Sondera Coding Agent Hooks

Coding Agent Hooks by Sondera
Released as part of the *Hooking Coding Agents with the Cedar Policy Language*
talk at Unprompted 2026, and updated for
presentation at
Black Hat Arsenal 2026
and the
Vegas AI Security Forum '26.
See also our ICML 2026 *Agents in the Wild* workshop paper:
arXiv:2606.26649.

A reference monitor for AI coding agents. Rust hook binaries and
Cedar policies intercept every shell command,
file operation, and web request to forbid exfiltration and destructive
behaviors, and enforce information flow control. YARA signatures and Cedar
policy evaluation are deterministic. The optional LLM-based classifiers (data
sensitivity, secure code policy) are probabilistic and configurable in
.sondera/sondera.toml — see Configuration.

Works with Claude Code,
Cursor,
GitHub Copilot,
and Gemini CLI, plus adapters for
Antigravity, Codex, Hermes, OpenCode, OpenHands, and VS Code —
sondera hook --help lists the full set.

A hook adapter normalizes its agent's event and forwards it over gRPC to
sondera serve, which combines deterministic signature scanning with Cedar
policy evaluation and returns Allow, Deny, or Escalate. If the harness cannot be
reached, enforcement hooks fail closed.

Enforcement at a glance

What each adapter can do with a decision, by hook group — block (deny,
fail-closed), ask (escalate to the host's approval UI), steer (inject
context), redact (replace tool output), terminate (stop the loop),
*observe* (recorded only):

Terms, the per-event matrix behind each cell, and the caveats it compresses are
defined in
crates/hooks/README.md.

Quick start

Download the archive for Linux x86-64 or Apple silicon from
Releases,
or build from source with Rust and Cargo. Then:

Installed from an archive, those commands are ./sondera serve, and so on.…