CiscoCiscoDefenseClaw
Connectors

Connectors

Nine first-class connectors — OpenClaw, ZeptoClaw, Claude Code, Codex, Cursor, Windsurf, Gemini CLI, GitHub Copilot CLI, Hermes — with a single enforcement contract.

Connectors are the adapter layer between agent frameworks and DefenseClaw's guardrail proxy. Each connector owns all security surfaces for its agent: LLM traffic routing, tool call inspection, agent hook events, component scanning, CodeGuard file scanning, and subprocess enforcement.

The two families

Proxy connectors

OpenClaw, ZeptoClaw. DefenseClaw sits in the LLM data path — every request and response is intercepted, scored, and forwarded.

Hook connectors

Claude Code, Codex, Cursor, Windsurf, Gemini CLI, GitHub Copilot CLI, Hermes. DefenseClaw wires into the agent's native lifecycle hooks; the agent talks directly to its upstream.

Pick yours

Capability summary

ConnectorFamilyTool inspectionSubprocess policyBlockNative askFail-closedHITL behavior
Claude Code
claudecode
hookspre-execution + response-scansandbox
PreToolUse
Claude Code supports native PreToolUse ask prompts. CRITICAL findings still block; HIGH findings can pause for approval.
Codex
codex
hookspre-execution + response-scansandbox·Codex has no native ask surface here; confirm verdicts are downgraded with raw_action preserved. HITL routes through TUI / OpenClaw plugin.
OpenClaw
openclaw
proxypre-execution + response-scansandbox
before_tool_call
OpenClaw supports DefenseClaw approval prompts for tool actions. Approvals reach chat-origin sessions via the bundled plugin.
Cursor
cursor
hookspre-execution + response-scannone
beforeShellExecution, beforeMCPExecution
Cursor supports native ask only on documented ask-capable hook events (beforeShellExecution, beforeMCPExecution).
Hermes
hermes
hookspre-execution + response-scannone··Can block supported hook events but has no native human-approval surface; confirm verdicts fall back explicitly.
Gemini CLI
geminicli
hookspre-execution + response-scannone·Can block supported hook events but has no native human-approval surface; confirm verdicts fall back explicitly.
GitHub Copilot CLI
copilot
hookspre-execution + response-scannone
preToolUse, PreToolUse
·Copilot CLI supports native ask on documented preToolUse hooks.
Windsurf
windsurf
hookspre-execution + response-scannone··Can block supported hook events but has no native human-approval surface; confirm verdicts fall back explicitly.
ZeptoClaw
zeptoclaw
proxypre-execution + response-scansandbox·ZeptoClaw has no native ask surface; confirm verdicts are downgraded with raw_action preserved so operators can review in TUI/audit.

For the full breakdown including HITL behaviour, head to the Capability Matrix.

How a connector is structured

Setup(ctx, opts)write hook scripts,back up agent files,register routes
Authenticate(r)verify gateway token
Route(r, body)extract upstream + model+ stream + headers
Teardown(ctx, opts)restore agent files
VerifyClean(opts)no residual artifacts
Every connector implements the same Go interface; the gateway routes traffic generically once a connector has resolved its signals.

The interface is defined in internal/gateway/connector/connector.go; each per-connector file (claudecode.go, codex.go, cursor.go via hook_only.go, ...) implements it.