Docs

Claude Code

Anthropic's terminal AI tool. Fully covered. On a whole-machine install, the developer can't disconnect it.

What ZYBE can do

Everything. Every rule that can be set to Block holds on Claude Code: commands, file reads and writes, web fetches, MCP calls, skills, package installs, and action after prompt injection. Ask works too: Claude Code pauses and shows the developer ZYBE's reason.

With Cover the conversation on and an Anthropic API key as its sign-in, Claude Code also sends its requests to the model through ZYBE on the laptop, so a pasted key is stopped before it leaves and injected text in a tool result is caught as it goes to the model.

What you do

Install the sensor. Nothing else. ZYBE connects itself to Claude Code's built-in "check before acting" step.

If Claude Code was open when you installed, restart it. A session that was already running doesn't pick up ZYBE.

Check it's working

1. Open Claude Code and ask it to run any command, say ls.
2. In the console, open the laptop from Inventory, Endpoints, click Sensor. Claude Code shows Blocking.
3. Set Agent read a credential file to Block on the Rules page and ask Claude Code to read ~/.aws/credentials. It stops and shows the reason.

What the developer sees when blocked

Blocked by your organisation's rule "Agent read a credential file" (ZYBE).

Claude Code stops, explains to the developer that it was refused, and doesn't try another way. A link lets the developer ask for an exception.

Standing permissions

Claude Code asks before it acts until a developer grants it a standing permission, like "always allow git push". ZYBE lists every such permission on the Permissions tab of the agent in the console. A detection profile can name permissions no AI tool may hold, and the laptop removes them. See the Standing permissions no agent may hold box when you expand a detection profile.

For IT: where ZYBE's connection lives