Integration Guides¶
Rampart supports several widely used AI agents through multiple integration methods, with different assurance levels and boundaries. Choose the guide for your agent below, then check the support matrix for the evidence and known limitations of that path.
After setup, rampart verify --all safely checks the policy engine and every configured integration with an active behavioral verifier without invoking a model. Static-only integrations such as Hermes remain visible in rampart doctor and require their isolated compatibility harness for runtime evidence.
Integration Methods¶
| Method | How It Works | Best For |
|---|---|---|
| Native Hooks | Uses the agent's built-in hook system | Claude Code, Cline, Codex, Cursor, GitHub Copilot; Gemini CLI (experimental enterprise/API-key path) |
| Shell Wrapper | Sets $SHELL to a policy-checking shim | Aider, OpenCode, Continue |
| MCP Proxy | Transparent proxy for individual MCP servers | Claude Desktop, Cursor (optional second boundary) |
| LD_PRELOAD | Interposes supported libc exec/spawn functions; native library is source-built | Optional defense in depth for compatible Unix processes |
| HTTP API | RESTful endpoint for custom integrations | Python agents, custom code |
| Native Plugin | Agent framework calls Rampart before each tool runs | OpenClaw, Antigravity, Hermes Agent (experimental) |
| Shim + Service | Legacy shell shim + dist patching compatibility path | Older OpenClaw |
Ask Behavior¶
When a policy action is ask, behavior varies by integration:
| Integration | Behavior |
|---|---|
| Claude Code | Hook returns "permissionDecision":"ask" — Claude Code shows native prompt |
| Codex | Rampart's external approval queue blocks; unavailable queue denies |
| Gemini CLI (experimental) | External Rampart queue blocks; unavailable queue denies |
| Antigravity CLI / IDE | Native force_ask prompt, ignoring cached Always Allow permissions |
| GitHub Copilot CLI / VS Code | Native Copilot approval prompt |
| Cursor | External Rampart approval queue; Cursor's generic pre-tool ask is not enforced |
| Cline | Hook returns {"cancel":true} with approval message (no native ask) |
| Standalone MCP proxy | Proxy blocks, returns JSON-RPC error on deny |
| OpenClaw | OpenClaw owns the visible approval UI; Rampart plugin supplies policy decisions |
| Hermes Agent | Compatible Hermes installations own the native approval prompt and resume the same call; older or incomplete installs block with upgrade guidance |
| Shell Wrapper | Shim blocks, command appears "hung" until resolved |
| LD_PRELOAD | Library blocks exec call, process appears "hung" |
| HTTP API | Returns "decision":"ask" with approval metadata when interactive review is required |
Agent Compatibility¶
| Agent | Method | Command | Platforms |
|---|---|---|---|
| Claude Code | Native hooks | rampart setup claude-code | All |
| Cline | Native hooks | rampart setup cline | Linux, macOS, Windows* |
| Cursor | Native local Agent hook; optional MCP proxy | rampart setup cursor | All |
| Claude Desktop | MCP proxy | rampart mcp -- | All |
| Codex CLI, IDE, desktop | Native hooks | rampart setup codex | All |
| Gemini CLI | Experimental enterprise/API-key native hooks | rampart setup gemini | Linux, macOS |
| Antigravity CLI / IDE | Shared plugin with installed-plugin and adapter checks | rampart setup antigravity | All |
| GitHub Copilot CLI / VS Code | CLI adapter-tested; shared VS Code Preview contract | rampart setup copilot | All |
| OpenClaw | Managed native guard | rampart protect openclaw | Linux, macOS |
| Hermes Agent | Experimental user plugin | rampart setup hermes | Linux, macOS |
| Python Agents | HTTP API | rampart serve | All |
| Any CLI Agent | Shell wrapper | rampart wrap -- | Linux, macOS |
* Cline's Windows .ps1 contract is source-reviewed and cross-build tested; physical Windows host E2E remains pending. See the Cline guide for activation and legacy --yolo limitations.
Choosing an Integration¶
Start with the simplest method
Preferred order is: native hooks/plugin > wrap > MCP proxy > preload > HTTP API. Use the first one your agent supports cleanly.