Connect your agents

Coverage at a glance#

Pre-execution coverage for more agents, through their own hook systems, is first on the roadmap.

Claude Code#

The installer registers vardhold-hook as a PreToolUse hook in Claude Code's managed settings, which apply to every user and which user or project settings cannot remove. Before each tool call (shell commands, file reads and edits, web fetches and MCP tools) the hook asks the service and returns its verdict.

• Fast: the hook is compiled to native code and adds about 45 ms to a check.
• Fail closed: the hook is registered so that if it crashes, is missing or times out, Claude Code blocks the call (Claude Code 2.1.295 or later).
• Clear to the agent: a block comes back with the rule and the reason, so Claude can explain it and try another way.

Sessions that were open before the install pick up the hook when they restart. To install without it, use INSTALLCLAUDEHOOK=0.

Cursor#

The installer adds Vardhold to Cursor's enterprise hooks file, C:\ProgramData\Cursor\hooks.json, which only administrators can change. It checks:

• shell commands, before they run
• MCP tool calls, before they run
• file reads, before the agent reads the file
• file edits and deletes made by the agent

The hooks are registered to fail closed. Edits made by Tab completion, which a person accepts keystroke by keystroke, are not agent actions and are not checked. Restart Cursor once after installing. To install without the hooks, use INSTALLCURSORHOOK=0.

MCP servers#

MCP servers give agents tools: databases, browsers, ticketing systems, shells. Vardhold scans the configuration of every MCP client on the PC and lists each server on the dashboard's MCP servers page.

Protect a server#

1. Open the dashboard from the tray icon and go to MCP servers.
2. Turn on Protect for the server. Vardhold rewrites the client's configuration so the server starts behind vardhold-mcp-proxy, keeping a backup of the original.
3. Restart the MCP client.

From then on, every tools/call is checked against the policy before it reaches the server, including the paths, URLs and commands in the tool's arguments. A rule such as mcp-shell-tools can ask before any tool that runs shell commands. HTTP servers are routed through the service.

Stay protected#

Vardhold re-scans MCP configurations every minute. If a protected server stops being routed through Vardhold, for example because an agent edited the configuration, a high-severity alert is raised. A new server that is not protected raises a medium one, so nothing new appears unnoticed.

Every other agent#

Vardhold recognises agents from signatures (executable names, install locations and command lines) and attributes every process to the agent that started it, so a node or python process launched by an agent is counted as that agent's work.

A private Windows telemetry (ETW) session records the process starts, file writes, creates, deletes, renames and network connections of every agent process. These events are evaluated against the same policy. Because they are seen as they happen, a matching block rule raises an alert rather than preventing the action. You then respond with:

• Suspend, resume or end the agent's processes from the dashboard, the CLI or the kill switch.
• Block the agent's network access with Windows Defender Firewall rules, one visible rule group per agent.
• Automatic suspension on a detected block, an opt-in setting for headless agents (CLI agents and MCP servers). It never applies to desktop or IDE apps a person is using.

Response actions are aimed at agents only. System and security processes, shared runtimes such as node, python and browsers, and Vardhold itself are always refused.

Trust an agent#

On the Agents page each agent has a trust level:

Blocking an agent is open to anyone at the PC. Trusting one, or lifting a block, needs administrator confirmation.