Coding hooks: install and verify

Coding hooks are how AI Agent Security sees and governs individual AI tool calls, such as a file write, a shell command, or a web fetch, rather than only the process that made them.

On Windows and macOS, the installer sets up machine-wide managed hooks for all four supported assistants (Claude Code, Codex, Cursor, and GitHub Copilot), and the Pathfinder agent enforces them for every user on the machine. There is no per-user step, and per-user hook entries that older agent versions installed are cleaned up automatically. Use this page to verify capture, check hook health, or reinstall a provider's managed hooks.

Reinstall managed hooks

You need this only if a provider's hook configuration was removed or overwritten after install. Managed hooks are machine-wide and owned by the system, so the command needs administrator rights.

Run the command for one provider in Terminal:

sudo pathfinder-agent hook install --provider claude
sudo pathfinder-agent hook install --provider codex
sudo pathfinder-agent hook install --provider cursor
sudo pathfinder-agent hook install --provider copilot

Or reinstall all four at once:

sudo pathfinder-agent hook install --all-providers

📘
If your policy requires MDM to own configuration files, the agent writes these files itself by default. Fleets where MDM must own them can turn that off and deliver the rendered configurations through MDM instead. For macOS, see Coding hooks MDM payloads (macOS). To print one provider's configuration instead of writing it, add --print, such as pathfinder-agent hook install --provider claude --print.

Verify capture

Run one command for the provider you use. The non-interactive form writes a small file, so there is a tool call to look for. In interactive mode, start the CLI and paste the same prompt: Create a file named pathfinder-test.txt containing the word hello.

The Test step of the Deploy an agent wizard, under Settings > Deployment, shows the same commands for each provider.

Non-interactive

claude -p "Create a file named pathfinder-test.txt containing the word hello"

Interactive

claude

Check: in AI Agent Security, go to Intelligence > AI Sessions. The session appears within seconds, with the file-write tool call visible.

Check hook health

Go to Visibility > Endpoints, select the endpoint, and select the Health tab. The Hook enforcement row reports whether hook enforcement is ready or degraded, and why.

If the agent service is not reachable when a tool call happens, the hook allows the call rather than blocking the developer's work. An endpoint whose hooks allowed calls without evaluating them shows Degraded in that row, so check it when a session is missing or a policy did not block.

Run a quick shell smoke test

This forces exactly one shell tool call. Run it in a directory you trust.

claude -p "Run the shell command pwd, then reply OK."

Test broader tool coverage

The smoke test proves that one tool call arrives. For a prompt that exercises web search, file writes, subagents, and external fetches in one session, use the CLI you installed:

In ~/example-prompt, search the web for the 2 most popular open source projects on GitHub right now. For each one, fetch their homepage, fetch their README, search for recent CVEs or security advisories, search for benchmark comparisons against their closest competitor, fetch one of those comparison pages, and search for the latest release notes. Then write a quick summary in a markdown report. Spin up subagents for these tasks. At the end, give a list of all tools used in this chat.

Open the session in Intelligence > AI Sessions to see each tool call it made.