Devin / Windsurf Integration
Install FireGuard hooks for Devin Local and Windsurf local agent events.
Use this integration when you want FireGuard to check local coding-agent prompts, commands, tool use, file reads, and file writes.
Support
| Product | Status | Notes |
|---|---|---|
| Devin Local | Supported | Install with --agent devin. Hooks live under ~/.config/devin/. |
| Devin Cascade | Not supported | FireGuard hooks do not run on Devin Cascade (Devin Cascade has been deprecated) |
| Windsurf (including Windsurf Cascade) | Supported | Install with --agent windsurf. Hooks live under ~/.codeium/windsurf/. |
Devin Local and Windsurf are separate installs. Devin does not use the Windsurf hooks directory.
Requirements
python3available onPATH.- A FireGuard API key.
- A FireGuard project ID with the policies and security guardrails you want to enforce.
Install Windsurf
curl -fsSL https://raw.githubusercontent.com/fireravenai/fireraven-agent-hooks/refs/heads/main/install.sh | sh -s -- --agent windsurfOr install from a local clone of github.com/fireravenai/fireraven-agent-hooks:
./fg install --agent windsurf
./fg init
./fg doctorConfigure Windsurf
Edit config.env in ~/.codeium/windsurf/hooks/:
FIRERAVEN_GUARDRAILS_API_KEY=fg_...
FIRERAVEN_PROJECT_ID=00000000-0000-0000-0000-000000000000Optional overrides (installer defaults are normal / open if omitted):
FIRERAVEN_API_URL=https://api.fireraven.ai
# FIRERAVEN_EXECUTION_MODE=fast
FIRERAVEN_REQUEST_TIMEOUT_SEC=15
# FIRERAVEN_FAIL_MODE=closedThe installer registers hooks in ~/.codeium/windsurf/hooks.json. Restart Windsurf after editing config.env.
Install Devin Local
curl -fsSL https://raw.githubusercontent.com/fireravenai/fireraven-agent-hooks/refs/heads/main/install.sh | sh -s -- --agent devinOr from a local clone:
./fg install --agent devin
./fg init
./fg doctorConfigure Devin Local
Edit config.env in ~/.config/devin/hooks/:
FIRERAVEN_GUARDRAILS_API_KEY=fg_...
FIRERAVEN_PROJECT_ID=00000000-0000-0000-0000-000000000000Optional overrides (same as Windsurf):
FIRERAVEN_API_URL=https://api.fireraven.ai
# FIRERAVEN_EXECUTION_MODE=fast
FIRERAVEN_REQUEST_TIMEOUT_SEC=15
# FIRERAVEN_FAIL_MODE=closedThe installer registers hooks in ~/.config/devin/config.json and runs devin_guardrail.py. Restart Devin Desktop after editing config.env.
Shared options
FIRERAVEN_EXECUTION_MODE
| Value | Default | Use when |
|---|---|---|
normal | yes | Full sequential checks with complete policy and security details. |
fast | Lower latency. FireGuard runs eligible checks in parallel and returns as soon as a blocking result is known. |
See FireGuard concepts — Execution modes.
FIRERAVEN_FAIL_MODE
| Value | Default | Use when |
|---|---|---|
open | yes | Allow the action through on transient FireGuard API failures. Policy violations and missing credentials still block. |
closed | Block the agent action when FireGuard cannot be reached (network, timeout, or HTTP error). Use for strict production enforcement. |
What Windsurf Checks
Windsurf runs the windsurf_guardrail.py entry script.
| Event | Mode | What FireGuard checks |
|---|---|---|
pre_user_prompt | Blocking | User prompts before the agent receives them. |
pre_run_command | Blocking | Shell commands and working directory context. |
pre_mcp_tool_use | Blocking | MCP server, tool name, and arguments. |
pre_write_code | Blocking | File path and proposed edits. |
pre_read_code | Blocking | File path and, for small files, a content preview. |
post_cascade_response | Audit | Agent response text after generation. |
post_write_code | Audit | Applied file-write content. |
Blocked pre-hook events exit with code 2. Audit events log unsafe output but do not block the already-completed action.
What Devin Local Checks
Devin Local runs the devin_guardrail.py entry script.
| Event | Mode | What FireGuard checks |
|---|---|---|
UserPromptSubmit | Blocking | User prompts before the agent receives them. |
PreToolUse | Blocking | Tool name and arguments (commands, file reads/writes, and other tools). |
PostToolUse | Audit | Tool results after the action completes. |
Blocked UserPromptSubmit events exit with code 2. PreToolUse policy denials may prompt for an allow/deny override, then return a JSON decision of approve or block. Audit events do not block the already-completed action.
Windows
Windsurf
& ([scriptblock]::Create((irm https://raw.githubusercontent.com/fireravenai/fireraven-agent-hooks/refs/heads/main/install.ps1))) -Agent windsurf| File | Purpose |
|---|---|
%USERPROFILE%\.codeium\windsurf\hooks.json | Windsurf hook registration |
%USERPROFILE%\.codeium\windsurf\hooks\ | Fireraven hook scripts and config |
%USERPROFILE%\.codeium\windsurf\hooks\config.env | Fireraven credentials |
Windsurf on Windows uses Cascade’s powershell hook field with a direct Python invocation for each Fireraven event. Restart Windsurf after editing config.env.
Devin Local
& ([scriptblock]::Create((irm https://raw.githubusercontent.com/fireravenai/fireraven-agent-hooks/refs/heads/main/install.ps1))) -Agent devin| File | Purpose |
|---|---|
%APPDATA%\devin\config.json | Devin Local hook registration |
%APPDATA%\devin\hooks\ | Fireraven hook scripts and config |
%APPDATA%\devin\hooks\config.env | Fireraven credentials |
Restart Devin Desktop after editing config.env.
Local Sensitive Path Blocking
The hooks include a local path guard for common sensitive path patterns before sending file-read requests to FireGuard. Paths containing values such as .env, id_rsa, credentials, secret, .pem, token, or api_key are blocked locally.