Codex
Tool checks, sandbox permission requests, and observed results.
Connect Codex ↗A firewall for coding agents
Let your agent work.
Keep your
boundaries.
Keep medical information out of your company Slack. When your agent tries to post the contents of a medical document, Fronteira checks the message against your rule before it’s sent.
Native hooks first. MCP proxy when you need it.
FRONTEIRA / SESSION TRACEIllustrative example
Codexsession / 8f2a
- 01Read a medical documentRead
medical-report.txtThe agent prepares to share its contents.
- 02Try to post it to company SlackBefore send
#general · Company workspace
YOUR BOUNDARY
Rule behind this decision
Block messages containing medical information in our company Slack.
deny call "mcp__company_slack__slack_send_message" when
llm_classified(args.text, "medical")Medical content detected.
Jev or an LLM classifies the outgoing text.
The message never reaches #general.
Why this action was blocked
Jev or an LLM classifies the proposed Slack message as medical. This rule blocks the send before the message reaches #general.
Matched rule Keep medical information out of Slackdeny call "mcp__company_slack__slack_send_message" when
llm_classified(args.text, "medical")Sends the outgoing text to the configured classifier; it does not open attached documents.
BUILT FOR THE WAY AGENTS WORKShell commandsFile operationsPermission requestsMCP tools
01 / Connect at the boundary
Two paths.
Your rules in both.
Check supported actions at the agent’s boundary with native hooks, or route MCP tool calls through Fronteira’s proxy. Here’s where each policy check happens.
01 / Check at the boundary
Recommended
Egress through native hooks
Check a supported outbound action before your agent runs it.
Your workspace
Coding agent
Codex, Cursor, or Claude Code
Sandbox stays enabled
Client enforcementNative hookTool or permission check
Policy check at the native hookArguments ↓↑ Decision
Policy checkFronteiraYour rules + session history
Direct executionExternal serviceThe agent’s tool sends the requestSlack · GitHub · other services
Denied → client stops the actionOtherwise, the client applies its own permissions.
The hook sends tool arguments to Fronteira and receives a decision. The client executes the action. Hooks cover reported operations; they do not intercept every network request.
Set up native hooks02 / Check along the route
Backup integration
Tool calls through the MCP proxy
Route MCP tools through Fronteira when native hooks aren’t available.
Your clientMCP clientConnected to your Fronteira endpoint
Proxy enforcementFronteira MCP proxyYour rules + session historyChecks before forwarding
Upstream toolsMCP serversRun the requested tool and return its resultSlack · GitHub · Gmail
Denied → proxy stops the callA permitted call is forwarded; its result returns through the proxy.
Fronteira sits in the tool-call path. Only MCP traffic routed through this endpoint is checked; local shell and file operations stay outside the proxy.
Set up the MCP proxyOne rule engine. One place to review decisions.
See the traces
Both integrations appear in Session traces, with their client and matching rule. Hook sessions and MCP connections keep separate histories.
Cursor
Tool checks, shell boundaries, and success or failure events.
Connect Cursor ↗Claude Code
Tool checks, permission requests, and success or failure events.
Connect Claude Code ↗Coverage follows each client’s hook support. Keep native sandbox controls enabled. Setup & compatibility →
02 / Make the rules yours
Five everyday tasks.
Five clear boundaries.
See what a policy can stop. Hover over, focus, or tap Blocked to see the reason and the exact rule behind each decision.
Outgoing content
Why this action was blocked
Jev or an LLM classifies the proposed Slack message as medical. This rule blocks the send before the message reaches #general.
Matched rule Keep medical information out of Slackdeny call "mcp__company_slack__slack_send_message" when
llm_classified(args.text, "medical")Sends the outgoing text to the configured classifier; it does not open attached documents.
A medical report sent to company Slack
The agent puts a patient’s diagnosis and treatment notes into a Slack message.
Proposed action
Post medical-report.txt contents to #general Sensitive text
Why this action was blocked
The issue body contains “-----BEGIN OPENSSH PRIVATE KEY-----”. This rule blocks the issue from being created with that text.
Matched rule Keep OpenSSH private keys out of issuesdeny call "mcp__github__create_issue" when
args.body contains "-----BEGIN OPENSSH PRIVATE KEY-----"Matches this header in the issue body; other secret formats need their own conditions.
A private key pasted into a GitHub issue
Along with the logs, the proposed issue body includes an OpenSSH private-key header.
Proposed action
Create an issue with copied debug output File access
Why this action was blocked
The requested file path contains “/.env”. This rule denies the Read operation before the file contents are returned.
Matched rule Restrict direct reads of environment filesdeny call "claude__Read" when
args.file_path contains "/.env"Checks the reported path for this file tool; shell reads need separate controls.
A production environment file opened by the agent
Claude Code tries to read an environment file while investigating a configuration problem.
Proposed action
Read /workspace/.env.production Sandbox boundary
Why this action was blocked
This is a shell permission request and its command contains “deploy --production”. Both conditions match, so Fronteira denies the request.
Matched rule Deny this production-deploy permission requestdeny call "codex__Bash" when
args._fronteira.phase is "permission" and
args.command contains "deploy --production"Checks the reported permission event and command text; it does not identify every way to deploy.
A production deployment asking for permission
Codex requests shell permission to run a command containing the production-deploy flag.
Proposed action
Request permission for deploy --production Session history
Why this action was blocked
An earlier observed Read operation in this same session used a path containing “/private/”. This rule blocks subsequent Slack sends, whatever their message text.
Matched rule Stop Slack sends after a private-file readdeny call "mcp__company_slack__slack_send_message" when
after call "claude__Read"
where args.file_path contains "/private/"
within sessionUses observed tool history and paths; it does not classify the file’s contents.
A Slack message after reading a private brief
Claude Code has read a file in /private/ during this session. The next proposed action is a Slack send.
Proposed action
Read /workspace/private/brief.txt → send to Slack03 / See what happened
See why it stopped.
And what went through.
See which agent tried to post the medical information and which rule blocked it. Review policy checks and observed outcomes across native hooks and the MCP proxy in one place.
Explore session traces →Session tracesIllustrative example
Medical report → #generalCodex · Native hooks
Why this action was blocked
Jev or an LLM classifies the proposed Slack message as medical. This rule blocks the send before the message reaches #general.
Matched rule Keep medical information out of Slackdeny call "mcp__company_slack__slack_send_message" when
llm_classified(args.text, "medical")Sends the outgoing text to the configured classifier; it does not open attached documents.
Team update → #generalCursor · Native hooks
SucceededProject notes → #teamCodex · MCP proxy
CompletedThe backup route
Still need an MCP proxy? It’s here.
Connect upstream MCP servers through one endpoint. Use the same rule engine and trace browser when native hooks aren’t available. The proxy checks only traffic routed through it.
A little more freedom. A clear boundary.
Put your rules
into practice.
Get started Connect an agent. Define a rule. Follow the trace.