Integration Support Matrix¶

Use this page as the canonical support contract for Rampart's main integration surfaces.

Rampart is policy, approval, audit, and proof infrastructure for agents that need real system access. This matrix describes current support evidence, not future-feature commitments. Optional containment, fleet controls, and broader enterprise administration should not be inferred from these support tiers.

Support tiers are tied to Rampart's public integration assurance manifest and portable evidence from the exact candidate build.

Verify configured boundaries safely¶

rampart verify --all

This runs the policy canaries plus every configured integration on the current platform that has an active behavioral verifier. It does not invoke a model or execute the represented actions. A target is not promoted merely because its configuration exists: OpenClaw's live plugin can earn host_verified, while ordinary native-hook checks earn adapter_verified.

These labels describe different probes. Native-hook verification inspects installed settings and invokes Rampart's adapter directly. OpenClaw verification calls rampart.verify on the running gateway plugin, which exercises the same policy mapping used by its pre-tool hook. Neither probe runs an authenticated agent turn or demonstrates a tool's execution or approval resume through the host dispatcher. Package startup and rolling compatibility tests are separate evidence, not a promotion of adapter checks to host ingestion.

Static-only integrations are excluded from the aggregate rather than reported as passing. In particular, use rampart doctor for Hermes installation status and the isolated latest-Hermes compatibility check for runtime evidence.

At a glance¶

Best default choices¶

• Claude Code → current documented hook-visible tools are mapped and, in enforce mode, unknown future pre-call tools deny; installed configuration and adapter behavior have safe verification
• Codex CLI, IDE, desktop → native lifecycle hooks cover host-exposed shell, file, MCP, web, and delegated-agent calls
• Antigravity CLI / IDE → one shared native plugin gates documented tool calls before execution and uses force_ask for approvals. Both hosts share the reviewed plugin contract and adapter. Current PostToolUse does not expose results, so response scanning is not claimed
• GitHub Copilot CLI / VS Code → one shared user hook covers both hosts; latest-package startup and the adapter are tested separately, but authenticated hook ingestion is still pending. Copilot CLI also supports a separate administrator-owned machine policy hook, while VS Code hooks remain an upstream Preview surface covered by contract and adapter tests
• Cursor local Agent / Cmd+K → the managed user preToolUse hook is fail-closed and leaves Cursor's own permission system intact on allow. Cloud Agents and Tab use separate configuration and hook surfaces; current verification proves configuration and adapter behavior, not host ingestion
• OpenClaw >= 2026.5.2 → rampart protect openclaw installs and verifies the managed native guard with fail-closed service behavior and native approval UI. An explicit --serve-url is used consistently for startup, plugin configuration, and verification; it must be loopback, and a non-default endpoint must already be reachable
• Cline → current editor and CLI payloads plus POSIX and Windows discovery artifacts are covered by adapter/setup tests; physical Windows and rolling latest-Cline host proof remain pending. Legacy CLI --yolo disables hooks, and the currently advertised custom --hooks-dir override is not consumed reliably by upstream file-hook discovery

Experimental paths¶

• Gemini CLI (enterprise/API key) → experimental native BeforeTool/AfterTool hooks cover documented shell, file, network, MCP, memory, and delegated-agent calls; a real authenticated host proof is still pending, and this does not cover Antigravity
• Hermes Agent → experimental plugin path with isolated latest-runtime discovery, dispatch, deny/allow, native approval/resume, and degraded-mode checks. Older Hermes releases block ask with upgrade guidance. Its built-in status check remains static, so it is not included in rampart verify --all, and authenticated live-host proof remains pending

Approval paths and limits¶

An ask decision requires approval; it does not promise that every integration has a working approval UI. Use the owner for the configured path:

Approving a pending action and granting permission to future actions are different operations. The OpenClaw native plugin does not learn persistent allowances from approval callbacks. Its separate exec-event compatibility bridge has different behavior; see the OpenClaw approval guide.

The verification probes described above do not prove approval delivery or resume. A supported native approval contract and a completed installed-host journey are different evidence.

Degraded behavior notes¶

In enforce mode, Rampart returns a denial for malformed tool input, invalid policy, and other handled decision failures. A host that never starts the hook, cancels it, or ignores its response owns the resulting behavior. The table describes the managed integration; monitor mode and explicit fail-open settings weaken enforcement. A host continuing its permission flow does not mean it will necessarily execute the tool.

OpenClaw and Hermes operators can explicitly opt tools into degraded fail-open behavior; rampart protect openclaw installs an empty opt-out list. OpenClaw's native approval limits and trusted-plugin composition boundary also apply. Hermes likewise treats other argument-rewriting plugins as part of the trusted host boundary; their rewrites are not verified as re-evaluated by Rampart.

Disabled or undiscovered hooks provide no interception. See each integration's activation requirements, including Cline's legacy --yolo bypass. Legacy OpenClaw patching requires re-patching after upgrades. Wrapper, preload, and custom API paths depend on their own configuration and caller behavior.

The machine-readable source for current integration guarantees and evidence is assurance/integrations.yaml. Coverage applies only to actions the host exposes through the named boundary. It does not imply syscall, packet, or arbitrary subprocess inspection.

Choosing the right path¶

• Use native hooks when the agent supports them.
• Use the Antigravity shared policy plugin for Antigravity CLI and IDE.
• Use the OpenClaw native plugin on current OpenClaw builds.
• Use the Hermes Agent plugin for conservative early Hermes testing.
• Use wrapper / preload when the CLI agent has no hook system.
• Use MCP proxy or HTTP API for clients that integrate through MCP or custom service calls.

Related guides¶

• Quick Start
• Security Assurance
• How Rampart Works
• OpenClaw integration
• Hermes Agent integration
• Integration guides