Neural Inverse Govern / Third-party AI tools
Govern the AI tools your teams already use, and know exactly how far that reaches.
Govern compiles one policy into each tool's own controls and states, tool by tool, what it enforces, what it only configures and what it can only observe.
- Enforced
- Claude Code, Cursor, Windsurf, GitHub Copilot CLI
- In verification
- Codex
- Managed configuration
- Gemini CLI
- Monitored
- Kiro CLI, Cline, Amazon Q Developer
- Levels verified
- October 2026
Overview
Govern governs third-party AI coding tools as far as each tool's own mechanisms allow, and no further. The endpoint agent installs the compiled policy where each tool reads it, every hook asks the same decision service, and model traffic can be routed through the AI Gateway. Where a tool has no control point, Govern says so and shows the gap.
Control levels
How far Govern reaches inside each tool.
Only an Enforced tool blocks reliably; a Managed configuration tool blocks what its locked configuration removes. The levels assume the endpoint agent has installed the compiled policy in the tool's managed location, and were verified against each vendor's mechanism and version in October 2026.
Enforced
A blocking pre-action hook in a managed location the developer cannot remove or disable.
Managed configuration
Govern installs and locks the tool's configuration. Any hook it also runs is advisory.
Network
Holds only while the tool's traffic goes through the Govern model gateway or MCP proxy.
Monitored
Vendor audit or telemetry only. Nothing is blocked.
Not controlled
Govern has no control. Listed so administrators see the gap.
| Tool | Agent actions | What it covers and what it does not |
|---|---|---|
| Claude Code | Enforced | On devices where Govern's managed settings are installed: user and project settings cannot add allow rules or hooks, and bypass modes are off. Hooks a developer adds in their own settings are advisory. |
| Cursor | Enforced | Shell commands, MCP calls and file reads. Not covered: file edits, Cursor's own web search and fetch tools, and file reads in the cursor-agent CLI. |
| Windsurf | Enforced | Commands, code reads and writes and MCP calls. Not covered: web search and other tools without a pre-action hook. An ask is a block. |
| GitHub Copilot CLI | Enforced | A root-owned policy hook. Rules that name a specific MCP server cannot be applied, and the hook must answer before its deadline. |
| Codex | In verification | Policy is compiled into Codex's managed requirements and configuration. Enforcement through its managed hooks is not yet verified against a released version, so treat it as advisory. |
| Gemini CLI | Managed configuration | Denied tools are excluded in locked settings. The hook is advisory: a developer can disable it or work in an untrusted folder. An ask is a deny. |
| Kiro CLI | Monitored | Advisory hook in the user's own directory. Deleting the hook file removes it; Kiro has no managed location. |
| Cline | Monitored | Advisory hook script. No effect while Cline's hooks setting is off or the script is removed. |
| Amazon Q Developer | Monitored | IDE plugins have no hook interface. Activity arrives through the vendor audit connector. |
| Continue | Not controlled | No hook and no audit interface. Model traffic can be routed through the gateway (Network). |
Model traffic through the AI Gateway.
| Tool | Model traffic | How |
|---|---|---|
| Claude Code | Network | Base URL and a credential helper that fetches a short-lived token. |
| Codex | Network | A model provider entry in its configuration, with a short-lived token. |
| Aider | Network | OpenAI-compatible base URL. |
| Continue | Network | OpenAI-compatible base URL of a model. |
| Cline, Roo Code | Network | The OpenAI Compatible provider, with a short-lived token. |
| Cursor | Network (partial) | Custom models only, through a custom base URL that must be reachable from the internet. Tab completion and Cursor-hosted models never reach Govern. |
| Gemini CLI | Monitored | OpenTelemetry events to vendor audit; the gateway does not serve the Gemini API. |
| GitHub Copilot | Monitored | Seats, usage and metrics through the vendor connector. |
| Windsurf | Not controlled | No custom endpoint and no audit feed of model requests. |
Product names belong to their owners.
What it does
What Govern does for third-party tools.
One policy, compiled into each tool's own mechanism, with the limits stated.
One policy, every engineThe agent policy you write is compiled for each tool: Claude Code's managed settings, Codex's requirements and configuration files, or a vendor tool's native hook file.
Gaps are listed, never droppedEvery rule a tool cannot express exactly is listed as a gap with its severity in the preview, so you see per tool what holds before you rely on a rule.
Managed locationsThe endpoint agent installs the compiled file in the tool's managed, root-owned location where one exists. A hook file in user or project configuration is not locked and only advisory.
Same decision serviceEvery hook asks the endpoint agent, so every tool is decided by the same rules, approvals and decision log. A tool name the agent does not recognise is denied.
Model traffic through the gatewayTools that accept a custom endpoint can send their model requests to the AI Gateway, so model access, budgets, DLP, guardrails, rate limits and request logs apply (Network level).
Short-lived tokens for toolsTools call the gateway as the person using them, with a token of at most one hour bound to their session or enrolled device, never a long-lived key.
Vendor audit: pullGovern polls vendors' audit and usage APIs with credentials held in its vault, among them Anthropic, OpenAI, Azure OpenAI, Amazon Bedrock, Google Cloud, Microsoft 365 Copilot, Amazon Q Developer, GitHub Copilot, Cursor, GitLab Duo, Slack and Box AI.
Vendor audit: pushClaude Code, Gemini CLI and OpenAI Codex send OpenTelemetry events, and any service can post JSON records, each with a revocable ingest token. From the OpenTelemetry tools, prompt text and tool details are withheld unless you choose to store them.
How the levels were provenGitHub Copilot CLI and Gemini CLI were run for real, offline, with the compiled file and the real endpoint agent. For Cursor, Windsurf, Kiro and Cline, their documented hook input was run through the real enforcement hook; the tools themselves were not run.
How it works
How policy reaches each tool.
- WriteAn administrator writes one agent policy in Govern.
- CompileGovern compiles it for each engine and lists every gap.
- DeliverThe endpoint agent verifies the signed manifest and installs the files at the tool's managed location.
- DecideEach hook calls the endpoint agent, which decides by the same rules and approvals for every tool.
- ReportDecisions go to Govern's decision log, with the target stored only as a hash.
Who uses it
Built for every role that answers for AI.
Security teamsWrite one policy for every tool, read the gaps per engine and decide which tools to allow.
Endpoint and IT teamsEnrol machines with the endpoint agent and deploy managed settings with your device management tool.
EngineersKeep the tools they already use, with the same rules and approvals wherever they work.
Compliance and auditRead vendor audit records beside Govern's own, and export them with a signed manifest.
Enforced and recorded
What blocks, what is configured and what is only observed.
The control level of each tool says which of these applies. Only an Enforced tool blocks reliably.
Enforced
Enforced toolsThe tool runs a blocking pre-action hook from a location the developer cannot change, and honours its deny.
Managed configurationWhat the locked configuration removes, such as excluded tools, stays removed. Any hook the tool also runs is advisory.
NetworkModel access, budgets, DLP and guardrails, while the tool's traffic goes through the AI Gateway.
Recorded
Hook decisionsDecisions made by a tool's hook are reported to the decision log, also for monitored tools whose hook a developer can remove.
Vendor recordsVendor audit and usage records show what the vendor reported. They observe; they do not block.
The levels assume the endpoint agent has installed the compiled policy in the tool's managed location. Without an egress lock on developer machines, a person can bypass the gateway with another key or endpoint. Pull connectors call the vendor's service, so in an air-gapped installation only services reachable inside your network can be used.
Linux, macOS and WindowsThe endpoint agent installs each tool's compiled file at the tool's managed path for that operating system.
Tools without a managed locationKiro and Cline hook files can be previewed and distributed by you; the endpoint agent's system service does not install them.
Air-gappedHooks and gateway routing work inside your network. Cursor's custom-model routing needs an address reachable from the internet, so it is not available air-gapped.
Hosted by usWe run it for you, with the same controls and audit record.
Get started
Set it up with the documentation.
Talk to our team.
Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.