Enforcement

Everything else watches. ZYBE refuses the action before it runs.

A tool call an AI agent is about to make is judged on the endpoint, in the agent's own pre-action moment, against your rules. If a rule says no, the command never starts, the file never opens, the server never answers. The model is told why, and told not to try another way.

Twelve kinds of action are refused: contained servers, skills and packages; the command after a prompt injection; credential file reads; a credential used and then the network; destructive commands; remote scripts piped into a shell; writes to startup locations; elevated privileges; packages from a URL or below the fixed version; uploads to paste sites; safety controls turned off; and anything you name yourself.

It holds on Claude Code, Cursor, Codex CLI, VS Code with Copilot Chat, Copilot CLI, Gemini CLI, Windsurf and Claude Desktop, and for the MCP servers of Cline and Roo Code. The console says one of four words per agent per endpoint: Blocking, Recording, Seen or Not allowed.