sondera-ai/sondera-coding-agent-hooks: Cedar Policy Language + Rust Reference Monitor Blocks Malicious Coding Agent Actions Before Execution

GitHub·medium signalXBlueskyLinkedInCopy link

Sondera Coding Agent Hooks intercepts every shell command, file operation, and web request made by coding agents (Claude Code, Cursor, Copilot CLI, Gemini CLI) and evaluates them against Cedar policies before execution — acting as a formal reference monitor. Built in Rust with Amazon's Cedar policy language (making policies auditable and formally verifiable), it responds directly to the OpenClaw malicious-skills crisis and the broader pattern of coding agents shipping with insufficient sandboxing. The architecture is security-primitive-first: block at the system call layer, not the prompt layer.