Support matrix
Which AI coding agents and DefenseClaw features work on Linux, macOS and Windows, in the open-source and enterprise editions, and what live tests verified for DefenseClaw 1.0.
This page answers three questions: does DefenseClaw protect my agent on my operating system, which features come with each edition, and how the enterprise edition attaches to each agent. Every Supported cell was verified by a live test in this release. Everything else is labeled.
- Supported
- Verified by live tests in this release
- Preview
- In the code, not verified live in this release
- Not supported
- The code refuses it on that OS or edition
- Not offered
- Not part of that edition
- Open source is the per-user install: one command, and each user runs their own DefenseClaw. Start with the Download page.
- Enterprise is the managed standalone profile an administrator deploys with a package or an MDM. Users can't turn it off. Start with Deploy to a fleet. The Secure Client profile is covered in Secure Client managed deployment.
Agents
Supported means a live test on that OS verified the agent's hooks and a block before the tool call ran. A cell says so when the agent's telemetry to Grafana and Galileo wasn't verified there. Switch to Enterprise for the managed edition. Select an agent for its setup page.
| Agent | Linuxx86_64, arm64 | macOSApple silicon | Windowsx64 | Min versionlowest tested |
|---|---|---|---|---|
| Claude CodeNative hooks | Supported | Supported | Supported | 2.1.154 |
| CodexNative hooks | Supported | Supported | Supported | 0.124.0 |
| GitHub Copilot CLINative hooks | Supported | Supported | Supported | 1.0.18 |
| CursorNative hooks | Supported | Supported | Supported | 2.4.0 |
| DevinNative hooks | Supported | Supported | Supported | 3000.4.25 |
| AntigravityNative hooks | Supported | Supported | Supported | 1.1.8 |
| KiroNative hooks | Supported | Supported | Supported | Not gated |
| OpenCodePlugin | Supported | Supported | Supported | 1.18.10 |
| AmpPolicy plugin | Supported | Supported | Supported | 0.0.1785334225 |
| HermesNative hooks | Supported | Supported | Supported | 0.19.0 |
| OpenHandsNative hooks | Supported | Supported | Not supported | 1.12.0 |
| OmniGentPolicy API | Supported | Supported | PreviewTelemetry: preview | 0.7.0 |
- Linux
- Supported
- macOS
- Supported
- Windows
- Supported
- Linux
- Supported
- macOS
- Supported
- Windows
- Supported
- Linux
- Supported
- macOS
- Supported
- Windows
- Supported
- Linux
- Supported
- macOS
- Supported
- Windows
- Supported
- Linux
- Supported
- macOS
- Supported
- Windows
- Supported
- Linux
- Supported
- macOS
- Supported
- Windows
- Supported
- Linux
- Supported
- macOS
- Supported
- Windows
- Supported
- Linux
- Supported
- macOS
- Supported
- Windows
- Supported
- Linux
- Supported
- macOS
- Supported
- Windows
- Supported
- Linux
- Supported
- macOS
- Supported
- Windows
- Supported
- Linux
- Supported
- macOS
- Supported
- Windows
- Not supported
- Linux
- Supported
- macOS
- Supported
- Windows
- PreviewTelemetry: preview
Version and platform notes
- Claude Code
- Windows: Native executable hooks. WSL is outside the native contract.
- Codex
- Windows: System PowerShell bridge to the packaged hook executable.
- GitHub Copilot CLI
- Windows: Uses Copilot CLI's PowerShell hook field.
- Cursor
- Cursor Agent 2.4.0 up to 4.0.0, and Agent build 2026.07.23-e383d2b. Windows: Managed PowerShell adapter.
- Devin
- Reviewed Devin CLI 3000.4.25 on every OS and 3000.11.3 on Linux; newer builds run as untested newer versions. Windows: Devin's own hook runner starts the protected hook executable directly; no PowerShell bridge.
- Antigravity
- Windows: Packaged PowerShell hook launcher.
- Kiro
- Per-user installs are not version-gated. The enterprise standalone profile requires kiro-cli 2.24.1 or Kiro IDE 1.0.182.
- OpenCode
- Contract covers 1.18.10 up to 1.19.0; newer versions run as untested newer versions.
- Amp
- Windows: Owner-only TypeScript plugin in the user plugin directory.
- Hermes
- Contract covers 0.19.0 up to 0.22.0. Windows: Hermes' own terminal tool needs its bundled Git Bash.
- OpenHands
- Windows: OpenHands CLI needs WSL, and DefenseClaw has no WSL connector path.
- OmniGent
- Contract covers 0.7.0 up to 0.14.0. Windows: Degraded mode: server and SDK policy path only, without terminal wrappers or sandbox parity.
| Agent | Linux.rpm | macOS.pkg | WindowsSetup.exe |
|---|---|---|---|
| Claude CodeNative hooks | SupportedMachine policy | SupportedMachine policy | SupportedMachine policy |
| CodexNative hooks | SupportedMachine policy | SupportedMachine policy | SupportedMachine policy |
| GitHub Copilot CLINative hooks | SupportedMachine policy | SupportedMachine policy | SupportedMachine policy |
| CursorNative hooks | SupportedMachine policy | PreviewMachine policy | SupportedMachine policy |
| DevinNative hooks | SupportedPer-user | SupportedPer-user | SupportedPer-user |
| AntigravityNative hooks | SupportedPer-user | SupportedPer-user | SupportedPer-user |
| KiroNative hooks | PreviewPer-user | PreviewPer-user | SupportedPer-user |
| OpenCodePlugin | SupportedMachine policy | SupportedMachine policy | SupportedMachine policy |
| AmpPolicy plugin | SupportedPer-user | SupportedPer-user | SupportedPer-user |
| HermesNative hooks | SupportedPer-user | SupportedPer-user | SupportedPer-user |
| OpenHandsNative hooks | SupportedPer-user | SupportedPer-user | Not supported |
| OmniGentPolicy API | PreviewPer-user | PreviewPer-user | Not supported |
- Linux
- SupportedMachine policy
- macOS
- SupportedMachine policy
- Windows
- SupportedMachine policy
- Linux
- SupportedMachine policy
- macOS
- SupportedMachine policy
- Windows
- SupportedMachine policy
- Linux
- SupportedMachine policy
- macOS
- SupportedMachine policy
- Windows
- SupportedMachine policy
- Linux
- SupportedMachine policy
- macOS
- PreviewMachine policy
- Windows
- SupportedMachine policy
- Linux
- SupportedPer-user
- macOS
- SupportedPer-user
- Windows
- SupportedPer-user
- Linux
- SupportedPer-user
- macOS
- SupportedPer-user
- Windows
- SupportedPer-user
- Linux
- PreviewPer-user
- macOS
- PreviewPer-user
- Windows
- SupportedPer-user
- Linux
- SupportedMachine policy
- macOS
- SupportedMachine policy
- Windows
- SupportedMachine policy
- Linux
- SupportedPer-user
- macOS
- SupportedPer-user
- Windows
- SupportedPer-user
- Linux
- SupportedPer-user
- macOS
- SupportedPer-user
- Windows
- SupportedPer-user
- Linux
- SupportedPer-user
- macOS
- SupportedPer-user
- Windows
- Not supported
- Linux
- PreviewPer-user
- macOS
- PreviewPer-user
- Windows
- Not supported
Route notes
- Kiro
- Editors that start Kiro over ACP can also use the ACP guard.
- OpenCode
- Machine policy through the managed OpenCode plugin that the standalone package installs; per-user when that plugin is missing.
The connector contract behind each row (block events, native ask, fail closed, sandbox tier) is on the capability matrix. Exact version ranges are on Compatibility.
Features
| Feature | Open source | Enterprise | ||||
|---|---|---|---|---|---|---|
| Linux | macOS | Windows | Linux | macOS | Windows | |
| Protect | ||||||
| Guardrails: observe, action, block | Supported | Supported | Supported | Supported | Supported | Supported |
| Policy and rule packs | Supported | Supported | Supported | Supported | Supported | Supported |
| CodeGuardEnterprise: part of the local policy engine in the standalone profile. | Supported | Supported | Supported | Preview | Preview | Preview |
| Skill scanner | Supported | Supported | Preview | Supported | Supported | Preview |
| MCP scanner | Supported | Preview | Supported | Supported | Supported | Preview |
| LLM judge | Supported | Supported | Preview | Preview | Preview | Preview |
| Redaction profiles | Supported | Supported | Preview | Not offered | Not offered | Not offered |
| OpenShell sandboxesLinux and macOS only. Managed installs don’t start the sandbox runtime yet. | Preview | Preview | No: Not supported | No: Not supported | No: Not supported | No: Not supported |
| ACP guard (Kiro, Zed) | Preview | Supported | Preview | Preview | Preview | Preview |
| Discover | ||||||
| AI discovery | Supported | Supported | Supported | Supported | Supported | Preview |
| Runtime discovery | Supported | Supported | Supported | Supported | Supported | Preview |
| Tool inventory | Supported | Supported | Supported | Not offered | Not offered | Not offered |
| Plugin inventory and scan | Preview | Supported | Supported | Not offered | Not offered | Not offered |
| Registries | Preview | Supported | Supported | Not offered | Not offered | Not offered |
| AIBOM | Supported | Preview | Preview | Not offered | Not offered | Not offered |
| Observe | ||||||
| OpenTelemetry export (Grafana) | Supported | Supported | Supported | Supported | Supported | Supported |
| Galileo | Supported | Supported | Supported | Supported | Supported | Supported |
| SplunkNeeds a Splunk Observability Cloud organization, and Terraform for the dashboards. | Preview | Preview | Preview | Preview | Preview | Preview |
| Local observability stackNeeds Docker. | Supported | Supported | Preview | Not offered | Not offered | Not offered |
| Alerts | Supported | Supported | Supported | Not offered | Not offered | Not offered |
| Webhooks | Supported | Supported | Supported | Preview | Preview | Preview |
| Audit log and export | Supported | Supported | Preview | Preview | Preview | Preview |
| Operate | ||||||
| InstallOpen source: the one-line installer. Enterprise: the .rpm, .pkg or Setup.exe package. | Supported | Supported | Supported | Supported | Supported | Supported |
| Upgrade | Supported | Supported | Supported | Supported | Supported | Supported |
| Uninstall | Supported | Supported | Supported | Supported | Supported | Supported |
| Health check and repairOpen source: doctor. Enterprise: verify and repair. | Supported | Supported | Supported | Supported | Supported | Supported |
| Keys and secretsEnterprise: the Cisco AI Defense key is a protected credential only the gateway service can read. | Supported | Supported | Supported | Preview | Preview | Preview |
| Terminal UI | Supported | Supported | Supported | Not offered | Not offered | Not offered |
| macOS menu-bar app | Not offered | Preview | Not offered | Not offered | Not offered | Not offered |
| Enterprise controls | ||||||
| Machine policy for agent hooks | Not offered | Not offered | Not offered | Supported | Supported | Supported |
| Tamper resistanceStandard users can’t turn DefenseClaw or its hooks off. | Not offered | Not offered | Not offered | Supported | Supported | Supported |
| Multi-user enroll and revoke | Not offered | Not offered | Not offered | Supported | Supported | Supported |
| Foreign-hook guard | Not offered | Not offered | Not offered | Supported | Supported | Preview |
| MDM deploymentIntune, Jamf, Iru (formerly Kandji), Workspace ONE, ConfigMgr and Linux configuration management. Verified by simulating the MDM run context; the recipes have not been run in a live MDM tenant. | Not offered | Not offered | Not offered | Supported | Supported | Supported |
Protect
- Guardrails: observe, action, block
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxSupportedmacOSSupportedWindowsSupported
- Policy and rule packs
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxSupportedmacOSSupportedWindowsSupported
- CodeGuardEnterprise: part of the local policy engine in the standalone profile.
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxPreviewmacOSPreviewWindowsPreview
- Skill scanner
- Open source
- LinuxSupportedmacOSSupportedWindowsPreview
- Enterprise
- LinuxSupportedmacOSSupportedWindowsPreview
- MCP scanner
- Open source
- LinuxSupportedmacOSPreviewWindowsSupported
- Enterprise
- LinuxSupportedmacOSSupportedWindowsPreview
- LLM judge
- Open source
- LinuxSupportedmacOSSupportedWindowsPreview
- Enterprise
- LinuxPreviewmacOSPreviewWindowsPreview
- Redaction profiles
- Open source
- LinuxSupportedmacOSSupportedWindowsPreview
- Enterprise
- LinuxNot offeredmacOSNot offeredWindowsNot offered
- OpenShell sandboxesLinux and macOS only. Managed installs don’t start the sandbox runtime yet.
- Open source
- LinuxPreviewmacOSPreviewWindowsNo: Not supported
- Enterprise
- LinuxNo: Not supportedmacOSNo: Not supportedWindowsNo: Not supported
- ACP guard (Kiro, Zed)
- Open source
- LinuxPreviewmacOSSupportedWindowsPreview
- Enterprise
- LinuxPreviewmacOSPreviewWindowsPreview
Discover
- AI discovery
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxSupportedmacOSSupportedWindowsPreview
- Runtime discovery
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxSupportedmacOSSupportedWindowsPreview
- Tool inventory
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxNot offeredmacOSNot offeredWindowsNot offered
- Plugin inventory and scan
- Open source
- LinuxPreviewmacOSSupportedWindowsSupported
- Enterprise
- LinuxNot offeredmacOSNot offeredWindowsNot offered
- Registries
- Open source
- LinuxPreviewmacOSSupportedWindowsSupported
- Enterprise
- LinuxNot offeredmacOSNot offeredWindowsNot offered
- AIBOM
- Open source
- LinuxSupportedmacOSPreviewWindowsPreview
- Enterprise
- LinuxNot offeredmacOSNot offeredWindowsNot offered
Observe
- OpenTelemetry export (Grafana)
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxSupportedmacOSSupportedWindowsSupported
- Galileo
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxSupportedmacOSSupportedWindowsSupported
- SplunkNeeds a Splunk Observability Cloud organization, and Terraform for the dashboards.
- Open source
- LinuxPreviewmacOSPreviewWindowsPreview
- Enterprise
- LinuxPreviewmacOSPreviewWindowsPreview
- Local observability stackNeeds Docker.
- Open source
- LinuxSupportedmacOSSupportedWindowsPreview
- Enterprise
- LinuxNot offeredmacOSNot offeredWindowsNot offered
- Alerts
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxNot offeredmacOSNot offeredWindowsNot offered
- Webhooks
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxPreviewmacOSPreviewWindowsPreview
- Audit log and export
- Open source
- LinuxSupportedmacOSSupportedWindowsPreview
- Enterprise
- LinuxPreviewmacOSPreviewWindowsPreview
Operate
- InstallOpen source: the one-line installer. Enterprise: the .rpm, .pkg or Setup.exe package.
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxSupportedmacOSSupportedWindowsSupported
- Upgrade
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxSupportedmacOSSupportedWindowsSupported
- Uninstall
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxSupportedmacOSSupportedWindowsSupported
- Health check and repairOpen source: doctor. Enterprise: verify and repair.
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxSupportedmacOSSupportedWindowsSupported
- Keys and secretsEnterprise: the Cisco AI Defense key is a protected credential only the gateway service can read.
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxPreviewmacOSPreviewWindowsPreview
- Terminal UI
- Open source
- LinuxSupportedmacOSSupportedWindowsSupported
- Enterprise
- LinuxNot offeredmacOSNot offeredWindowsNot offered
- macOS menu-bar app
- Open source
- LinuxNot offeredmacOSPreviewWindowsNot offered
- Enterprise
- LinuxNot offeredmacOSNot offeredWindowsNot offered
Enterprise controls
- Machine policy for agent hooks
- Open source
- LinuxNot offeredmacOSNot offeredWindowsNot offered
- Enterprise
- LinuxSupportedmacOSSupportedWindowsSupported
- Tamper resistanceStandard users can’t turn DefenseClaw or its hooks off.
- Open source
- LinuxNot offeredmacOSNot offeredWindowsNot offered
- Enterprise
- LinuxSupportedmacOSSupportedWindowsSupported
- Multi-user enroll and revoke
- Open source
- LinuxNot offeredmacOSNot offeredWindowsNot offered
- Enterprise
- LinuxSupportedmacOSSupportedWindowsSupported
- Foreign-hook guard
- Open source
- LinuxNot offeredmacOSNot offeredWindowsNot offered
- Enterprise
- LinuxSupportedmacOSSupportedWindowsPreview
- MDM deploymentIntune, Jamf, Iru (formerly Kandji), Workspace ONE, ConfigMgr and Linux configuration management. Verified by simulating the MDM run context; the recipes have not been run in a live MDM tenant.
- Open source
- LinuxNot offeredmacOSNot offeredWindowsNot offered
- Enterprise
- LinuxSupportedmacOSSupportedWindowsSupported
Not offered in the enterprise columns means the feature is a per-user
command. The enterprise packages don't install the per-user defenseclaw
CLI, and a managed computer refuses per-user commands. The administrator
configures the managed gateway through its
config instead.
Enterprise
In the enterprise edition DefenseClaw attaches to each agent in one of two ways:
- Machine policy. DefenseClaw's hooks sit in the agent vendor's administrator-owned policy files, which apply to every user of the computer. See Machine policy.
- Per-user. The guardian writes DefenseClaw's hook or plugin into each enrolled user's own agent config and repairs it if it changes. See Enrollment.
| Agent | Linux.rpm | macOS.pkg | WindowsSetup.exe |
|---|---|---|---|
| Claude CodeNative hooks | SupportedMachine policy | SupportedMachine policy | SupportedMachine policy |
| CodexNative hooks | SupportedMachine policy | SupportedMachine policy | SupportedMachine policy |
| GitHub Copilot CLINative hooks | SupportedMachine policy | SupportedMachine policy | SupportedMachine policy |
| CursorNative hooks | SupportedMachine policy | PreviewMachine policy | SupportedMachine policy |
| DevinNative hooks | SupportedPer-user | SupportedPer-user | SupportedPer-user |
| AntigravityNative hooks | SupportedPer-user | SupportedPer-user | SupportedPer-user |
| KiroNative hooks | PreviewPer-user | PreviewPer-user | SupportedPer-user |
| OpenCodePlugin | SupportedMachine policy | SupportedMachine policy | SupportedMachine policy |
| AmpPolicy plugin | SupportedPer-user | SupportedPer-user | SupportedPer-user |
| HermesNative hooks | SupportedPer-user | SupportedPer-user | SupportedPer-user |
| OpenHandsNative hooks | SupportedPer-user | SupportedPer-user | Not supported |
| OmniGentPolicy API | PreviewPer-user | PreviewPer-user | Not supported |
- Linux
- SupportedMachine policy
- macOS
- SupportedMachine policy
- Windows
- SupportedMachine policy
- Linux
- SupportedMachine policy
- macOS
- SupportedMachine policy
- Windows
- SupportedMachine policy
- Linux
- SupportedMachine policy
- macOS
- SupportedMachine policy
- Windows
- SupportedMachine policy
- Linux
- SupportedMachine policy
- macOS
- PreviewMachine policy
- Windows
- SupportedMachine policy
- Linux
- SupportedPer-user
- macOS
- SupportedPer-user
- Windows
- SupportedPer-user
- Linux
- SupportedPer-user
- macOS
- SupportedPer-user
- Windows
- SupportedPer-user
- Linux
- PreviewPer-user
- macOS
- PreviewPer-user
- Windows
- SupportedPer-user
- Linux
- SupportedMachine policy
- macOS
- SupportedMachine policy
- Windows
- SupportedMachine policy
- Linux
- SupportedPer-user
- macOS
- SupportedPer-user
- Windows
- SupportedPer-user
- Linux
- SupportedPer-user
- macOS
- SupportedPer-user
- Windows
- SupportedPer-user
- Linux
- SupportedPer-user
- macOS
- SupportedPer-user
- Windows
- Not supported
- Linux
- PreviewPer-user
- macOS
- PreviewPer-user
- Windows
- Not supported
Route notes
- Kiro
- Editors that start Kiro over ACP can also use the ACP guard.
- OpenCode
- Machine policy through the managed OpenCode plugin that the standalone package installs; per-user when that plugin is missing.
Platforms
| OS | Architectures | Open source verified on | Enterprise verified on |
|---|---|---|---|
| Linux | x86_64, arm64 | RHEL | RHEL (.rpm). The .deb is built but not certified in this release |
| macOS | Apple silicon | macOS on Apple silicon | macOS on Apple silicon (.pkg) |
| Windows | x64 | Windows x64 | Windows x64 (Setup.exe) |
Intel Macs aren't supported, and Windows is x64 only. The full requirements are on Install and, for the enterprise packages, under Requirements on the Windows, Linux and macOS pages.
Agents that connect through the guardrail proxy aren't part of this matrix. Their pages are listed under Connectors.
ZeptoClaw
ZeptoClaw routes through DefenseClaw via api_base redirect plus response-scan. Full guardrail pipeline runs on every request.
Set up the guardrail
The central command. Configures how DefenseClaw guards your agent (connector, observe or action mode, scanner, judge, human approval and rule pack), then restarts the gateway.