Capability Matrix

Per-connector breakdown of block capability, native ask events, fail-closed support, subprocess policy, and HITL behaviour. The single source of truth for "can this connector do X?"

This page is the single source of truth for "can this connector do X?". Every row is hand-derived from the Go connector files in internal/gateway/connector/ and re-verified on every change. Use it to pick the connector that fits your safety posture, or to find the gaps you need to compensate for.

Connector capability is not platform certification

This matrix describes each connector's product-level hook or proxy contract. Native Windows currently certifies Codex and Claude Code as hook-backed connectors and Amp as a system-plugin connector; the Windows package does not provide a subprocess sandbox. See the native Windows connector matrix before applying these rows to Windows.

Connector	Family	Tool inspection	Subprocess policy	Block	Native ask	Fail-closed	HITL behavior
Claude Code claudecode	hooks	pre-execution + response-scan	none	✓	✓ PreToolUse	✓	Claude Code supports native PreToolUse ask prompts. CRITICAL findings still block; HIGH findings can pause for approval.
Codex codex	hooks	pre-execution + response-scan	none	✓	·	✓	Codex has no native ask surface here; confirm becomes an alert/systemMessage with raw_action preserved. The TUI can review the event but cannot resume it.
OpenClaw openclaw	proxy	pre-execution + response-scan	sandbox	✓	✓ before_tool_call	✓	OpenClaw supports DefenseClaw approval prompts for tool actions. Approvals reach chat-origin sessions via the bundled plugin.
Cursor cursor	hooks	pre-execution + response-scan	none	✓	✓ beforeShellExecution, beforeMCPExecution	✓	Cursor supports native ask only on documented ask-capable hook events (beforeShellExecution, beforeMCPExecution).
Hermes hermes	hooks	pre-execution + response-scan	none	✓	·	·	Can block supported hook events but has no native human-approval surface; confirm verdicts fall back explicitly.
OpenCode opencode	hooks	pre-execution + response-scan	none	✓	·	✓	No native human-approval surface; blocks by throwing in the bridge plugin's tool.execute.before. confirm verdicts fall back to allow.
Amp amp	hooks	pre-execution + response-scan	none	✓	✓ tool.call, tool.result	✓	Amp can ask in the active foreground thread during tool.call and before a tool.result reaches the model. Denial, a background thread, or unavailable plugin UI rejects the call or withholds the result rather than silently allowing it.
OmniGent omnigent	hooks	pre-execution + response-scan	none	✓	✓ UserPromptSubmit, PreToolUse, BeforeModel	✓	OmniGent parks request, tool_call, and llm_request policy phases for native ASK approval; post-action confirm verdicts use the configured fallback.
Gemini CLI geminicli	hooks	pre-execution + response-scan	none	✓	·	✓	Can block supported hook events but has no native human-approval surface; confirm verdicts fall back explicitly.
GitHub Copilot CLI copilot	hooks	pre-execution + response-scan	none	✓	✓ preToolUse	·	Copilot CLI supports native ask on documented preToolUse hooks.
OpenHands openhands	hooks	pre-execution + response-scan	none	✓	·	✓	OpenHands has no native ask surface in the documented hook contract; confirm verdicts are downgraded with raw_action preserved and optional additionalContext returned to the agent.
Antigravity antigravity	hooks	pre-execution + response-scan	none	✓	✓ PreToolUse	·	Antigravity has an empirically verified native ask on PreToolUse. Returning decision=ask there overrides agy's --dangerously-skip-permissions flag; force_ask is retained only as internal raw_action telemetry.
Windsurf windsurf	hooks	pre-execution + response-scan	none	✓	·	·	Can block supported hook events but has no native human-approval surface; confirm verdicts fall back explicitly.
ZeptoClaw zeptoclaw	proxy	pre-execution + response-scan	sandbox	✓	·	✓	ZeptoClaw has no native ask surface; confirm uses its explicit fallback with raw_action preserved for TUI/audit review. There is no resumable approval.

Reading the matrix

Family

proxy = DefenseClaw sits in the LLM data path. hooks = DefenseClaw hooks into the agent's lifecycle; the agent talks directly to its upstream.

Tool inspection

When DefenseClaw can see the tool call. pre-execution + response-scan means we score before the call fires and after it returns.

Subprocess policy

sandbox = connector setup calls DefenseClaw's OpenShell/shim enforcement wiring. none = the agent's own runtime executes commands; DefenseClaw observes or blocks only through the connector's hook/proxy surface.

Block

Whether the hooks the connector exposes can return a block decision at all.

Native ask

Whether the connector's hooks can prompt the operator inside the agent UI for approval. Without native ask, confirm uses a connector-specific alert/allow/context fallback; the TUI can review the event but cannot resume it.

Fail-closed

Whether the hook surface supports a fail-closed response — i.e. block on transport failure to the gateway. Connectors marked false require operator-managed timeouts.

HITL behaviour

One-line summary of how human-in-the-loop approvals reach the operator for this connector.

Where the data comes from

Field	Source
Family	`internal/gateway/connector/*.go` (whether the connector implements `RoutingConnector` for proxy mode)
Tool inspection	`_CONNECTOR_META[<id>].tool_mode` in `cli/defenseclaw/commands/cmd_setup.py`
Subprocess policy	Effective setup call sites for `SetupSubprocessEnforcement` in `internal/gateway/connector/*.go`, cross-checked with `_CONNECTOR_META[<id>].subprocess_policy`
Block / Native ask / Fail-closed	`HookCapability{}` literals in `internal/gateway/connector/hook_only.go` and the per-connector files
Hook contract versions	`cli/defenseclaw/inventory/hook_contracts.json`, checked against `internal/gateway/connector/hook_contract.go`
HITL behaviour	`_hilt_support_note(<id>)` in `cli/defenseclaw/commands/cmd_setup.py`

The component renders from data/capability-matrix.json, which is the single editable copy and is refreshed against the Go source on every connector change.

Advertised contract vs empirical verification

The Antigravity v2 contract advertises native ask on PreInvocation and PreToolUse, and block on PreInvocation, PreToolUse, and Stop. DefenseClaw has empirically verified only the PreToolUse ask/block branch against agy v1.0.1. The additional registered branches remain gated on upstream implementation parity; an advertised branch is not the same as an end-to-end verification claim.

Common patterns

"I want maximum safety on a single connector"

Pick a row with proxy family, block: yes, native ask: yes, fail-closed: yes. That's OpenClaw today.

"I want enforcement on Claude Code without the proxy"

Direct-to-upstream hook enforcement is supported on Claude Code, Codex, Cursor, Gemini CLI, Hermes, Windsurf, Copilot CLI, OpenHands, Antigravity, OpenCode, and OmniGent. Amp uses a direct-to-upstream system policy plugin instead. The constraint is the same: these connectors cannot block a request the agent has not yet presented to their hook or policy surface.

"I want HITL approvals to surface inside the agent UI"

Pick a row with native ask: yes: OpenClaw, Claude Code (PreToolUse), Cursor (beforeShellExecution / beforeMCPExecution), GitHub Copilot CLI (preToolUse), Antigravity (PreInvocation advertised by the v2 contract and PreToolUse empirically verified), Amp (tool.call and model-bound tool.result in the active foreground thread), or OmniGent (request, tool_call, llm_request). Confirm verdicts on every other connector/event take an immediate connector-specific fallback; there is no TUI approval queue.

"I want fail-closed on transport failures"

Pick a row with fail-closed: yes: OpenClaw, ZeptoClaw, Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Amp, OpenHands, and OmniGent. GitHub Copilot CLI, Hermes, Windsurf, and Antigravity do not expose a DefenseClaw-controlled fail-closed transport response.