ControlLoopStart free trial

Your coding agent runs the review for you

Install the free ControlLoop plugin once. Claude Code, Codex, Gemini CLI, Cursor, or GitHub Copilot then checks every change to tools, hooks, MCP servers, and permissions, and to the files that install tools on clone, open, and commit, explains what it found, and drafts the fix. Open source, read-only, and nothing leaves your machine.

Star the plugins on GitHub Get the CLI

The plugins run ControlLoop’s Agent authority gate locally, with the CLI on your machine. One shared skill, one public repository, one plugin per host. Join the Discord to hear when each one ships.

Three steps

  1. 01

    Install once

    One command per host, below. A plugin ships one skill and, where the host supports it, one slash command. No hooks, nothing on session start.

  2. 02

    The agent runs the gate for you

    One slash command, or one sentence, and the agent runs controlloop gate on your branch with the CLI on your machine, against the baseline you approved.

  3. 03

    It explains, then drafts the fix

    You get the worst reachable capability, a plain-language statement of what each change grants, and every finding with its remediation. Say yes, and the agent drafts the controlloop.yaml change.

Pick your host

  • PluginAvailable

    Claude Code

    Add the ControlLoop marketplace, install the plugin, and run /controlloop:review on your branch.

    In Claude Code
    /plugin marketplace add controlloop-security/controlloop-plugins
/plugin install controlloop@controlloop
    To run it
    /controlloop:review runs the gate on your branch. Or tell Claude to review the branch with ControlLoop.
    What it reads
    .claude/settings.json permissions and hooks, skills, subagents, plugins and marketplaces, and .mcp.json.
    Listed in
    Anthropic's official plugin directory, after its review. Our own marketplace works before that.

    Source on GitHub

  • PluginAvailable

    Codex

    Review approval_policy, sandbox_mode, and MCP changes from the Codex CLI, the app, or the IDE extension.

    Terminal
    codex plugin marketplace add controlloop-security/controlloop-plugins
codex plugin add controlloop@controlloop
    To run it
    Tell Codex to review the branch with ControlLoop. It runs the gate and explains every finding.
    What it reads
    .codex/config.toml: approval_policy, sandbox_mode, and MCP servers.
    Listed in
    The Codex Plugin Directory, once third-party submissions open. Our own marketplace works before that.

    Source on GitHub

  • ExtensionAvailable

    Gemini CLI

    One command installs the extension from GitHub. The extensions gallery lists it once it is released.

    Terminal
    gemini extensions install https://github.com/controlloop-security/controlloop-plugins
    To run it
    Tell Gemini to review the branch with ControlLoop. It runs the gate and explains every finding.
    What it reads
    .gemini/settings.json, installed extensions, and the MCP servers they declare.
    Listed in
    The Gemini CLI extensions gallery, which crawls GitHub daily.

    Source on GitHub

  • PluginAvailable

    Cursor

    Download the latest release into Cursor's local plugins folder and ask the agent to review a Cursor MCP or hook change before you commit it.

    Terminal
    mkdir -p ~/.cursor/plugins/local/controlloop && curl -fsSL https://github.com/controlloop-security/controlloop-plugins/releases/latest/download/controlloop-plugin.tar.gz | tar -xz -C ~/.cursor/plugins/local/controlloop
# Then run Developer: Reload Window in Cursor.
    To run it
    Tell the Cursor agent to review the branch with ControlLoop. It runs the gate and explains every finding.
    What it reads
    .cursor/mcp.json and Cursor hooks.
    Listed in
    The Cursor Marketplace, submitted through the Cursor team. Team admins can import the repository before that.

    Source on GitHub

  • PluginAvailable

    GitHub Copilot

    Copilot CLI, VS Code, or the Copilot app: review the GitHub workflows that run an agent in your CI.

    Terminal
    copilot plugin marketplace add controlloop-security/controlloop-plugins
copilot plugin install controlloop@controlloop
    To run it
    Tell Copilot to review the branch with ControlLoop. It runs the gate and explains every finding.
    What it reads
    The GitHub workflows that run an agent, their triggers and token permissions, and every MCP declaration in the repository.
    Listed in
    awesome-copilot, a marketplace Copilot CLI includes by default. Our own marketplace works before that.

    Source on GitHub

  • MCP serverAvailable

    Any MCP host

    Kiro, Windsurf, Roo Code, Cline, Continue, opencode: add the local controlloop mcp server and call the CLI as tools.

    Your host's MCP configuration
    {
  "mcpServers": {
    "controlloop": { "command": "uvx", "args": ["controlloop@latest", "mcp"] }
  }
}
    To run it
    The host calls the gate, diff, bom, and rules tools itself. Tell it to review the workspace with ControlLoop.
    What it reads
    Only the workspace your host passes. Tools: bom, diff, gate, and rules, each returning the CLI's JSON.
    Listed in
    Ships inside the free CLI, so it installs with the CLI from PyPI. The hosted Team MCP server at app.controlloop.ai is separate.

    Source on GitHub

What every plugin will and won’t do

Read-only

The plugin never edits your agent's configuration on its own. It reports, explains, and drafts a controlloop.yaml change only when you ask for one.

Local

The CLI reads committed files on your machine and runs with the network off. Nothing is sent anywhere, and the plugin adds no telemetry.

No hooks, nothing on session start

A security tool that installs a SessionStart hook is the exact pattern ControlLoop flags in other repositories. The plugin ships none.

Never installs the CLI silently

It uses the controlloop command on your PATH, then uvx, and otherwise shows you the install options and stops.

Open source

Every host's plugin lives in one public repository around one shared skill, and the CLI it runs is Apache-2.0.

Deterministic

Same files, same baseline, same verdict. No model decides whether a change is safe; the CLI's policy rules and your capability ceiling do.

Questions

Does the plugin install anything?

No. It uses the controlloop command already on your PATH. If there is none, it tries uvx controlloop, and otherwise it shows the install options and stops. It never installs the CLI without you.

Does anything leave my machine?

No. The scan reads committed files and runs with the network off, and the plugin adds no telemetry. If you later set a Team token, the gate sends ControlLoop a summary of findings and never your source.

Is this the hosted MCP server?

No. controlloop mcp is a local, read-only server that ships with the free CLI and reads only the workspace your host passes. The hosted MCP server at app.controlloop.ai is part of Team and runs as a signed-in user.

What does Team add inside the plugin?

With a Team token set, the same plugin checks components against your organization's approved list, queries the fleet, and pulls evidence reports. Without it, everything on this page works and stays free.

Which files does it review?

Everything the CLI reads: the project configuration of Claude Code, Codex, Gemini CLI, Cursor, and Kiro; MCP declarations from VS Code, Roo Code, Cline, Continue, Windsurf, and opencode; A2A agent cards, OpenAPI documents, AWS IAM policies, GitHub workflows that run an agent, and CrewAI, LangGraph, and OpenAI Agents SDK code, parsed and never imported. It also reads the files that install tools on clone, open, and commit: dev container extensions, features, and lifecycle commands, VS Code extension recommendations, pre-commit hooks, editor startup files, and JetBrains required plugins.

Go deeper

Read the guides on Claude Code hooks and permissions and MCP server security, or see what ControlLoop catches before it ships.