Capability Matrix
Per-connector breakdown of block capability, native ask events, fail-closed support, subprocess policy, and HITL behaviour. The single source of truth for "can this connector do X?"
This page is the single source of truth for "can this connector do X?". Every row is hand-derived from the Go connector files in internal/gateway/connector/ and re-verified on every change. Use it to pick the connector that fits your safety posture, or to find the gaps you need to compensate for.
Connector capability is not platform certification
This matrix describes each connector's product-level hook or proxy contract. Platform availability, setup, and operating-system-specific limits live in the connector platform table and on each connector page. A supported native Windows path does not fabricate official-client validation evidence, and the Windows package does not provide the proxy or subprocess-sandbox topology used by some connectors elsewhere.
| Connector | Family | Tool inspection | Subprocess policy | Block | Native ask | Fail-closed | HITL behavior |
|---|---|---|---|---|---|---|---|
| Claude Code claudecode | hooks | pre-execution + response-scan | none | ✓ | ✓ PreToolUse | ✓ | Claude Code supports native PreToolUse ask prompts. CRITICAL findings still block; HIGH findings can pause for approval. |
| Codex codex | hooks | pre-execution + response-scan | none | ✓ | · | ✓ | Codex has no native ask surface here; confirm becomes an alert/systemMessage with raw_action preserved. The TUI can review the event but cannot resume it. |
| OpenClaw openclaw | proxy | pre-execution + response-scan | sandbox | ✓ | ✓ before_tool_call | ✓ | OpenClaw supports DefenseClaw approval prompts for tool actions. Approvals reach chat-origin sessions via the bundled plugin. |
| Cursor cursor | hooks | pre-execution + response-scan | none | ✓ | · | ✓ | DefenseClaw does not enable Cursor native human approval. Confirm verdicts remain attributed alerts and cannot resume the original hook call. |
| Hermes hermes | hooks | pre-execution + response-scan | none | ✓ | · | · | Hermes has no native human-approval surface; confirm verdicts are recorded and alerted but cannot pause or resume the hook. |
| OpenCode opencode | hooks | pre-execution + response-scan | none | ✓ | · | ✓ | No native human-approval surface; blocks by throwing in the bridge plugin's tool.execute.before. confirm verdicts fall back to allow. |
| Amp amp | hooks | pre-execution + response-scan | none | ✓ | ✓ tool.call, tool.result | ✓ | Amp can ask in the active foreground thread during tool.call and before a tool.result reaches the model. Denial, a background thread, or unavailable plugin UI rejects the call or withholds the result rather than silently allowing it. |
| OmniGent omnigent | hooks | pre-execution + response-scan | none | ✓ | ✓ UserPromptSubmit, PreToolUse, BeforeModel | ✓ | OmniGent parks request, tool_call, and llm_request for native ASK approval. Post-phase confirm findings are audited and continue without a pause; DENY may suppress onward-visible content but cannot roll back completed work. |
| GitHub Copilot CLI copilot | hooks | pre-execution + response-scan | none | ✓ | ✓ preToolUse | · | Copilot CLI supports native ask on documented preToolUse hooks. |
| OpenHands openhands | hooks | pre-execution + response-scan | none | ✓ | · | ✓ | OpenHands has no native ask surface in the documented hook contract; confirm verdicts are downgraded with raw_action preserved and optional additionalContext returned to the agent. |
| Antigravity antigravity | hooks | pre-execution | none | ✓ | ✓ PreToolUse | · | Antigravity documents native ask on PreToolUse only. DefenseClaw does not claim that this response overrides permission-bypass flags without persisted official-client evidence; force_ask is retained only as internal raw_action telemetry. |
| Devin devin | hooks | pre-execution + response-scan | none | ✓ | · | ✓ | Can block documented events but has no native resumable human-approval surface; confirm verdicts fall back explicitly. |
| ZeptoClaw zeptoclaw | proxy | pre-execution + response-scan | sandbox | ✓ | · | ✓ | ZeptoClaw has no native ask surface; confirm uses its explicit fallback with raw_action preserved for TUI/audit review. There is no resumable approval. |
Reading the matrix
Family
proxy = DefenseClaw sits in the LLM data path. hooks = DefenseClaw hooks into the agent's lifecycle; the agent talks directly to its upstream.
Tool inspection
When DefenseClaw can see the tool call. pre-execution + response-scan means we score before the call fires and after it returns.
Subprocess policy
sandbox = connector setup calls DefenseClaw's OpenShell/shim enforcement wiring. none = the agent's own runtime executes commands; DefenseClaw observes or blocks only through the connector's hook/proxy surface.
Block
Whether the hooks the connector exposes can return a block decision at all.
Native ask
Whether the connector's hooks can prompt the operator inside the agent UI for approval. Without native ask, confirm uses a connector-specific alert/allow/context fallback; the TUI can review the event but cannot resume it.
Fail-closed
Whether the hook surface supports a fail-closed response — i.e. block on transport failure to the gateway. Connectors marked false require operator-managed timeouts.
HITL behaviour
One-line summary of how human-in-the-loop approvals reach the operator for this connector.
Where the data comes from
| Field | Source |
|---|---|
| Family | internal/gateway/connector/*.go (whether the connector implements RoutingConnector for proxy mode) |
| Tool inspection | _CONNECTOR_META[<id>].tool_mode in cli/defenseclaw/commands/cmd_setup.py |
| Subprocess policy | Effective setup call sites for SetupSubprocessEnforcement in internal/gateway/connector/*.go, cross-checked with _CONNECTOR_META[<id>].subprocess_policy |
| Block / Native ask / Fail-closed | HookCapability{} literals in internal/gateway/connector/hook_only.go and the per-connector files |
| Hook contract versions | cli/defenseclaw/inventory/hook_contracts.json, checked against internal/gateway/connector/hook_contract.go |
| HITL behaviour | _hilt_support_note(<id>) in cli/defenseclaw/commands/cmd_setup.py |
The component renders from data/capability-matrix.json, which is the single editable copy and is refreshed against the Go source on every connector change.
Advertised contract vs empirical verification
The Antigravity contract documents native ask and hard deny only on
PreToolUse. PreInvocation and PostInvocation are context-transform
surfaces, PostToolUse is observation-only, and DefenseClaw returns the
documented allow shape for Stop. No permission-bypass override is claimed
without persisted official-client evidence.
Common patterns
"I want maximum safety on a single connector"
Pick a row with proxy family, block: yes, native ask: yes, fail-closed: yes. That's OpenClaw today.
"I want enforcement on Claude Code without the proxy"
Direct-to-upstream hook enforcement is supported on Claude Code, Codex, Cursor, Hermes, Devin, Copilot CLI, OpenHands, Antigravity, OpenCode, and OmniGent. Amp uses a direct-to-upstream system policy plugin instead. Cursor action uses documented event-native deny from the user hook. Cursor exposes no safe API for detecting an actual higher-priority Enterprise, Team, or Project conflict, so DefenseClaw reports that limitation and does not infer a conflict. The broader constraint is that these connectors cannot block a request the agent has not yet presented to their hook or policy surface.
"I want HITL approvals to surface inside the agent UI"
Pick a row with native ask: yes: OpenClaw, Claude Code (PreToolUse), GitHub Copilot CLI (preToolUse),
Antigravity (PreToolUse only), Amp (tool.call and model-bound tool.result
in the active foreground thread), or OmniGent (request, tool_call, llm_request).
Cursor is not counted because DefenseClaw does not enable its native ask response;
confirm verdicts remain attributed alerts and cannot resume the original call.
Confirm verdicts on every other connector/event take an immediate
connector-specific fallback; there is no TUI approval queue.
"I want fail-closed on transport failures"
Pick a row with fail-closed: yes: OpenClaw, ZeptoClaw, Claude Code, Codex, Cursor, Devin, OpenCode, Amp, OpenHands, and OmniGent. GitHub Copilot CLI, Hermes, and Antigravity do not expose a generic DefenseClaw-controlled fail-closed transport response. Cursor's support is mode-matched: action writes failClosed: true, while observe writes failClosed: false. Devin can map DefenseClaw availability failures to vendor exit 2 only on its four declared block-capable events.