Hunt through scattered files
agent.yamltools.json.claude/settings.json.mcp.jsonIAM roleenvironmentAPI docs
Reviewers chase access across systems and can still miss what the agent is able to do through connected tools.
Pre-deployment security for AI agents
Approve what your agents are allowed to do. Before they do it.
ControlLoop builds an Agent Capability Bill of Materials, detects changes to tools and transitive permissions, and blocks dangerous capability expansion before deployment.
7 days free, then $199 a month. Cancel any time.
Not ready for Team? The ControlLoop CLI is free and open source. Get it on GitHub ↗
01Local-firstYour source stays in your environment.
02DeterministicThe same evidence produces the same verdict.
03CI-nativeDecide before capability reaches production.
By the numbers
What is already committed to public repositories.
From a census of 7,760 public GitHub repositories that commit coding-agent configuration, analyzed with the free ControlLoop CLI. Read the research →
14%of Claude Code setups allow Bash(*)
What it meansA committed settings file lets the agent run any shell command without asking anyone.
Why it is badOne prompt injection or one bad suggestion becomes an arbitrary command on every machine that opens the repo.
8%run a SessionStart hookWhat it meansA hook in the repo runs a command the moment someone starts a session, before any prompt is typed.
Why it is badIt is the same shape as a credential harvester disguised as setup, and it runs for every developer who clones the repo.
91%of package-launched MCP servers are unpinnedWhat it meansThe server starts with npx -y and no version, so the agent runs whatever the registry serves next.
Why it is badA compromised release lands silently; postmark-mcp shipped a backdoor in version 1.0.16 after fifteen clean ones.
2%commit a credential in agent configWhat it meansAn API key or token sits in plain text in the files that configure the agent.
Why it is badAnyone who can read the repo, including the agent, can use it. It belongs in a secret store and needs rotating now.
00 The verdict
One pull request. One clear decision.
Every gate result names the effective capability path, what changed, the policy that fired, and the evidence file behind it. Blocked means blocked, with the reason attached.
Capability reviewPR #184 · refund-agent
Capabilities37
Changes4
Critical1
Effective capability path
Agentrefund-agent
→Toolpayments-api
→Actionrefund:write
+toolissue_refundAdded
+resourcepayments/*Added
~identitypayments-roleChanged
Policyproduction-no-new-writeCritical
ControlLoop gateDeployment blocked
EXIT 1Evidence generated
evidence.jsonThe inventory behind feature 03ACBOM
Agent Capability Bill of Materials
A clear inventory of every tool, identity, resource, action, and delegated agent your agent can reach.
Agent→Tool→Identity→Action
01 The control gap
A small agent change can quietly unlock a lot more. ControlLoop shows you exactly what changed.
An agent's access can come from many places: tools, identity and permission settings, API configuration, other agents, environment metadata, and the agent's own configuration: hooks, MCP servers, plugins, permission rules. A pull request that looks small can give it powerful new abilities.
ControlLoop brings those pieces together and explains, in plain language, what the agent gained access to before anyone approves the change.
See the complete access picture
The Agent Capability Bill of Materials shows what the agent can reach, what changed, and whether that change should ship.
02 The product
Three things ControlLoop does.
ControlLoop turns what your agents and repositories can do into evidence your team can understand, review, and govern, in the workflow developers already use.
What an agent may do, approved in the pull request.
Permission rules, approval modes, hooks, MCP servers, skills, plugins, and agent workflows are read from the files you commit and compared with the baseline you approved. When authority grows past it, the build fails, and the verdict says in one sentence what the agent can now do.
What a clone installs and runs, caught before merge.
ControlLoop reviews the files that silently install tools and run scripts every time a repo is opened or committed to, and flags any new, changed, or unpinned entry in the pull request. A poisoned install is caught by one reviewer before it merges, instead of running on every developer's laptop and CI runner.
What exists across every repository, with proof.
One Agent Capability Bill of Materials per repository, the fleet view across your organization, and evidence packs an auditor accepts: the inventory, every change, who approved it, and the policy in force.
03 Use cases
What ControlLoop catches.
Seven ways a pull request quietly expands what your AI agents and development environments can do, each with the rule that reports it and a deterministic verdict before merge.
Catch the pull request that hands an agent your whole shell
A one-line settings change lets an agent run any command without asking. See it before it merges.
See how ControlLoop catches itStop a committed hook before it runs on every laptop
A new SessionStart hook runs on every machine that opens the repo. Review the command before it does.
See how ControlLoop catches itCatch an MCP server that changes behind the same name
postmark-mcp was clean for 15 releases, then it wasn't. Catch the version change before it ships.
See how ControlLoop catches itFind the agent that can read your data, take orders from strangers, and send it out
Sensitive data, untrusted input, and an outbound channel in one agent is a leak waiting for a prompt.
See how ControlLoop catches itKeep AI agents in CI from holding write tokens with no brakes
An agent triggered by any issue comment, holding a write token, takes orders from the public.
See how ControlLoop catches itShow your auditor what every agent could do, and who approved it
Every verdict, exception, and approver for an audit window, mapped to SOC 2 and ISO/IEC 42001.
See how ControlLoop catches itReview what a clone installs and runs before it merges
One line in devcontainer.json installs an extension and runs a command on every clone. Review it before it merges.
See how ControlLoop catches it
04 Inside your agent
Your coding agent runs the review. Before you commit.
Install the free ControlLoop plugin in Claude Code, Codex, Gemini CLI, Cursor, or GitHub Copilot, or add the local MCP server to any other host. The agent checks every change to tools, hooks, MCP servers, and permissions, explains what it found, and drafts the fix. Open source, read-only, and nothing leaves your machine.
- PluginClaude CodeAdd the ControlLoop marketplace, install the plugin, and run /controlloop:review on your branch.
- PluginCodexReview approval_policy, sandbox_mode, and MCP changes from the Codex CLI, the app, or the IDE extension.
- ExtensionGemini CLIOne command installs the extension from GitHub. The extensions gallery lists it once it is released.
- PluginCursorDownload the latest release into Cursor's local plugins folder and ask the agent to review a Cursor MCP or hook change before you commit it.
- PluginGitHub CopilotCopilot CLI, VS Code, or the Copilot app: review the GitHub workflows that run an agent in your CI.
- MCP serverAny MCP hostKiro, Windsurf, Roo Code, Cline, Continue, opencode: add the local controlloop mcp server and call the CLI as tools.
05 The workflow
From git push to a clear decision.
No cloud upload is required for scanning. No probabilistic model decides whether the build passes. Explicit capability evidence is evaluated against explicit policy.
CLI · Local Ready
$ controlloop gate . --baseline baseline.json --no-network✓ discovered 14 tools
✓ resolved 37 capabilities
× 1 forbidden expansion
- 01DiscoverScan
Parse agent definitions, tool contracts, identities, delegation, and agent host configuration.
- 02NormalizeMap
Build a canonical Agent Capability Bill of Materials.
- 03CompareDiff
Calculate effective authority against the trusted baseline.
- 04EnforceGate
Pass, warn, require review, or block with evidence.
06 Standards-aware
Works with the way your agents are built.
ControlLoop reads common agent, API, and identity definitions, then brings them into one clear access map. Custom formats can plug into the same model.
Agent → Tool → Identity → ActionOne clear agent access map
01MCP02A2A03OpenAPI04OASF05IAM06Custom manifests07Claude Code08Codex09Cursor10Gemini CLI11Kiro12Cline13Roo14Agent workflows
07 Pricing
Free to inspect. Paid to enforce together.
The local CLI earns trust. The Team tier turns that trust into a shared control point across private repositories. Enterprise runs it wherever your code lives.
CommunityFor individual builders
$0forever
Understand what an agent can do on your own machine.
- ✓Local-first CLI scanning
Agent authority gate
- ✓Baseline policy checks
- ✓Plain-language authority statement on every pull request
- ✓Public repository CI
Clone-time protection
- ✓New, changed, and unpinned entries in devcontainers, pre-commit hooks, and editor startup files
Fleet inventory and evidence
- ✓Capability BOM generation
- ✓JSON and SARIF output
7-day free trial
TeamFor security and engineering teams
$199/ month
Govern capability changes in private CI workflows.
- ✓Connects GitHub, GitLab, Bitbucket, and Azure DevOps
- ✓Hosted scans, or run the gate in your own CI
- ✓MCP server and chat interface: ask Claude, ChatGPT, or Cursor about your fleet, findings, and gates
Agent authority gate
- ✓Private repository CI gates
- ✓Inline pull-request findings
- ✓Shared policy bundles
- ✓Approved-components list with a review queue
- ✓Exceptions and attestations
Fleet inventory and evidence
- ✓Fleet view of every AI your repositories run
- ✓Capability history and evidence
EnterpriseFor organizations with their own requirements
Customper organization
Run ControlLoop on premises or in your own cloud, beyond the Team limits.
- ✓Everything in Team, including the MCP server and chat interface
- ✓Deploy on premises or in your own cloud
- ✓Repository and contributor limits set for your organization
- ✓SSO and SCIM
- ✓Advanced access controls
Agent authority gate
- ✓Custom rule authoring and policy distribution
Fleet inventory and evidence
- ✓Compliance evidence exports
- ✓Organization-wide agent inventory
08 Questions
Clear answers.
What does “agent” mean here?+
A deployable software identity that can choose and invoke tools to pursue a goal. You point ControlLoop at its manifest, tool definitions, identity and permission metadata, policies, and related configuration—not a human job title.
Which platforms does ControlLoop support?+
Source control: GitHub, GitLab.com, Bitbucket Cloud, and Azure DevOps Services. Self-hosted editions (GitHub Enterprise Server, GitLab Self-Managed, Bitbucket Data Center, and Azure DevOps Server) aren't supported yet. Azure DevOps sign-in uses a Microsoft work or school account; organizations owned by a personal Microsoft account aren't supported, and your Microsoft admin may need to approve ControlLoop once. To scan in your own pipeline, the ControlLoop CLI runs on macOS and Linux, with a GitHub Action and a pre-commit hook. A push to a repository's default branch starts a scan: straight away on GitHub, and within a few minutes on GitLab, Bitbucket, and Azure DevOps. Every connected repository is also rescanned at least daily, and whenever you choose Scan now.
Does my source code leave my environment?+
Only if you choose hosted scanning, and even then ControlLoop doesn't keep a copy. You can run ControlLoop entirely on your own machines: the CLI, GitHub Action, and pre-commit hook scan your repository locally or on your CI runner, and the scan itself needs no network connection. With Team, the gate then sends ControlLoop a summary of the scan, not your code: component names and types, capability findings, rule IDs, file paths with line numbers, and the commit. ControlLoop's service rejects any upload that contains source code, secret-shaped values, environment variables, or prompt text. If you connect a repository for hosted scanning, ControlLoop makes a temporary copy inside a short-lived, isolated scan task, keeps only that same summary, and deletes the copy when the scan ends. ControlLoop's access to your code is read-only, so it never changes your code. Each scan task can reach only your git provider and ControlLoop, and nothing else on the internet. Disconnecting a provider in Settings deletes the access ControlLoop stored for it. If you'd rather your code is never copied, run the scan in your own CI instead.
Is this a runtime firewall?+
No. Runtime controls react while an agent is operating. ControlLoop is a pre-deployment control that detects and stops dangerous capability expansion before new configuration ships.
Is the gate powered by an LLM?+
No. Policy outcomes are deterministic and auditable. The same capability evidence and policy produce the same verdict.
Does it cover the coding agent itself, or only the agents I build?+
Both. ControlLoop reads the configuration of the coding agent in your repository: its hooks, MCP servers, plugins, marketplaces, skills, subagents, permission rules, and the CI workflows that run it. A pull request that changes any of those gets the same diff, statement, and gate. On Team, each grant is also checked against your organization's approved-components list, and one that is not on it is marked Review required until someone approves it.
The standard for agent capability approval
Ship agents with proof.Not hope.
Try ControlLoop Team free for 7 days. Then $199 a month for your organization, and cancel any time.
Start free trial