cmd.exe or PowerShell resolution through COMSPEC and PATHEXT. The install commands and the interactive picker also resolve agent CLIs that npm installs as .cmd shims on Windows, so commands like install --codex find them. Automated Windows tests cover the analyzer and a subset of integrations; for the remaining hosts Windows support is best-effort and untested, and Amp’s own manual documents macOS, Linux, and WSL rather than native Windows.
The Hermes Agent and OpenClaw integrations run only on macOS and Linux. They use the POSIX home-directory paths ~/.hermes and ~/.openclaw and do not support Windows paths.
Install Node.js 18 or later before you start. The examples use npx to run CLI subcommands.
Use cc-safety-net install <target-flag> to install one integration and cc-safety-net uninstall <target-flag> to remove it. Use cc-safety-net update to refresh all installed integrations.
Install interactively
Run the installer with no target flag to get an interactive multi-select over the coding CLIs detected on your machine:Space selects a target, Enter confirms, u switches to updating every installed integration instead, and q or Esc cancels without changing anything. The @latest qualifier matters: a bare cc-safety-net spec can re-run an older cached copy from the npx cache instead of the current release, so every install, uninstall, and update command on this page pins it.
To remove integrations the same way:
ccsn, a shorter alias for the same commands:
npx runs use the full cc-safety-net name.
Update installed integrations
To refresh every installed integration in place, run:update detects the integrations already installed on your machine — including disabled ones — and re-runs each one’s install path in update mode. An integration whose agent CLI cannot be found is reported as skipped, and if nothing is installed the command tells you to run cc-safety-net install first. Pressing u in the interactive installer runs the same update.
update is also the upgrade path between major versions. Running it on a v1 installation moves every installed integration to the current v2 release. If you defined custom rules under v1’s inline configuration, complete the legacy migration. Then confirm that the runtime is ready with npx cc-safety-net doctor.
Install a specific agent
For scripted, non-interactive installs, pass exactly one target flag. Passing zero or more than one target flag is an error. In an interactive terminal, passing no target flag starts the installer selector.
Every install command is idempotent: running it again on an already-configured agent is safe and leaves a single managed entry behind.
Amp Code installation
cc-safety-net.ts in your account’s hosted Amp Personal Plugins repository. A personal plugin follows your account everywhere, so it also covers threads that execute on a remote machine, such as Amp Orbs.
Install needs the amp CLI and a signed-in account: it first runs amp plugins repositories --json to find your writable Personal Plugins repository, and a missing CLI or missing login stops the install with a pointer to amp login. It then clones user-plugins into a throwaway temporary checkout, writes cc-safety-net.ts, commits under the tool identity cc-safety-net (with commit signing turned off, so your global git config cannot stall the install), and pushes. Rerunning the command updates the published artifact in place.
Install also embeds a snapshot of your user policy file into the published artifact. At runtime the snapshot applies only on a machine that has no policy file — such as an Orb’s empty home directory; a policy file present on the machine, even an invalid one, always wins. If your policy file is absent or cannot be parsed, install publishes the bare artifact without a snapshot. The snapshot does not carry audit retention, user rulebooks, or project-scope policy, and a policy edit ships on the next install --amp or update.
cc-safety-net.ts from the personal repository with the same commit-and-push flow.
Restart Amp or run
plugins: reload after installing, updating, or uninstalling so the change takes effect.cc-safety-net.ts in the personal repository if it is a symlink, not a regular file, or a file that does not carry the CC Safety Net managed header. Remove it there and rerun the command.
Earlier releases copied the plugin to a local file at ~/.config/amp/plugins/cc-safety-net.ts. A leftover local entry masks the personal plugin, so install removes a managed local copy after publishing, and fails when the local entry is not a managed copy:
Antigravity CLI installation
PreToolUse entry to ~/.gemini/config/hooks.json that runs npx -y cc-safety-net hook --agy-cli on each run_command tool call.
Because the hook runs through npx, install first deletes any cached cc-safety-net copies from the npm cache’s _npx directory ($npm_config_cache if set, otherwise ~/.npm on macOS and Linux, %LOCALAPPDATA%\npm-cache on Windows) so the hook resolves the current release. Uninstall does not touch the cache.
/cc-safety-net skill so you can author rules interactively inside Antigravity CLI:
Claude Code installation
cc-marketplace marketplace from kenryu42/cc-marketplace and installs the cc-safety-net@cc-marketplace plugin, enabling it if a disabled copy is already present.
/plugin inside Claude Code, navigate to Marketplaces, select cc-marketplace, and enable auto-update.
The plugin invokes the shared Coding CLI hook,
cc-safety-net hook --coding-cli (short flag -cc). That is the canonical flag name, and it is shared with the Codex plugin. hook --claude-code is accepted as a legacy alias only — do not use it in new configuration.Codex installation
cc-marketplace marketplace from kenryu42/cc-marketplace and installs the cc-safety-net@cc-marketplace plugin.
Codex support has one known enforcement bound: input typed into an already-running interactive session is never inspected or audited. See the Codex coverage boundary.
Trust the hook
Codex will not run an untrusted hook. Start Codex, open /hooks, select the cc-safety-net PreToolUse hook, and press t to trust it.
Cursor installation
preToolUse entry to your global Cursor hooks config, ~/.cursor/hooks.json:
failClosed means Cursor denies the tool call if the hook cannot produce a decision.
Because the hook runs through npx, install first clears cached cc-safety-net copies from the npm _npx cache so the hook resolves the current release; uninstall does not touch the cache. The cache locations are listed in the Antigravity CLI section.
Gemini CLI installation
https://github.com/kenryu42/gemini-safety-net, or re-enables it if a disabled copy is already present. Gemini CLI is not a cc-marketplace plugin — its extension lives in its own repository under the extension id gemini-safety-net.
GitHub Copilot CLI installation
cc-marketplace marketplace if it is not already registered, installs the cc-safety-net@cc-marketplace plugin, and flips the plugin to true in enabledPlugins in ~/.copilot/settings.json if it was explicitly disabled.
Restart Copilot CLI after installing or removing the plugin for the change to take effect.
.github/hooks; inline hook definitions in .github/copilot/settings.local.json, .github/copilot/settings.json, .claude/settings.local.json, .claude/settings.json, ~/.copilot/settings.json, and ~/.copilot/config.json; and user hook files under ~/.copilot/hooks. Inline hook definitions require Copilot CLI 1.0.8 or later, and user hook files require 0.0.422 or later. The plugin handles this for you; if you configure hooks manually and hit issues, run npx cc-safety-net doctor — it reports the detected Copilot version and which hook sources are supported.
Hermes Agent installation
__init__.py and plugin.yaml — to $HERMES_HOME/plugins/cc-safety-net/ (~/.hermes/plugins/cc-safety-net/ when HERMES_HOME is unset), then runs hermes plugins enable cc-safety-net --no-allow-tool-override. The files alone are inert: Hermes loads a user plugin only when its own config lists it as enabled, which is why install runs the enable command even when the files are already up to date.
Because the plugin shells out through npx, install first clears cached cc-safety-net copies from the npm _npx cache so the plugin resolves the current release; uninstall does not touch the cache. The cache locations are listed in the Antigravity CLI section.
Restart Hermes after installing, updating, or uninstalling so the change takes effect.
pre_tool_call, the plugin sends the tool call to npx -y cc-safety-net hook --hermes-agent (short flag -ha) over JSON stdin, with a 30-second timeout. It protects the terminal, read_file, write_file, and patch tools; other Hermes tools are not forwarded. The plugin fails closed: when npx is missing, the analysis cannot start, times out, exits non-zero, or returns unreadable output, the tool call is blocked with an explicit message instead of slipping through.
hermes plugins disable cc-safety-net before removing the plugin files — Hermes only resolves a plugin that is still on disk, and a config entry left enabled would auto-load any future plugin of the same name. If the hermes CLI fails or is missing, the files are removed anyway and a warning notes that cc-safety-net may still be listed in the Hermes config. Uninstall also removes the Python __pycache__ bytecode directory and reclaims the plugin directory only when nothing else is left in it.
Install and uninstall both refuse to touch the plugin directory if it is a symlink or not a regular directory, and refuse to overwrite or remove any managed file that is a symlink, not a regular file, or does not carry the CC Safety Net managed header. Move or remove it yourself and rerun the command.
This integration is macOS and Linux only.
Kimi Code installation
Kimi Code supports two install methods: a global hook written to your Kimi Code config, or a native Kimi Code plugin you install from inside Kimi Code. In an interactive terminal,install --kimi-code (or picking Kimi Code in the interactive installer) opens a single-select prompt asking which method to use: install the global hook now, or print the native-plugin steps. In a non-interactive session the flag installs the global hook directly, so scripts and CI pipelines never hang on a prompt. update is unchanged.
Kimi Code hooks are fail-open with either method: when the hook process cannot start, crashes, or times out, Kimi Code allows the tool call.
[[hooks]] block to ~/.kimi-code/config.toml (or $KIMI_CODE_HOME/config.toml) that runs npx -y cc-safety-net hook --kimi-code on each PreToolUse call. The adapter treats Bash as a shell-command tool and inspects other tool inputs for protected paths.
Because the hook runs through npx, install first clears cached cc-safety-net copies from the npm _npx cache so the hook resolves the current release; uninstall does not touch the cache. The cache locations are listed in the Antigravity CLI section.
/reload or start a new session. The plugin declares one PreToolUse hook with no tool matcher. It runs node ./dist/bin/cc-safety-net.js hook --kimi-code for every tool call with a 30-second timeout, using the same adapter as the global hook.
When the global hook is already configured, the Kimi Code row in the interactive installer stays selectable and is labeled (global hook installed), and the printed plugin steps add a caution: run cc-safety-net uninstall --kimi-code only after the plugin is active. A brief overlap where both hooks run just duplicates the denial message, while a gap with neither active leaves you unprotected.
Optionally install the /cc-safety-net skill so you can author rules interactively inside Kimi Code:
OpenClaw installation
openclaw plugins install <packaged plugin dir> --force followed by openclaw plugins enable cc-safety-net, where the packaged plugin directory ships inside the npm package. It then verifies the plugin actually loaded by running openclaw plugins inspect cc-safety-net --runtime --json: an enabled plugin whose runtime is broken installs cleanly and then silently protects nothing, so anything other than a loaded status fails the install and points you at openclaw plugins inspect cc-safety-net --runtime for details.
Because --force overwrites (and on uninstall deletes) whatever holds the cc-safety-net extension id, both commands first check that the extension directory holds only a CC Safety Net managed plugin — or nothing at all — and refuse to run otherwise. Move or remove the directory and rerun the command.
Restart the OpenClaw Gateway after installing, updating, or uninstalling so the change takes effect. If
plugins.allow is set in openclaw.json, it must also list cc-safety-net — an allowlist that omits it keeps the plugin from loading even when it is enabled.before_tool_call handler for the untagged exec tool only. OpenClaw’s file tools and tagged exec variants are not covered. Each supported exec call is analyzed against the agent’s workspace directory, and the plugin fails closed when that workspace cannot be resolved, when workdir resolves outside it, or when the call names an execution host other than auto or gateway (for example sandbox or node).
OpenClaw’s state directory is OPENCLAW_STATE_DIR when set, otherwise the directory holding OPENCLAW_CONFIG_PATH, otherwise ~/.openclaw; the config file is OPENCLAW_CONFIG_PATH when set, otherwise openclaw.json in the state directory. A leading ~ path in either environment variable expands against the user’s home directory. Install and doctor resolve paths in that same order, so a relocated OpenClaw install is handled instead of reported as absent.
This integration is macOS and Linux only.
OpenCode installation
$XDG_CACHE_HOME/opencode as its cache directory when XDG_CACHE_HOME is set and non-empty, otherwise ~/.cache/opencode. It can keep serving a stale cached plugin version, so the install command clears packages/cc-safety-net@latest under that directory before running opencode plugin -g -f cc-safety-net@latest. Install then proves that the cached package exists, its declared main entry loads, and it exports a callable CCSafetyNetPlugin; a failed proof stops the install because OpenCode would otherwise continue without protection.
$XDG_CONFIG_HOME/opencode as its config directory when XDG_CONFIG_HOME is set and non-empty, otherwise ~/.config/opencode. Uninstall removes cc-safety-net from the plugin array in opencode.json or opencode.jsonc there and clears the cached package again.
Restart OpenCode after installing or updating so the plugin is loaded from the refreshed cache.
Pi installation
pi install npm:cc-safety-net and, if your Pi settings pin an extensions filter that would leave CC Safety Net disabled, clears that filter in ~/.pi/agent/settings.json.
bash tool as a shell command. It also inspects other tool inputs for protected paths, but it does not support custom command tools named Shell (for example pi-grok-cli). It registers a /cc-safety-net builtin command for managing rulebooks. See Integration architecture for details.
Migrating from a legacy plugin identifier
The current plugin identifier iscc-safety-net@cc-marketplace everywhere it applies. Two identifiers from earlier releases still show up on existing machines:
You do not need to remove these by hand — run the normal install command for the agent and the migration happens as part of it. Do not use the legacy identifiers in new configuration.
Verify your installation
After installing, run the doctor command to confirm CC Safety Net is wired up correctly and blocking commands as expected:doctor runs a full health check across every supported agent — hook integration, a self-test that confirms blocking works, custom-rule validation, active mode flags, recent activity, system versions, and an update check. See the doctor command reference for what each check does and the flags available.
If any check fails, the output includes a description of the problem and suggested fixes.