---
id: agentic-code-security
track: coding
version: 0.4.1
label: blocks
keyword: block
where: write turn-end
sha256: 249aae76cd38a0e8cc7a896074bd684a224c9c4ea66f8552deb842d06c89c9e1
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/agentic-code-security
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Agentic Code Security

agentic-code-security · version 0.4.1

Blocks — Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. 

In a git repo: at commit (Chock refuses the commit, locally and in CI.)



## What it does

Trigger: writing agent code or agent config -- Python or TypeScript using AutoGen, CrewAI, LangChain, LangGraph, mem0, the OpenAI Agents or Claude Agent SDK, an MCP server or client (.mcp.json, .cursor/mcp.json, .vscode/mcp.json, claude_desktop_config.json, .codex/config.toml, .gemini/settings.json), docker-compose files for agents. avoid: code execution on the host, unpinned MCP servers and models, shell-reaching tools, approvals switched off, whole-environment and credential-store leaks, TLS verification off, unbounded loops, SQL and eval built from strings, stripped provenance markers. 29 rules in 10 packs -- exec, supply, tools, approval, identity, comms, bounds, prompt-memory, code, provenance -- each pack or rule allow|deny in .chock/agentic-security.json; bounds, prompt-memory and one supply rule start as allow.

## Its label on each agent

- Claude Code (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=agentic-code-security
- Cursor (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=cursor&p=agentic-code-security
- Codex (tested): Blocks — Blocks on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=agentic-code-security
- GitHub Copilot (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=agentic-code-security
- Devin (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=agentic-code-security
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=agentic-code-security
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=agentic-code-security
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=agentic-code-security
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=agentic-code-security
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=agentic-code-security
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=agentic-code-security

## What it misses

This policy does not state what it misses.

## Examples

- Refused: A file \`agents/proxy.py\` runs AutoGen code with use_docker False, judged at commit.
- Allowed: A file \`agents/proxy.py\` runs code in Docker, or not at all, judged at commit.

## Latest change

0.4.1 · 2026-10-26 — Lint, no behaviour change: the JSONC reader's line-end characters U+2028 and U+2029 are written as escapes (same value).

## Provenance

- Tested by 141 of 146 cases run automatically
- SHA-256: `249aae76cd38a0e8cc7a896074bd684a224c9c4ea66f8552deb842d06c89c9e1`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/agentic-code-security (catalog path `agentic-security/agentic-code-security`)
- Presets: none
- JSON: `/api/coding/policies/agentic-code-security.json`
- Report a problem: https://chock.sh/report/?policy=agentic-code-security&version=0.4.1&page=%2Fcoding%2Fpolicies%2Fagentic-code-security%2F