Agent coverage: which agents CyberBoar can govern
Research for the v1 agent list, done on 2026-10-01. Vendor hook APIs move fast: every row cites the page it came from, and each must be checked again against a real run before its adapter is written. Status notes are as of their dates; the capability matrix has the current state of each adapter.
What an adapter needs from an agent
An adapter (internal/adapters) implements Parse (the agent’s hook input to engine actions)
and Respond (a verdict to the agent’s hook output). That works only if the agent:
- calls an external program before each tool call, with the tool name and its arguments;
- lets that program deny the call (ask is a bonus; without it, ask becomes deny, as on Codex);
- ideally lets an administrator install the hook where the developer can’t remove it
(Claude Code’s
allowManagedHooksOnly, Codex’srequirements.toml), and doesn’t run the tool when the hook crashes or times out.
The first two adapters show the size of one: Claude Code is about 740 lines (adapter plus settings
installer), Codex about 1,190 (it also reads the session transcript and code mode). Each also
needs captured hook inputs in its package’s testdata/, a capability-matrix row, an apply target
and a scripted real run, as test/e2e/claude-code.sh does for Claude Code. Sizes below are relative to those: S reuses most of the
Claude Code adapter, M is a new adapter of Claude Code’s size, L needs something new
outside internal/adapters.
Popularity
| Source | Date | What it says |
|---|---|---|
| JetBrains, Developer Ecosystem Survey 2026 (15,000+ professional developers, reweighted) | fieldwork May–Jul 2026 | used at work: Claude Code 39%, GitHub Copilot 21%, Codex 16%, Cursor 12%, JetBrains AI (incl. Junie) 9%, OpenCode 7%, Google Antigravity 6% |
| JetBrains, AI Pulse wave 2 (10,000+) | Jan 2026 | Copilot 29%, Claude Code 18%, Cursor 18%, JetBrains AI 9%, Antigravity 6%, Junie 5%, Codex 3% |
| Stack Overflow, survey retrospective | 2026-09-30 | April 2026 pulse: 59% use agents (31% in 2025); Claude Code use 41% → 55%. Full 2026 results due in the next days |
| GitHub stars, morphllm | 2026-06-09 | OpenCode 172k, Claude Code 131k (issues/docs repo), Gemini CLI 105k, Codex 90k, Cline 63k, Goose 49k, Aider 46k, Kilo Code 20k |
| GitHub stars, star-history | 2026-10-01 | OpenCode 211k, #25 on GitHub |
| VS Code Marketplace installs, via findarepo | 2026-09-30 | Copilot Chat 79M, Copilot 75M, Claude Code 27M, Codex 15M, Cline 5.5M, Gemini Code Assist 5.4M, Continue 4.3M, Roo Code 2.0M, Amazon Q 1.9M, Kilo Code 1.6M |
Read with care: survey shares are of professional developers at work, stars measure interest rather than use, and install totals count every install ever (Copilot ships preinstalled in many setups). The surveys agree on the order that matters for enterprise buyers: Claude Code, Copilot, Codex, Cursor, with OpenCode the clear open-source leader. npm download counts were not collected: the registry’s API is not reachable from the research environment.
Two market changes since the list was drawn up: Codex went from 3% to 16% in six months, and Google replaced Gemini CLI with Antigravity CLI (announced 2026-05-19; Gemini CLI stopped serving individual users on 2026-06-18, enterprise licences keep it). The earlier choice of “Copilot CLI or Gemini CLI” now reads “Copilot or Antigravity”.
CLI agents
| Agent | Pre-tool hook | Deny / ask | Admin-locked install | Fails closed? | Adapter |
|---|---|---|---|---|---|
| Claude Code | PreToolUse | yes / yes | managed settings | no, native rules cover literal rules | built |
| Codex CLI | PreToolUse | yes / no | requirements.toml | no | built (denied on Windows: PowerShell) |
| Copilot CLI | preToolUse, JSON on stdin (toolName, toolArgs, cwd) | yes / yes (permissionDecision; ask is deny in the cloud agent) | policy files (policy.d, Windows registry) load first | not documented | M; same format family as Claude Code. Tools include bash and powershell |
| opencode | in-process JS plugin: tool.execute.before (throwing blocks the tool), permission.ask | yes / yes | only through the paid OpenCode Console (org deny can’t be lifted); plugins load from .opencode/plugin/ and ~/.config/opencode/ | ours to decide: the shim throws on any error | M; a small TypeScript plugin shim that runs cyberboar hook and throws on deny. The developer can remove the plugin unless the Console locks config |
| Antigravity CLI (was Gemini CLI) | PreToolUse (Gemini CLI’s 11 events folded into 5; old payloads incompatible) | yes (allow_tool: false) / not documented | ~/.gemini/antigravity-cli/hooks.json, project .agents/hooks.json; no system scope found | not documented | M, but the API was rewritten four months ago; wait for it to settle |
| Cursor CLI | shares Cursor’s hooks.json | see Cursor below | see Cursor below | covered by the Cursor adapter if the CLI runs the agent hooks; Cursor’s page is unclear on this, verify in a real run | |
| Amp | permission rules with "action": "delegate" to a program on $PATH | yes / probably | not documented | not documented | M, wire format not public in what was read |
| Kiro | “Pre Tool Use” hook can block | yes / not documented | not documented | not documented | M, output format undocumented |
| Cline (VS Code and CLI) | PreToolUse script in ~/Documents/Cline/Hooks/ or .clinerules/hooks/ (.ps1 on Windows) | yes (cancel: true) / no | none found | not documented | S–M; nothing stops the developer deleting the hook |
| Goose | none: an internal PermissionInspector and permission.yaml | static rules only | none | n/a | out of reach without upstream changes |
| Aider | none: it edits files and runs commands itself, no tool-call hook | n/a | n/a | n/a | out of reach |
| JetBrains Junie CLI | none: ~/.junie/allowlist.json (allow/ask rules) | static rules only | none documented | n/a | out of reach; could generate its allowlist from a policy, advisory only |
IDE extensions
| Product | Hook point | Notes | Adapter |
|---|---|---|---|
| Cursor (IDE agent) | preToolUse, beforeShellExecution, beforeMCPExecution, beforeReadFile, also Tab’s beforeTabFileRead; allow / deny / ask | enterprise scope by MDM (/Library/Application Support/Cursor/hooks.json, /etc/cursor/hooks.json, C:\ProgramData\Cursor\hooks.json) and the team dashboard; failClosed: true blocks on crash, timeout or bad JSON; also loads Claude Code hooks. Cloud agents skip MCP hooks | M; the best enforcement surface after Claude Code |
| Copilot in VS Code (agent mode) | PreToolUse with hookSpecificOutput.permissionDecision allow / deny / ask (Preview) | reads .github/hooks/*.json, ~/.copilot/hooks/, and even .claude/settings.json (chat.useClaudeHooks); admins control hooks through VS Code enterprise policy (chat.useHooks). Which tools from other extensions pass through is not documented | S once the Copilot CLI adapter exists: same format, much of it Claude Code’s |
| Windsurf (Cascade, also its JetBrains plugin) | pre_read_code, pre_write_code, pre_run_command, pre_mcp_tool_use | block only with exit code 2, no ask; any other exit code lets the action through (fail open); system scope /etc/devin/hooks.json, C:\ProgramData\Devin\hooks.json and a team dashboard | S–M; usable, but a crash of our hook allows the call |
| Cline, Kilo Code, Roo Code | Cline has hooks (above); for Roo Code and Kilo Code no documented pre-tool hook was found | Cline S–M; Roo/Kilo out of reach until found | |
| Continue | no documented pre-tool hook found | out of reach until found | |
| JetBrains AI Assistant / Junie plugin | none: user approval and allowlist only | out of reach | |
| Gemini Code Assist | Google moved individuals to Antigravity | follow Antigravity | |
| Inline completions (Copilot, Cursor Tab, …) | not tool calls: text the developer accepts | Cursor’s beforeTabFileRead can keep files from the model | not our problem: nothing runs until a human accepts it |
When there is no hook
CyberBoar decides per call, so an agent without a pre-tool hook can’t be governed by it. What an organisation can still do, honestly ranked:
- Allow only agents that can be governed. VS Code’s enterprise policy can allowlist extensions; MDM can block binaries. This is the only strong control, and the one CyberBoar’s docs should recommend: “these agents are governed; block the rest”.
- Translate the policy into the agent’s own rules (Junie’s allowlist, Goose’s
permission.yaml, OpenCode Console policies): literal rules only, no shell analysis, and advisory unless the agent locks them. Worth it only for an agent with real market share. - The OS sandbox (out of v1, the real v2): file and network limits that hold whatever the agent is. This is the only answer for Aider-style tools.
- After the fact: the git server’s pre-receive checks, secret scanning. Detects, doesn’t prevent.
PowerShell
The design is powershell.md (2026-10-06); this section is the survey that sized it.
PowerShell matters more with every adapter above: Codex on Windows runs it (and is denied
today), Claude Code has a PowerShell tool (denied under denyInterpreters), Copilot CLI
has a powershell tool, and Cursor, Windsurf and Cline run terminal commands in PowerShell on
Windows by default. Without it, “native Windows” means “Git Bash only”.
It is the largest item on this page (L, larger than bash was): bash analysis sits on
mvdan.cc/sh’s parser plus about 5,400 lines of analysis, and no maintained Go parser for
PowerShell exists, so the parser is ours too. The language is also harder to analyse:
case-insensitive and abbreviable parameters, aliases, providers (HKLM:, Env:), .NET calls
([IO.File]::Delete), & $x, Invoke-Expression, script blocks, -EncodedCommand.
Size, measured against what bash cost: mvdan.cc/sh’s lexer, parser and AST are about 5,900
lines, and our analysis on top of it about 5,100 (non-blank, without tests). PowerShell’s
grammar is bigger than bash’s, but a fail-closed analyser only has to parse a subset fully and
recognise the rest well enough to refuse it.
| Part | Strict subset (v1 candidate) | Fuller coverage (v1.x) |
|---|---|---|
Lexer: variables, '…'/"…"/here-strings, backtick escapes and continuation, <# #> comments, operators, the Unicode dashes and quotes PowerShell accepts as - and ' | 800 | 1,500 |
Parser and AST: statements, pipelines, commands and parameters, &&/` | , redirections, &` with a literal; everything else recognised and refused | |
Analysis: cmdlet and alias table, parameter binding (case, abbreviation, positional, -P:value), providers, mapping to engine actions, native commands through the existing code | 1,000 | 2,500 |
| Production Go, total | ~2,700 | ~6,500 |
| Corpus cases, differential against PowerShell’s own parser, fuzz targets | ~1,500 | ~3,500 |
The strict subset lets an agent run native programs with literal arguments (git, npm,
go test) and the common file cmdlets (Get-ChildItem, Get-Content, Set-Content,
Remove-Item, Copy-Item, Move-Item, New-Item) with literal paths; variables, $( ),
script blocks, .NET calls, pipelines into ForEach-Object, and Invoke-Expression stay
denied. Deferring either step costs no contract: PowerShell commands map to the same engine
actions and the same policy, so it can land in v1.x without a policy or protocol change.
Approach, if chosen: our own parser for a strict subset (pipelines of known cmdlets and native
commands with literal arguments), everything else foreign code and denied, exactly as bash
treats what it can’t resolve. PowerShell’s own parser
(System.Management.Automation.Language.Parser) becomes the differential oracle in CI, as real
bash is for scripts/bash-differential.sh, never a runtime dependency (it costs a pwsh start
per call and would trust the machine’s PowerShell). A Windows VM (week of 2026-10-05)
is where its differential would run.
Until then: Git Bash, WSL or a container, said explicitly
An outside program can’t make these agents use another shell on native Windows. Claude Code is
the exception: its Bash tool already runs Git Bash, and its PowerShell tool is denied with a
pointer to Bash. Cursor’s agent ignores the terminal profile and runs PowerShell
(forum, Feb 2026);
Copilot CLI has no shell setting and needs pwsh itself
(discussion); opencode follows $SHELL
and otherwise falls back to cmd.exe, with a config option only promised
(issue 4683).
What CyberBoar can do is deny, and say exactly why, in every place the user or the agent looks:
- Every denied shell call on native Windows whose shell isn’t Git Bash (or isn’t known): “CyberBoar blocked this command: on native Windows, Cursor runs commands in PowerShell, which CyberBoar can’t check yet. Open the project in WSL or a Linux dev container, where commands are checked.” File and MCP tools stay checked natively.
- The session briefing, where the agent supports one, says the same before the first call, so the agent tells the user instead of retrying.
cyberboar applyon native Windows prints it to the administrator at install time, and the capability matrix row says “native Windows: shell commands denied; use WSL or a dev container”.
In WSL, VS Code/Cursor Remote-WSL or a dev container the agent’s tools run on Linux and are checked like any Linux machine, provided the hook is installed inside that environment (to verify per agent in the real runs).
Recommendation for v1
Decided on 2026-10-01: Cursor, Copilot and opencode first; Antigravity CLI is dropped. PowerShell is pending the estimate above.
- Cursor (M): 12% at work, IDE and probably CLI from one adapter, MDM-installed hooks, ask, and an explicit fail-closed switch. The strongest surface after Claude Code. Built (2026-10-02) from the docs and others’ captures; a real run is pending.
- GitHub Copilot, CLI and VS Code agent mode (M, then S): 21% at work and the largest installed base; one hook format for both, close to Claude Code’s, with policy-level files. Copilot CLI built (2026-10-01), verified against 1.0.91.
- opencode (M): 7% at work, the most-starred open-source agent; a plugin shim rather than a command hook, and only lockable through its paid Console, so its matrix row says “advisory unless the Console locks config”. Built (2026-10-02), verified against 1.18.34.
- PowerShell analysis (L): needed for Windows on every agent above; start it now, it is the long pole, and v1 can ship with PowerShell still denied if it isn’t ready.
After v1: Windsurf (fails open, no ask), Antigravity CLI (once its hooks stop changing), Cline, Amp, Kiro. Out of reach without upstream hooks: Aider, Goose, Junie / JetBrains AI, Continue, Roo Code, Kilo Code.