Harness coverage
A connector is only as complete as the native action boundary its harness actually exposes.
Coverage matrix
| Harness | Current boundary | Important limitation |
|---|---|---|
| Claude Code | Live-verified PreToolUse, PostToolUse, and failure events for built-in and MCP tools. | A Bash hook sees the proposed command, not every syscall made by its child process. |
| Codex CLI | Native pre/post tool hooks plus Pilot MCP. | User hooks require review/trust; specialized hosted paths may opt out unless managed requirements cover them. |
| Gemini CLI | Native BeforeTool/AfterTool; real allow, result, and denial paths exercised. | Model-request interception is separate, and identical parallel calls have limited post-call correlation. |
| GitHub Copilot CLI | Local and repository preToolUse/postToolUse contracts. | Documented timeouts fail open; cloud agents need committed repository hooks and reachable ingress. |
| OpenHands | Claude-compatible pre/post hooks per repository. | User-home configuration is not fleet-wide; distribute the repository contract to every workspace. |
| OpenClaw | Bundled plugin for built-in tools, results, and outbound messages. | Only OpenClaw-owned paths are covered; retain sandbox and egress controls. |
| Hermes Agent | Native CLI/Gateway pre/post tool hooks; pinned wire protocol verified. | Malformed output, process death, and timeout behavior requires additional containment because upstream failure modes may be fail open. |
| Cline | Global PreToolUse/PostToolUse scripts for desktop and SDK-hosted tools. | Hook crashes and timeouts are documented as fail open; existing global hooks must be composed explicitly. |
| Cursor | Native pre/post tool hooks with fail-closed Pilot preflights. | User hooks do not reach cloud agents; use repository, team, or enterprise distribution there. |
| Continue | Pilot MCP calls plus Continue's static allow/ask/exclude permissions. | No universal external pre/post hook was found; do not claim whole-agent semantic control. |
| JetBrains Junie | Pilot MCP plus Junie's action allowlist. | Native Junie actions remain outside Pilot evaluation without a supported interception API. |
| PicoClaw | JSON-RPC process hooks for before_tool/after_tool. | The upstream runtime is pre-1.0. Pin and certify an exact build; it is not production-certified. |
| Any MCP client | Complete arguments and results for calls to the Pilot MCP server. | Installing Pilot MCP does not intercept other MCP servers or built-in shell, browser, or file tools. |
| Custom SDK host | Potentially complete BeforeAction/AfterAction wrapping around host-owned side effects. | Unwrapped adapters remain outside control; the host must attest and test the complete action inventory. |
Attach after adoption
Use the version-pinned command shown by the onboarding page. Examples:
npx -y pilotprotocol-mcp@0.2.13 attach --claude
npx -y pilotprotocol-mcp@0.2.13 attach --codex
npx -y pilotprotocol-mcp@0.2.13 attach --gemini
npx -y pilotprotocol-mcp@0.2.13 attach --openclaw
npx -y pilotprotocol-mcp@0.2.13 attach --hermesThe adapter verifies that $HOME/.pilot/managed/enterprise-control.json is a regular owner-owned file with owner-only permissions. It merges supported hook configuration without deliberately replacing an unrelated existing hook. Some harnesses require an explicit restart, trust review, repository-level file, or first-use command approval; follow the connector-specific instructions displayed in the console.
What Pilot receives
Where the harness supplies it, a pre-hook sends the canonical action, called tool, complete parameters, explicit file bytes, destination, session and working-directory correlation, permission mode, and timing metadata. A post-hook adds the result, response content, duration, or failure. The hosted exchange makes those fields visible alongside the signed policy and decision.
Coverage must be stated per event. An outbound-message hook can govern message delivery even when it is not a general tool hook. MCP coverage means Pilot sees calls to Pilot MCP, not the entire agent. A shell hook is not kernel mediation.
Failure posture
Pilot can emit a valid deny when the hosted decision service is reachable but rejects or times out according to policy. It cannot prevent a harness from killing or bypassing its hook process if the harness itself defines that path as fail open. For high-risk actions, choose harnesses and deployment controls that can enforce the required failure posture.
- Use managed hook requirements or repository-distributed hooks where user configuration is optional.
- Keep host sandboxing and outbound network policy for child-process containment.
- Do not give the Pilot adapter unrelated model-provider or application secrets.
- Version-pin both the harness and adapter, then retest after either changes.
Production certification checklist
- Inventory every side-effect path: process, file, browser, HTTP, MCP, messages, transfers, trust, events, and payments.
- Prove an allowed action runs and produces a completed exchange.
- Prove a denied action leaves no external artifact.
- Prove approval, exact continuation, expiry, cancellation, and replay rejection.
- Prove failed tool and post-hook evidence is terminal and non-replaying.
- Kill and time out the hook to confirm the actual failure posture.
- Disable the attachment and verify the original unmanaged behavior returns.