tools, and expand prompts from a laptop. Without a shared control layer, each engineer’s agent is a private toolchain—and security only finds out after something leaks or lands on main.
- No inventory of which bash, path, MCP, or prompt actions agents actually attempt
- Policy lives in chat tips and wiki pages, not in the execution path
- Incidents lack a replay of who ran what, under which control channel
Three jobs Relay owns for IDE agents
Discover the surface, enforce policy on the path, and keep a replay you can trust
See
Know the agent surface
Inventory governed tools and active sessions across Cursor and Claude. Know what agents are allowed to reach—before you need a forensic hunt.
Control
Bash · path · MCP · prompt
Four control channels evaluate every agent action before it runs. Denied calls return a clear reason; allowed calls keep the speed engineers expect.
Prove
Replay for audits and retros
Tamper-evident events capture who ran which bash, path, MCP, or prompt action—under which policy, with what outcome.
Where Relay sits
Between the IDE agent and execution—bash, path, MCP, and prompt evaluated before side effects
Bash, path, MCP, and prompt controls
Four channels—each with allow and deny examples you can ship as org policy
Path control
Filesystem boundaries
Constrain which paths agents can read or write. Keep work inside the repo; keep secrets and infra out of reach.
Allow src/**, tests/**, draft PR files
Deny .env*, ~/.ssh, production kube configs
MCP control
MCP tool allowlists
Decide which MCP tools and actions agents may call. Draft a PR—yes. Hit prod APIs or secret stores—not without an approval path.
Allow github.read, pr.draft, catalog lookup
Deny secrets.read, kube.apply, unrestricted HTTP
Prompt control
Prompt & context rules
Shape what enters model context and what agents are instructed to do—redact secrets, block risky system prompts, keep org rules sticky.
Allow Repo conventions, approved skill prompts
Deny API keys in context, jailbreak-style overrides
Session policy · live evaluate
ControlRequestResultReason
Bashnpm testallowallowlisted · package scripts
Pathwrite .env.localdenysecrets path blocked
MCPgithub.create_prallowrepo scope · draft only
Promptinclude API keysdenyprompt redaction rule
Every action gets a decision
Allow with execution, or deny with a clear reason—then log either way
- 1
Agent proposes
Cursor or Claude selects bash, a path write, an MCP tool, or a prompt expansion.
- 2
Relay evaluates
The matching control channel runs before any side effect.
- 3
Allow or deny
Approved calls proceed; denied calls return a structured reason.
- 4
Record
Outcome lands in the audit log for replay and compliance.
What you configure in Relay
Concrete controls for Cursor and Claude coding agents
Four control channels
Bash, path, MCP, and prompt rules share one Relay policy surface—so Cursor and Claude sessions stay consistent across the team.
Example: Permit npm test and github.create_pr; deny writes to .env and any prompt that asks to paste secrets.
Active policy rules
Rules evaluate on every agent action before tools execute—command patterns, path globs, MCP scopes, and prompt redaction.
Example: Block writes to main, strip tokens from model context, and require a second engineer for infra-touching MCP tools.
IDE-native hooks
Built for Cursor and Claude coding agents. Relay does not ask teams to abandon their IDE—it governs the path from agent intent to execution.
Example: Same agent, same editor—different outcome when a disallowed bash or MCP call is requested: structured deny, not a silent failure.
Relay seats & ownership
Seat the engineers who run governed agents. Access is explicit; sprawl of ungoverned laptops shrinks.
Example: Platform owns bash/path/MCP/prompt policy; feature teams get Relay seats without becoming security admins.
Who Relay is for
Platform & security
One place to set bash, path, MCP, and prompt policy for IDE agents—without reviewing every engineer’s local config.
Engineering leads
Keep Cursor and Claude in the workflow while knowing what agents can shell, touch, and call in shared repos.
Compliance & audit
Evidence of agent actions by control channel: who, which rule, what result—exportable when exams ask.
Relay with Harness
Harness runs production AI operations—gateway, prompts, skills, memory, and context. Relay governs coding agents in the IDE. Buy either alone or Full Platform for both.
Put Relay on your IDE agents
Relay sits between IDE coding agents and the tools they want to call. Bash, path, MCP, and prompt controls evaluate before side effects—engineers keep velocity; the org keeps the audit trail.
- Bash, path, MCP, and prompt controls
- Policy before every agent action
- Audit replay for seats and sessions