Devin / Windsurf Integration
Install FireGuard hooks for Devin and Windsurf local agent events.
Use the Devin / Windsurf integration when you want FireGuard to check local coding-agent prompts, commands, MCP calls, file reads, and file writes.
Requirements
python3available onPATH.- A FireGuard API key.
- A FireGuard project ID with the policies and security guardrails you want to enforce.
Install
Install the Windsurf-compatible hooks:
curl -fsSL https://raw.githubusercontent.com/fireravenai/fireraven-agent-hooks/refs/heads/main/install.sh | sh -s -- --agent windsurfOr install from a local clone of github.com/fireravenai/fireraven-agent-hooks:
./fg install --agent windsurf
./fg init
./fg doctorConfigure
Edit config.env in ~/.codeium/windsurf/hooks/:
FIRERAVEN_GUARDRAILS_API_KEY=fg_...
FIRERAVEN_PROJECT_ID=00000000-0000-0000-0000-000000000000Optional overrides (installer defaults are normal / open if omitted):
FIRERAVEN_API_URL=https://api.fireraven.ai
# FIRERAVEN_EXECUTION_MODE=fast
FIRERAVEN_REQUEST_TIMEOUT_SEC=15
# FIRERAVEN_FAIL_MODE=closedRestart Devin Desktop or Windsurf after editing config.env.
FIRERAVEN_EXECUTION_MODE
| Value | Default | Use when |
|---|---|---|
normal | yes | Full sequential checks with complete policy and security details. |
fast | Lower latency. FireGuard runs eligible checks in parallel and returns as soon as a blocking result is known. |
See FireGuard concepts — Execution modes.
FIRERAVEN_FAIL_MODE
| Value | Default | Use when |
|---|---|---|
open | yes | Allow the action through on transient FireGuard API failures. Policy violations and missing credentials still block. |
closed | Block the agent action when FireGuard cannot be reached (network, timeout, or HTTP error). Use for strict production enforcement. |
The installer registers hooks in ~/.codeium/windsurf/hooks.json.
What Devin And Windsurf Check
Windsurf and Devin run the windsurf_guardrail.py entry script.
| Event | Mode | What FireGuard checks |
|---|---|---|
pre_user_prompt | Blocking | User prompts before the agent receives them. |
pre_run_command | Blocking | Shell commands and working directory context. |
pre_mcp_tool_use | Blocking | MCP server, tool name, and arguments. |
pre_write_code | Blocking | File path and proposed edits. |
pre_read_code | Blocking | File path and, for small files, a content preview. |
post_cascade_response | Audit | Agent response text after generation. |
post_write_code | Audit | Applied file-write content. |
Blocked pre-hook events exit with code 2. Audit events log unsafe output but do not block the already-completed action.
Windows
& ([scriptblock]::Create((irm https://raw.githubusercontent.com/fireravenai/fireraven-agent-hooks/refs/heads/main/install.ps1))) -Agent windsurfThe PowerShell installer writes:
| File | Purpose |
|---|---|
%USERPROFILE%\.codeium\windsurf\hooks.json | Devin/Windsurf hook registration |
%USERPROFILE%\.codeium\windsurf\hooks\ | Fireraven hook scripts and config |
%USERPROFILE%\.codeium\windsurf\hooks\config.env | Fireraven credentials |
On Windows, Cascade uses a powershell hook field with a direct Python invocation for each Fireraven event. Restart Devin Desktop or Windsurf after editing config.env.
Local Sensitive Path Blocking
The hooks include a local path guard for common sensitive path patterns before sending file-read requests to FireGuard. Paths containing values such as .env, id_rsa, credentials, secret, .pem, token, or api_key are blocked locally.