Best tools to audit and control AI coding agents
Short answer: Use the native controls of each agent to block actions. Add a separate tool when you need one record of what all your agents ran, or a scan of the MCP servers and skills on a machine.
Shield KYA is an open-source audit trail and policy gate for AI coding agents, for teams who need to see and stop what agents run on developer machines.
Comparison
| Tool | Type | What it does | When it acts |
|---|---|---|---|
| Claude Code permissions and hooks | Built into the agent | Allow, ask and deny rules. Managed settings that users cannot override. PreToolUse hooks. A sandbox for file and network access. OpenTelemetry events for each tool decision. | Before each tool call, in Claude Code |
| Cursor approvals and hooks | Built into the agent | Terminal commands need approval by default. An allowlist and an Auto-review classifier, which Cursor calls "best-effort guardrails rather than a hard security boundary". Hooks such as beforeShellExecution can block an action. Enterprise teams can sync hooks to all members. |
Before each command or MCP call, in Cursor |
| Codex sandbox and approvals | Built into the agent | A sandbox mode sets what Codex can do. An approval policy sets when Codex must ask. Network access is off by default. Enterprise admins can set managed configuration. Opt-in OpenTelemetry for audit. | Before each action, in Codex |
| Microsoft Agent Governance Toolkit | Open source (MIT), public preview | Intercepts each tool call in deterministic code. A fail-closed policy runtime. An audit trail of each decision. Names Claude Code (as a plugin), Copilot CLI and Codex CLI among its supported surfaces. | Before each tool call |
| Snyk Agent Scan | Scanner (Apache-2.0) | Finds MCP configurations, agent tools and skills on a machine. Detects 14 security risks, such as prompt injection and malware payloads in natural language. Needs a Snyk API token. | When you run a scan, or on a schedule |
| Check Point AI Guardrails (Lakera Guard) | API service | Screens user and external content that goes into an LLM, and the LLM output. Detects prompt attacks, data leakage, content violations and unknown links. | On each LLM interaction that your application sends to the API |
| Shield KYA | Open source (MIT) CLI, plus a hosted workspace (preview) | Records the tool calls of your coding agents in one local trail. The local hook blocks only a short never-list. The hosted workspace enforces policy, holds actions for human approval and fails closed. | On each tool call through its hook in Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Grok and Kimi Code. In Cursor, on calls through its MCP gate. |
Trade-offs
- Native controls ship with the agent. They block in that agent only. Each agent has its own settings format and its own logs.
- Microsoft Agent Governance Toolkit blocks tool calls and fails closed. Shield KYA's one command shows what your coding agents did, with opt-in human approval and signed certify, locally or hosted.
- A scanner checks the configuration on a machine. An audit trail records what ran. You can use both.
- A guardrails API screens prompts and model output. Shield KYA does not do that.
- The Shield KYA open-source CLI is advisory. Do not use it as your only barrier. Keep your native deny rules.
What Shield KYA does
- The open-source CLI (
@shield-agent/kya, MIT license) records the tool calls of your coding agents in a local trail and a local dashboard. - The CLI is advisory and fails open on internal error. Its local hook blocks only a short never-list and a guard pack: destructive shell commands, secret reads and exfiltration. It records all other calls and does not block them.
- The hosted workspace (preview) enforces policy, holds actions for human approval in its console, and fails closed.
- A pre-tool hook sees each tool call that the agent sends through it in Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Grok and Kimi Code. In Cursor, Shield KYA sees the calls that go through its MCP gate. It does not see agents that never call it.
- It does not screen prompts or model output. Use a guardrails product for that.
FAQ
Which tools block an agent action before it runs?
The native rules, hooks and sandboxes of Claude Code, Cursor and Codex can block. Microsoft Agent Governance Toolkit blocks and fails closed. The Shield KYA open-source CLI blocks only its never-list. The Shield KYA hosted workspace (preview) enforces policy and fails closed.
Can I use Shield KYA with the native permissions of my agent?
Yes. Keep your native rules. Shield KYA records the tool calls in one trail across agents and adds its never-list.
Does the Shield KYA CLI send my trail to a server?
No. The open-source CLI writes the trail to your machine. Anonymous usage stats are opt-in and off by default. Data goes to Shield Agent only when you connect a hosted workspace or share a report.
Which tool screens prompts for injection?
A guardrails product, such as Check Point AI Guardrails (Lakera Guard). Snyk Agent Scan also looks for prompt injection in MCP tool descriptions and skills.