hook is the command your agent calls before it runs a tool. It reads the agent’s hook input as JSON from stdin and, to block the call, answers in that agent’s deny format. Your agent’s plugin or config sets it up, so you do not normally run it by hand.
For example, install --cursor writes this command into Cursor’s hook config, and Cursor runs it for every tool call:
hook integration flags
hook requires exactly one integration flag, which names the agent. With no flag or more than one, it prints hook requires exactly one integration flag. Try: cc-safety-net hook --kimi-code, shows the command help, and exits 1.
Each agent’s page describes what its hook checks and what happens when the check fails. In Claude Code, the hook can ask you instead of blocking. See When Claude Code asks you instead of blocking.
Agents without a hook flag
Amp Code, DeepSeek Harness, OpenClaw, OpenCode, and Pi have nohook flag. They load CC Safety Net inside their own process, as a plugin or extension. See Integration models.