Prevent · Agent Hooks

Automated security guidance and enforcement for coding agents.

Heeler automatically supplies coding agents with applicable standards, repository guardrails and sensitive-data requirements, including PII. It checks supported actions during development and evaluates the resulting changes against PR guardrails.

Your standards → this repositoryShared guardrails
ASVS · DORA · CRAAdopt standards and apply their enforceable controls.
acme/payments-apiResolve applicable requirements and scoped guardrails.
Inside the coding agentGuidance before coding. Checks before supported actions.
ruleOn the pull request · evaluate the change against applicable guardrails.
Managed in Heeler

Centrally managed standards, data requirements and guardrails.

Your organization establishes standards and scoped guardrails in Heeler. Heeler automatically resolves the requirements for each repository and its applications, including relevant PII and payment-data classifications.

CENTRAL REQUIREMENTS → REPOSITORY REQUIREMENTS
Security standardsASVS · DORA · CRA
Data classificationsPII · payment data
↓
Repository requirementsApplicable coding guidance and scoped guardrails
↓
Coding agentAutomatic guidance and supported checks
Pull requestGuardrail evaluation of the change
Before coding

Heeler automatically supplies standards and sensitive-data requirements.

The agent receives the requirements that apply to its repository without developers assembling instructions. Supported prompt hooks select guidance for the task, including input handling, secrets, dependencies and configuration.

EXAMPLE GUIDANCE · APPLICATION HANDLES PII
STANDARDSValidate inputs at trust boundaries
PIIKeep personal data out of logs and error messages
PAYMENT DATAUse tokens; never store card verification codes
REPOSITORY GUARDRAILSAvoid changes that violate applicable controls
During development

Heeler checks agent actions automatically and blocks supported violations.

Hooks check proposed changes and commands as the agent works. Findings return directly to the agent with the reason, so it can correct the change before PR review.

AUTOMATIC CHECKS AT THE POINT OF ACTION
editDependency changesVulnerabilities, malware, licenses, release age and repository guardrails.
Supported violations can block
terminalShell commandsConfigured restrictions on commands such as force-push or download-and-execute.
Matching commands can block
keyCredentials at commit and pushProvider-verified live secrets, with exceptions applied from Heeler.
Live-secret blocking when enabled
ruleCode before pushFindings from committed changes returned to the agent before review.
Feedback · PR guardrails enforce
Checks follow their configured enforcement behavior. Local command restrictions supplement centrally scoped repository guardrails. An unavailable check does not establish that a change passed.
On the pull request

Heeler evaluates the change against the same repository guardrails.

The requirements supplied to the agent remain connected to the controls used at review. Heeler evaluates applicable PR guardrails and returns Observe, Warn or Block results. Agent guidance is not a substitute for this evaluation.

SHARED GUARDRAILS · TWO POINTS IN DEVELOPMENT
INSIDE THE AGENTRequirements supplied automaticallySupported violations caught during development
↓
ON THE PULL REQUESTProposed change evaluatedObserve · Warn · Block
Standards bundles create the enforceable controls. Other requirements provide guidance or require additional evidence.
Agent coverage

Consistent security requirements across 15 coding agents.

Heeler resolves the repository’s requirements across the supported tools developers use, on Windows, macOS and Linux.

SUPPORTED CODING AGENTSNotify · Block
Claude Code
Codex CLI
GitHub Copilot CLI
Cursor
Gemini CLI
Cline
Augment Auggie
Kiro
Factory Droid
JetBrains Junie CLI
Antigravity CLI
Devin CLI / Local
Amp
OpenCode
goose
Deployment

The CLI connects coding agents to Heeler’s guidance and checks.

Install the integration for the coding agent and verify it with doctor. Requirements remain managed in Heeler; hook installation connects the agent to guidance and supported action checks.

CLAUDE CODE · INSTALLATION EXAMPLE
heelercli login
heelercli hook claude install
heelercli hook claude doctor
Restart the agent after installation. Deployment options determine which checks run and whether supported failures deny actions.

Agent enforcement and session investigation.

Hooks automatically supply requirements and check supported actions. The Workstation Sensor records session activity for investigation.