FireGuard

Devin / Windsurf Integration

Install FireGuard hooks for Devin and Windsurf local agent events.

Use the Devin / Windsurf integration when you want FireGuard to check local coding-agent prompts, commands, MCP calls, file reads, and file writes.

Requirements

  • python3 available on PATH.
  • A FireGuard API key.
  • A FireGuard project ID with the policies and security guardrails you want to enforce.

Install

Install the Windsurf-compatible hooks:

curl -fsSL https://raw.githubusercontent.com/fireravenai/fireraven-agent-hooks/refs/heads/main/install.sh | sh -s -- --agent windsurf

Or install from a local clone of github.com/fireravenai/fireraven-agent-hooks:

./fg install --agent windsurf
./fg init
./fg doctor

Configure

Edit config.env in ~/.codeium/windsurf/hooks/:

FIRERAVEN_GUARDRAILS_API_KEY=fg_...
FIRERAVEN_PROJECT_ID=00000000-0000-0000-0000-000000000000

Optional overrides (installer defaults are normal / open if omitted):

FIRERAVEN_API_URL=https://api.fireraven.ai
# FIRERAVEN_EXECUTION_MODE=fast
FIRERAVEN_REQUEST_TIMEOUT_SEC=15
# FIRERAVEN_FAIL_MODE=closed

Restart Devin Desktop or Windsurf after editing config.env.

FIRERAVEN_EXECUTION_MODE

ValueDefaultUse when
normalyesFull sequential checks with complete policy and security details.
fastLower latency. FireGuard runs eligible checks in parallel and returns as soon as a blocking result is known.

See FireGuard concepts — Execution modes.

FIRERAVEN_FAIL_MODE

ValueDefaultUse when
openyesAllow the action through on transient FireGuard API failures. Policy violations and missing credentials still block.
closedBlock the agent action when FireGuard cannot be reached (network, timeout, or HTTP error). Use for strict production enforcement.

The installer registers hooks in ~/.codeium/windsurf/hooks.json.

What Devin And Windsurf Check

Windsurf and Devin run the windsurf_guardrail.py entry script.

EventModeWhat FireGuard checks
pre_user_promptBlockingUser prompts before the agent receives them.
pre_run_commandBlockingShell commands and working directory context.
pre_mcp_tool_useBlockingMCP server, tool name, and arguments.
pre_write_codeBlockingFile path and proposed edits.
pre_read_codeBlockingFile path and, for small files, a content preview.
post_cascade_responseAuditAgent response text after generation.
post_write_codeAuditApplied file-write content.

Blocked pre-hook events exit with code 2. Audit events log unsafe output but do not block the already-completed action.

Windows

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/fireravenai/fireraven-agent-hooks/refs/heads/main/install.ps1))) -Agent windsurf

The PowerShell installer writes:

FilePurpose
%USERPROFILE%\.codeium\windsurf\hooks.jsonDevin/Windsurf hook registration
%USERPROFILE%\.codeium\windsurf\hooks\Fireraven hook scripts and config
%USERPROFILE%\.codeium\windsurf\hooks\config.envFireraven credentials

On Windows, Cascade uses a powershell hook field with a direct Python invocation for each Fireraven event. Restart Devin Desktop or Windsurf after editing config.env.

Local Sensitive Path Blocking

The hooks include a local path guard for common sensitive path patterns before sending file-read requests to FireGuard. Paths containing values such as .env, id_rsa, credentials, secret, .pem, token, or api_key are blocked locally.

On this page