| name | tool-policy |
| description | Understand and modify this machine's cross-harness tool policy (rtk redirects, bash allow/deny, native Read blocking). Use when editing tool-policy.json, debugging hook failures, verifying policy across Claude/OpenCode/Cursor/Codex, or asking how tool-guard works. For vendor harness schema details, use ctx7 (find-docs skill) — do not guess hook JSON shapes. |
Tool Policy (machine-scratch)
Read order
- House policy (what THIS machine enforces):
docs/TOOL_POLICY.md
- Live JSON:
config/tool-policy.json
- Vendor schema (how each harness expresses hooks/perms): ctx7 — see below
Vendor docs via Context7
Do not duplicate upstream hook schemas in commits. Query live:
ctx7 docs /websites/developers_openai_codex "<hooks question>"
ctx7 docs /websites/cursor "<hooks or permissions question>"
ctx7 docs /anomalyco/opencode "<permission question>"
ctx7 docs /websites/code_claude "<PreToolUse question>"
Index of library IDs: docs/vendor/agent-harnesses/llms.txt
Common tasks
Agent vocabulary
- File/git ops: rtk only — never suggest raw
ls, cat, grep, find, git, gh.
- No
head/tail/less/more on rtk output; invalid rtk subcommands are denied in tool-guard.sh.
rtk tree requires GNU tree (brew install tree).
Verify policy after edits
bin/install-active-config.sh
rtk test bin/test-all-policy.sh
rtk test bin/verify-rtk-stack.sh
Restart Cursor IDE after hook changes.
Debug a deny that should allow (or vice versa)
rtk test bin/test-tool-guard.sh
echo '{"tool_name":"Bash","tool_input":{"command":"cat foo"}}' | bin/tool-guard.sh
echo '{"command":"cat foo"}' | bin/tool-guard-cursor.sh
echo '{"toolCall":{"name":"run_command","args":{"CommandLine":"cat foo"}}}' | bin/tool-guard-antigravity.sh
Add a new allowed bash command
- Add to
config/tool-policy.json → bash_allow
bin/install-active-config.shrtk test bin/test-all-policy.sh and rtk test bin/verify-rtk-stack.sh
Never hand-edit ~/.claude/settings.json permission arrays or ~/.cursor/cli-config.json.
Harness-specific notes
| Harness | Config path | Hook script |
|---|
| Claude | ~/.claude/settings.json | ~/bin/tool-guard.sh |
| Codex | ~/.codex/hooks.json | ~/bin/tool-guard.sh |
| Cursor | ~/.cursor/hooks.json + cli-config.json | ~/bin/tool-guard-cursor.sh |
| OpenCode | ~/.config/opencode/opencode.json + plugin | plugins/tool-guard/index.js |
Antigravity (agy) | ~/.gemini/config/hooks.json + ~/.gemini/antigravity-cli/settings.json | ~/bin/tool-guard-antigravity.sh |
Codex: PreToolUse matches Bash only (upstream limitation).
Cursor: restart IDE after install; uses v1 hooks schema.
Antigravity (agy)
Wired via named tool-guard block in ~/.gemini/config/hooks.json plus settings.json under
~/.gemini/antigravity-cli/ (toolPermission: request-review, permissions.allow as command(rtk) etc.
from bash_allow). Restart agy after bin/install-active-config.sh. Adapter maps run_command → Shell,
list_dir / read_file / view_file / find_by_name → List/Read/Glob denies. Verify:
rtk test bin/test-antigravity-hooks.sh. Live: rtk ls should not prompt; list_dir should deny.
