You're viewing docs for v1.0.0-rc.3.
View the latest release
Capability matrix
Coverage for tool calls that reach each adapter. File checks through shell commands are best effort; CyberBoar is not an OS sandbox. See Agent setup for installation and Security model for shared limitations.
This reference is generated from internal/adapters/matrix_data_test.go with
go test ./internal/adapters -update; edit the source rather than this page.
| Capability | Claude Code | Codex CLI | GitHub Copilot (CLI, VS Code) | Cursor | opencode |
|---|---|---|---|---|---|
| Validation coverage | Claude Code 2.1.220: captured inputs and real-agent harness. | Codex 0.155: captured inputs and real denied reads/writes; scripted-model integration harness passed at 0.155 and 0.163. | Copilot CLI: captured inputs/schema at 1.0.91, tool list at 1.0.97; local-model integration harness passed at 1.0.97 and 1.0.98. VS Code 1.142 with Copilot Chat 0.70: the Copilot target runs the CLI runtime (captured inputs); the Local agent has captured inputs and tool list, and a scripted-model run checked its decisions. | Cursor CLI 2026.10.14: captured inputs and real-agent harness. Cursor editor 3.13: documentation and captured payloads; real-agent validation pending. | opencode: captured plugin inputs/schema at 1.18.34; local-model integration harness passed at 1.19.0. |
| Native Windows | Bash tool with Git Bash and the PowerShell tool, which is the only shell without Git Bash. Mount-aware Windows path checks cover drives, trailing dots, streams, junctions and 8.3 names; UNC/device paths deny. Local-scope real-agent testing does not cover every CPU or managed configuration; the PowerShell tool’s real-agent testing is limited. | PowerShell, with the same Windows path checks; the user’s PowerShell profiles run and are guarded. User and managed scope; project scope is not supported. Real-agent testing is limited. | Denied; use WSL or a Linux container (in VS Code, open the folder there). | Denied; use WSL, Remote-WSL or a Linux container. | Denied; use WSL or a Linux container. |
| Native file tools | Read, Write, Edit, MultiEdit, NotebookEdit, Grep, Glob, LS and file-upload tools. | apply_patch (every changed path), view_image. Reads otherwise use shell tools. | view, create, edit, str_replace_editor, apply_patch (every changed path), grep, rg and glob. VS Code Local: read_file, list_dir, view_image, create_file, replace_string_in_file, multi_replace_string_in_file, insert_edit_into_file, apply_patch, create_directory and notebook tools; grep_search, semantic_search and symbol searches check the whole workspace. A file: URI in a path is read as its path; other URIs are refused. | Read, Write, Delete and Grep through preToolUse; loosely matched path fields, missing paths deny. beforeReadFile covers prompt attachments; beforeTabFileRead covers Tab reads. | read, write, edit, apply_patch (every changed path), grep and glob. |
| Shell file rules | Best effort on inferred arguments. Launched programs’ internal file access is opaque. | Best effort. Working directory is recovered from the session transcript; code mode requires plain literal tool calls. Missing or unmatched calls deny. | Best effort. Each call starts in the session directory and keeps no cd or variables; relative paths in reused shells (shellId) ask, since such a shell starts where it was created. VS Code Local: the agent terminal persists and its directory is not reported, so relative paths ask unless the command starts with an absolute cd; the terminal is read as bash/zsh. | Best effort. The agent shell persists between calls; a call without a working directory leaves relative paths unknown (ask, so denied) unless the command starts with an absolute cd. HOME, glob options and aliases from earlier calls are treated as unknown. Shells outside bash/sh/dash/zsh are foreign code. | Best effort using the call’s workdir. |
| Command rules | Parsed Bash commands. On native Windows the PowerShell tool’s commands are parsed PowerShell (a checked subset); elsewhere that tool is denied (builtin.powershell). | Parsed Bash; selected shell is recovered from the transcript. Shells outside bash/sh/zsh are foreign code. On native Windows commands are parsed PowerShell (a checked subset), and other shells deny (adapter.windowsShell). | Parsed Bash; the powershell tool is foreign code. VS Code Local: run_in_terminal and create_and_run_task commands; a task must run in the hook’s workspace folder, and a task with arguments may hold only plain words, since VS Code quotes them. | Parsed Bash through preToolUse and beforeShellExecution. | Parsed Bash; config, $SHELL or the Bash default selects the shell. Shells outside bash/sh/dash/zsh are foreign code. |
| MCP rules | Server name from the hook input; deny and ask rules also match names with characters outside A-Z, a-z, 0-9, _ and - written as _. | All possible server/tool name splits; deny and ask rules also match Codex’s rewritten names (characters outside A-Z, a-z, 0-9 and _ as _, hash suffixes); resource access maps to its server. | All possible server/tool name splits; deny and ask rules also match Copilot’s rewritten names (punctuation as -, punycode, 64-character cut). VS Code Local names tools mcp_<label>_<tool> with a label the server reports, cut at 64 characters: deny and ask rules match the tool of any server (a whole-server deny covers every VS Code MCP tool), and only */tool allow rules cover a call; a cut name matches deny and ask rules whose tool could start with it, and only allow rules whose tool pattern ends in *. | beforeMCPExecution, the event supplying the server name. | Configured server names and all possible splits; resource calls map to a known server or every server when ambiguous. |
| ask | Native user confirmation. | Converted to deny; a hook ask would let the tool run. | Native confirmation; headless (-p) denies. VS Code: native confirmation. | Converted to deny; preToolUse ask would let the tool run. | Converted to deny; plugins cannot request confirmation. |
| Unclassified tools | Denied. | Denied, including code-mode exec and plugin installation. write_stdin is not hooked, so commands that ask for a terminal (tty) are denied. | Denied, including write_bash/write_powershell and unknown tools. VS Code Local: extension tools are denied, but one named mcp_… is checked as an MCP tool; send_to_terminal, run_task, runTests, run_notebook_cell, run_vscode_command, install_extension, run_playwright_code and vscode_renameSymbol are denied (adapter.uncheckedTool). | Denied outside Shell, Read, Write, Delete, Grep, Task and MCP. | Denied, including custom tools, experimental lsp and code-mode execute. |
| Hook visibility limits | No unhooked calls known. | Hosted tools (such as web search) and hook opt-outs are outside coverage. Input typed into running commands (write_stdin) is not hooked; commands with a terminal are denied, and others get no stdin. | Internal sql/session_store_sql queries are checked conservatively and refused when file access is possible (ATTACH, read_csv, quoted paths). VS Code’s memory files live in its own storage and are not governed. VS Code’s hook input names only the folder the hook runs in: in a multi-root workspace, workspace-wide searches are checked against that folder only and other folders’ settings are not guarded. terminal_last_command and terminal_selection may return output of commands the user typed; insert_edit_into_file is checked for secrets in its sketch, not the text another model writes from it. | Cloud-agent MCP calls lack beforeMCPExecution. Events that fire no hook, such as AskQuestion, are outside coverage. | No unhooked calls known; another plugin can alter arguments after the check. |
| Subagents | Hooked. | Hooked. | Hooked. | Task passes; subagent calls are checked. | Hooked with separate sessionID. |
| Tripwire | Per session_id. | Per session_id; converted asks do not count. | Per sessionId (VS Code: session_id). | Per conversation_id; converted asks do not count. | Per sessionID; subagents count separately. |
| Session briefing | SessionStart additionalContext for startup, resume, clear and compact. | SessionStart additionalContext; invocation verified, delivery of briefing text unverified. | sessionStart additionalContext; delivery verified in Copilot CLI and VS Code’s Local agent. | sessionStart additional_context in editor/CLI; unavailable in cloud agents. | System prompt through experimental.chat.system.transform; delivery verified. |
| Hook execution failure | Claude Code 2.1.295+ blocks missing binary, crash and timeout with onFailure: block. Earlier versions may fail open; native deny/ask fallback covers translatable literal file, command and MCP rules. | Can fail open. Managed prefix_rules cover translatable literal command rules. | Timeout or invalid output can fail open. Crashes/other exits deny; no native fallback. VS Code lets a tool run on a timeout or an exit other than 0 and 2, so the installed command ends in || exit 2: a missing binary or crash denies. | failClosed blocks crashes/timeouts; invalid output also blocks. | Plugin denies missing binary, crash, timeout and unexpected answers. Plugin-load failure or –pure skips enforcement. |
| Configuration guards | Guards settings, installed plugins, custom agents, skills and commands (.claude/agents, .claude/skills, .claude/commands in ~/.claude, CLAUDE_CONFIG_DIR, the project and every folder above it up to its git work tree), whose hooks Claude Code runs, shell startup files, and policy, key, audit and binary (builtin.guarded), plus native Edit denies, which also cover these folders at any depth. Shell writes to .claude/skills or .claude/commands below the project, folders added with –add-dir or /add-dir, indirect writes by launched programs and branch switches remain gaps. | Guards hooks.json/config.toml under CODEX_HOME/project, /etc/codex (Windows: %ProgramData%\OpenAI\Codex), session transcripts, shell startup files, on Windows the PowerShell profile and module folders, and shared policy/key/audit/binary paths; indirect-write gaps remain. | Guards COPILOT_HOME or ~/.copilot, .github/hooks and .github/copilot and VS Code’s workspace settings in the session’s folder and every folder up to its git work tree, /etc/github-copilot/policy.d, user settings of every profile, and remote machine settings including Codespaces’ (chat.useHooks, chat.hookFilesLocations), Claude settings (chat.useClaudeHooks), custom agents (.github/agents, .claude/agents, ~/.copilot/agents, ~/.claude/agents) and agent plugins, whose hooks VS Code runs, shell startup files, and shared protected paths; *.code-workspace files, .vscode/mcp.json, agent locations added with chat.agentFilesLocations and indirect writes remain gaps. | Guards user/workspace/machine hooks and scripts, cli-config.json, editor user settings, Claude settings, shell startup files and shared protected paths; indirect-write gaps remain. | Guards XDG config/cache, ~/.opencode, project .opencode, opencode.json(c)/tui.json(c), environment-selected config, /etc/opencode, shell startup files and shared protected paths; indirect-write gaps remain. |
| Trust before activation | Not required. | User/project hooks require trust in /hooks. Managed hooks do not. | Not required for Copilot CLI. VS Code runs workspace hooks only in a trusted workspace. | Not required. | Not required. |
| Managed locking | Managed settings with allowManagedHooksOnly (Team/Enterprise, MDM). Other scopes are advisory. | requirements.toml with allow_managed_hooks_only. Other scopes are advisory. | Root-owned /etc/github-copilot/policy.d, unaffected by disableAllHooks; VS Code’s Local agent does not read it, nor a user hook under COPILOT_HOME. Other scopes are advisory. | Machine-wide root-owned hooks run before user hooks. apply cannot configure dashboard team hooks; other scopes are advisory. | No CyberBoar managed scope. –pure/OPENCODE_PURE=1 skips plugins; configuration is advisory outside OpenCode Console controls. |
| Network egress | Not governed. | Not governed. | Not governed. | Not governed. | Not governed. |