Install a connector

Before you start

• You need an approved evaluation or an order, which gives access to the signed release artifacts. Start with the evaluation application or contact us.
• Node.js 22.12.0 or newer on the machine, because the hooks run as Node.js scripts (Claude Code).
• Install only artifacts you received through the approved channel. Local source builds are for development and are not a customer installation.

Claude Code

Acceptance: Tested on one host version: Claude Code 2.1.296, linux/x64, development build, 2026-10-11. Other versions and platforms are unverified.

Interception: Pre-tool-call hook (PreToolUse), post-tool-output inspection (PostToolUse) and a session-start plugin scan.

Sees: Tool calls that Claude Code routes through its hook system, such as shell commands, file writes and web fetches.

Install

Signed plugin archive from an approved release, added with /plugin marketplace add and /plugin install.

/plugin marketplace add /absolute/path/to/extracted/aidr-claude-plugin
/plugin install aidr@aidr

Known limits

• A disabled hook fails open on the host side.
• Actions that never pass through the host hook (a separate shell, direct network access) are not seen.
• Hook timeouts can let the host continue; behaviour must be verified per host version.

Cursor

Acceptance: Preview: no real-host acceptance evidence yet.

Interception: Managed pre-tool-use hook installed by the extension.

Sees: Agent tool calls that Cursor routes through its hook system.

Install

Signed .vsix from an approved release, installed with Extensions > Install from VSIX.

Then run Singularity AIDR: Enable protection from the command palette to install the managed hooks.

Known limits

• The extension can be disabled by the operator.
• Commands run outside the extension host (an external terminal) are not seen.
• Cursor cannot enforce an approval prompt on preToolUse, so AIDR maps an approval-needed verdict to a block.

VS Code

Acceptance: Preview: no real-host acceptance evidence yet.

Interception: Managed agent hook installed by the extension.

Sees: Agent tool calls for VS Code Local agent hooks (requires the chat.useClaudeHooks setting).

Install

Signed .vsix from an approved release, installed with Extensions > Install from VSIX.

Then enable chat.useClaudeHooks in VS Code user settings and run Singularity AIDR: Enable protection from the command palette. The extension does not change that setting for you.

Known limits

• The extension can be disabled by the operator.
• Commands run outside the extension host are not seen.
• Enforcement across current VS Code minor versions is not yet verified on real hosts.

OpenClaw

Acceptance: Tested on one host version: OpenClaw 2026.9.6, linux/x64, development build, 2026-10-11. Other versions and platforms are unverified.

Interception: In-process plugin: before_tool_call, with post-execution output and reply inspection.

Sees: exec, web_fetch, write, edit, read and apply_patch tool calls.

Install

Approved signed version from the private registry, per the package installation guide.

Known limits

• If the plugin is removed, nothing is intercepted.
• Output inspection happens after execution and cannot undo a tool action.
• There is no in-session approval prompt; a blocked action stays blocked until an operator approves it out of band.

OpenCode

Acceptance: Tested on one host version: OpenCode 1.18.32, linux/x64, development build, 2026-10-11. Other versions and platforms are unverified.

Interception: Plugin hooks: tool.execute.before and tool.execute.after.

Sees: bash, webfetch, read, write, edit, apply_patch, ls, glob and grep. Unmapped tools pass through unchanged.

Install

Approved signed version from the private GitHub Packages registry, enabled in the OpenCode config.

// ~/.config/opencode/package.json
{ "dependencies": { "@singularityrd/aidr-opencode": "VERSION" } }

// ~/.config/opencode/opencode.json
{ "plugin": ["@singularityrd/aidr-opencode"] }

Known limits

• Provider streams and non-tool content are not inspected.
• There is no in-session approval prompt; a blocked action stays blocked until an operator approves it out of band.

Codex CLI

Acceptance: Tested on one host version: codex-cli 0.141.0, linux/x64, development build, 2026-10-11. Other versions and platforms are unverified.

Interception: Native PreToolUse command hook, with an optional UserPromptSubmit prompt check.

Sees: Bash, apply_patch and MCP (mcp__*) tool calls matched by the packaged hook matcher. Other local function tools do not invoke the hook.

Install

Approved signed version of the Codex package from the private registry, with the hooks registered in the Codex configuration and trusted in Codex /hooks.

npm install --global @singularityrd/aidr-codex@VERSION

# ~/.codex/config.toml
[[hooks.PreToolUse]]
matcher = "^(Bash|apply_patch|mcp__.+)$"

[[hooks.PreToolUse.hooks]]
type = "command"
command = "aidr-codex-hook"
timeout = 10

Known limits

• If the hook is disabled, untrusted, crashes or times out, Codex runs the call (the host fails open).
• No tool-output inspection before the model is claimed for this host.
• Hosted and specialised tool paths may bypass the host hook path.

Verify the install

Use the safe deny canary from the first-customer acceptance procedure that comes with the evaluation. It checks that a block is applied by the host without running a live payload. Please do not run a real payload as an install test. Also test what happens when the hook is disabled, crashes or times out, because those cases differ by host and version.

Registration of a hook is not proof that the host runs it. Setup output that says protection is "not yet active" should be taken at face value.

Reduce outbound traffic

For a fully local evaluation, turn the optional outbound legs off in ~/.singularity-aidr/config.json:

{
  "url_check": { "enabled": false },
  "file_check": { "enabled": false },
  "package_check": { "enabled": false },
  "version_check": { "enabled": false },
  "control_plane": {
    "enabled": false,
    "send_audit_logs": false
  }
}

Leave browser and runtime diagnostics unset as well. Confirm the effective configuration and your network policy in your own environment.

Uninstall

Use the extension uninstall for Cursor and VS Code, remove the plugin for Claude Code, OpenClaw and OpenCode, or run the CLI uninstall command where the CLI was used. Questions: support.