Native hook coverage

This matrix was reviewed against official upstream contracts on October 27, 2026. A registered callback does not prove that every provider version emits it. Configuration-layout tests, a native client run, and delivery from your deployed provider are separate validation steps. Use Cloud agent hooks for Cursor Cloud Agents and Grok Bot. Use device managed hook actions for local clients. Native hook coverage is separate from network routing coverage. Platform-specific layouts describe setup support. Historical binary evidence does not qualify every current client release or operating system. Verify the exact runtime and provider version in your environment before a broader rollout. Cloud monitoring does not execute policy enforcement.

Family	Setup route and OS or version limit	Registered observations	Native blocking or rewrite	Tested artifact and live evidence	Exact remaining gap
Claude Code	Fleet native hooks. Current launcher record covers macOS and qualified Windows layout.	Prompt, tools, response, session and supported lifecycle callbacks.	Prompt and pre-tool decisions. Tool input replacement follows the native contract.	Historical release record plus existing runtime tests. Official rolling docs reviewed today.	Re-run each deployed client version. Newly documented events are not automatically installed or qualified.
Codex	Fleet native hooks. OS-specific managed layouts exist. Historical binary evidence covers the macOS launcher.	Supported session, prompt, tool, response, task and compaction callbacks.	Pre-tool deny and exact input replacement. Permission decisions have distinct output semantics.	Existing runtime tests. Official rolling release docs reviewed today.	Hosted tools bypass local function-tool hooks. `write_stdin` does not create a new pre-tool gate. Windows launcher needs separate proof.
Cursor	Fleet native hooks. Historical native test on macOS Agent `2026.07.09-a3815c0`.	Supported prompt, tool, response, task and lifecycle callbacks.	Native permission boundaries and supported input replacement.	Historical allow, tool and deny launcher test, including absent denied side effect.	Qualify newer launchers and other platforms separately.
Cowork	Local setup on macOS. Enterprise plugin layout supports macOS and Windows. Historical Desktop `1.20186.1`, embedded runtime `2.1.205`.	Claude-compatible callbacks in supported plugin execution modes.	Native boundaries depend on the executing plugin runtime.	Historical live evidence covers local macOS only.	Windows enterprise setup needs native launcher qualification. Current remote Cowork execution needs its own installation and ingestion evidence.
Rovo Dev	No qualified launcher. Parser is retained for conformance work.	No complete stdin or output contract established.	No supported enforcement claim.	Parser and official event-hook overview only.	Public examples do not establish input, output, failure, or portable launch semantics. Keep unavailable for deployment.
OpenClaw	Fleet plugin setup. Host version and declared plugin hooks must match the installed profile.	Supported plugin prompt, tool, message, task and lifecycle hooks.	Native directive hooks only. Conversation access requires explicit permission.	Existing plugin implementation and official plugin reference.	Prove the installed host’s hooks and permission settings. Metadata-only hooks do not grant transcript access.
VS Code Local	Fleet local settings and owned hook file. Applies to the legacy Local harness.	Session start, prompt, tools, stop, subagent and precompact. No session end.	Prompt and pre-tool decisions, pre-tool replacement.	Local protocol fixtures. Official Local reference reviewed today.	VS Code’s current Copilot harness uses another contract and discovery path. A different model choice does not verify harness migration.
GitHub Copilot CLI	Fleet managed policy or user hooks. OS-specific layout fixtures.	Session, prompt, tools, failures, response, task and compaction.	Pre-tool and permission decisions. Post-tool result replacement cannot undo execution.	Protocol and native result-rendering fixtures.	Command pre-tool errors deny, but timeouts fail open. Validate actual managed policy and client build.
Gemini CLI	Fleet managed or user settings. OS-specific layout fixtures. Historical native CLI `0.26.0`.	Session, BeforeAgent, BeforeTool, AfterTool, AfterAgent and PreCompress.	BeforeAgent and BeforeTool in Forge. BeforeTool input merge.	Historical real model and tool run against a local protocol backend, including denial. Existing tests also retain delayed callbacks.	No deployed tenant claim. Model hooks remain excluded for privacy. Tool IDs are not guaranteed by the documented payload.
Grok CLI	Fleet `~/.grok/hooks/50-forge.json`. OS-specific layout fixtures.	Session, prompt, tool, failure, stop, task and compaction.	PreToolUse alone. No documented input replacement.	Protocol and renderer fixtures. Official contract unchanged by content digest.	Native timeouts, crashes and malformed output fail open. No current authenticated launcher run.
Qwen Code	Fleet managed or user settings. OS-specific layout fixtures.	Session, prompt, tools, failure, response, task or todo and compaction.	Prompt, pre-tool and permission boundaries with documented replacement.	Protocol and renderer fixtures. Current types reviewed.	UserPromptSubmit also covers model continuations. Safe mode, bare mode and disableAllHooks disable callbacks. New streaming and batch events are not registered.
Cline CLI or SDK	Fleet owned SDK bridges in `~/.cline/hooks`.	Nine registered task, prompt, tool, error and shutdown callbacks.	SDK tool cancellation and input override.	SDK-shaped fixtures. Reviewed event contract.	File-map PreCompact is still undefined. Agent-end response content is unspecified. Do not substitute the extension protocol.
Devin CLI or Local	Fleet config. Minimum tested version `3000.11.3`.	Eight callbacks covering session, prompt, tools, stop and postcompaction.	Pre-tool and permission boundaries. Pre-tool input merge.	Historical native CLI run against a local protocol backend.	Older installed clients are rejected. Stop continuation cannot withdraw delivered content. No deployed tenant evidence.
Hermes	Fleet profile config and native shell-hook consent.	Session or turn, exposed prompt and response, tools and child tasks.	Pre-tool block or shallow argument modification.	Shell-hook protocol, consent and renderer fixtures.	Shell consent and configured fail_closed must be checked. Session-end naming does not establish a true conversation boundary.
Goose	Fleet owned plugin manifest and hooks file.	Session, prompt, tool, file or shell observations and stop.	PreToolUse. No documented exact argument replacement.	Protocol and renderer fixtures. Reviewed implementation.	on_failure=block applies only to pre-tool. No invented subagent callbacks. No authenticated current launcher run.
Windsurf or Cascade	Fleet managed Devin hook locations or legacy user location.	Native prompt, file, shell, MCP and response observations.	Exit 2 on supported pre hooks. No exact output replacement.	Protocol and layout fixtures. Current official Cascade reference reviewed.	Restricted Mode suppresses hooks. No native session boundaries. Devin Local uses a different contract.
Cursor Cloud	Repository `.cursor/hooks.json` or Enterprise team hooks. Separate scoped cloud credential and runtime.	Fourteen registered cloud callbacks.	Forge collector remains monitor-only.	Shared success, failure and redacted-result fixtures pass in Go and Rust. No live hosted executor in this review.	Early read-only turns and session boundaries are absent. Dedicated MCP callbacks are absent. Generic HTTP MCP results may be redacted.
Grok Bot	Hosted computer `~/.cursor/hooks.json`. Separate scoped credential and runtime. Enterprise central setup is per member.	Ten configured callbacks. The parser also accepts two session-boundary observation names. Reference native probe observed only the three tool callbacks.	Forge collector remains monitor-only.	Shared success and timeout fixtures pass in Go and Rust. No Forge live hosted executor in this review.	Without conversation identity, only valid native tool IDs permit call pairing. Other registered events require provider emission and eligible identity.

The generic profile installer excludes entries whose canonical kind is empty. Session-boundary names in the shared profile describe parser acceptance, not installed callback coverage. Product-specific installers can register additional lifecycle observations. Verify emitted boundaries on the actual installed configuration before claiming a complete session history. Native command hooks use their own setup. Framework SDK instrumentation, OTLP exporters, provider inference hooks and gateway routing require separate configuration and credentials. Their visibility and controls differ. When several routes report the same activity, verify correlation before treating the records as additional conversation coverage.

Current limits

Cursor Cloud can emit generic HTTP MCP tool callbacks with redacted output. Dedicated cloud MCP callbacks and early read-only turns remain unavailable. Redacted content is not inspected content.
Grok Bot team setup may expose secrets only to setup processes. Persist the collector secret privately for later hooks. Validate a fresh Bot for each pilot member. A missing native conversation ID permits tool-use pairing, not conversation reconstruction.
VS Code Local is a legacy harness. The current shared Copilot harness has a separate contract and setup path.
Qwen UserPromptSubmit can represent a model continuation. Its callback name alone does not establish a new human prompt.
Cowork can execute remotely. Desktop plugin qualification does not establish coverage of hosted sessions across web or mobile.

A watcher or manual intervention request records intent. Check the linked evaluation and outcome to determine what happened. Only an applicable executed enforcement path can establish that a tool was blocked or rewritten. Monitor-only cloud events remain observational.

Get started

Observe

Secure

Enable

Integrations

Resources

Native hook coverage

Current limits