Coding agents act autonomously across your codebase
They read files, run commands, and call tools without a human reviewing every step-by design, that's what makes them fast.
By usage
Claude Code, Cursor, and Codex - governed, not guessed at.
Coding agents read your repo, execute shell commands, and call MCP servers on your behalf. That autonomy is exactly why every tool call needs to be policy-checked-without adding friction developers will just work around.
Why it matters
Autonomy is the feature and the risk
Every tool call is a new trust decision
An MCP-connected coding agent can reach databases, deployment systems, and internal APIs. Each connection needs to be governed on its own.
Governance can't add friction devs will route around
Security that breaks the workflow gets disabled. Controls need to run underneath the tool, invisibly, on the happy path.
What Lineation does
Policy underneath the assistant, not inside it
Tool-call governance for every MCP connection
Every MCP server a coding agent reaches is inventoried, scored, and policy-checked before the call executes.
Shell command & file-write policy
Read access can stay wide open while write, deploy, and shell-execute actions require explicit allow.
Prompt injection scanning on ingested content
Docs, web pages, and MCP responses are scrubbed for hidden instructions before the agent's decision layer sees them.
Full audit trail per session, per developer
Every tool call is logged and replayable, tied to the developer and session that triggered it.
How it works
Five steps to governed coding agents
Connect at the IDE/CLI layer
A lightweight daemon observes tool calls from Claude Code, Cursor, and Codex without changing developer workflow.
Discover every MCP server
See every tool and server a coding agent can already reach, including ones nobody documented.
Scope policy
Define what files, commands, and repos each agent may touch, by developer, team, or repo.
Scrub ingested content
Documentation, web content, and MCP responses are checked for injected instructions before the agent reads them.
Log every tool call
Sessions are fully replayable, so any surprising agent action can be traced back to its exact trigger.
FAQ
Common questions
Does this slow down Claude Code, Cursor, or Codex?
Policy runs against a cached rule set at the endpoint, so the happy path sees negligible added latency.
What is indirect prompt injection in a coding assistant?
Coding agents read repos, dependencies, web pages, and MCP outputs automatically. Any of that content can carry hidden instructions unless it's scrubbed before ingestion. See the prompt injection guide for more.
Can we allow read access but block write and deploy actions?
Yes-policy is scoped by action type, so read stays open while write, deploy, and shell-execute require explicit allow.
Does this work with permission-skipping flags?
Enforcement happens outside the assistant's own permission model, at the gateway and endpoint layer, so it applies regardless of flags the assistant runs with.
Is this vendor-specific, or does it cover multiple tools?
Coverage is vendor-agnostic across Claude Code, Cursor, Codex, and other MCP-connected assistants.
How do we roll this out without disrupting developers?
Start observe-only to see every tool call without blocking anything, then enable enforcement rule by rule.
Let engineers move fast. Keep the guardrails on.
Observe every tool call today. Enforce policy when you're ready, rule by rule.