Install Skarn.

Wire the guard

The guard is a pre-execution hook. Before your agent runs a shell command, writes a file, fetches a URL or calls an MCP tool, the pending action is scanned on this machine and gets a verdict. It ships in audit mode, which reports the verdict it would have reached and changes nothing your agent does.

Which of those events a host gates differs by host; the guard hook-event reference lists them per host.

Wire the hooks

Wire the skarn guard hook into detected AI coding agents (merge-based, reversible), then verify it with the guard self-test. skarn setup detects the installed agents it supports (Claude Code, Cursor, Codex CLI, Copilot CLI, Gemini CLI and Grok Build), merges the guard hook into each one's own config in audit mode, backs up every file it changes before rewriting it, and ends with a self-test. Every flag it takes is in the manual entry for skarn setup.

Check the wiring

Check whether skarn is actually protecting this machine: binary, license, wired agent hooks, guard log, session stores, and the guard self-test. Run it any time. A warning or failure names the command that clears it, or the resource to read, wherever one exists. Every check it runs is in the manual entry for skarn doctor.

Review the audit window

Once the calls it flagged span five or more days with no deny among them, the report prints the exact command that switches these hooks to enforce; its forecast counts the blocks and prompts per day that enforcing would have produced. Every count and rate it prints is over the calls the guard flagged, never over all the traffic your agent generates.

Four hosts can install the same hooks through their own plugin system instead, and Cursor from its own plugin repository. The plugin carries hook configuration only; the hooks call skarn guard on your PATH, so install the binary above first.

Claude Code

No trust step; the hooks are live in your next session.

Codex CLI

Codex asks you to trust the hooks the first time you start it after installing; until you do, they do not run.

Gemini CLI

The install asks for consent, because the extension declares hooks and an MCP server, and asks you to trust the folder.

Antigravity

Install from a clone; agy plugin list confirms the hook, skill and MCP server counts.

Cursor

The Cursor Marketplace listing is pending; until then Cursor reads the plugin from that local directory. Run Developer: Reload Window to load it. Cursor rejects a symlink whose target lies outside ~/.cursor/plugins/local, so copy a checkout there rather than linking it.

A Team license adds enforcement, plus the policy and baselines that decide what blocks and the audit record proving it did.

The MCP server, the plugins for every host, and a copy-ready snippet for each client are on Integrations.

Download the binary

Skarn is one static file with no runtime dependencies. Pick your platform from the release page and put it on your PATH - no installer, and on most machines no admin rights.

All assets, plus both license agreements, are on the Skarn release page. The container build-stage contract is on Containers and CI.

MCP server

Skarn also runs as a local MCP server, so your agent can scan its own sessions and vet its own configuration. It exposes four read-only tools, returns redacted results, makes no network call, and carries no tool that writes. The host starts it by running skarn mcp from your PATH, so install the binary above first.

Add to Cursor Add to VS Code

Both buttons register the server as skarn and run it from your PATH, so install the binary above first. If you would rather not, the pinned launcher form works with only Node present: Cursor or VS Code. That form downloads @skarn-security/[email protected] on first run and reuses the npx cache afterwards, so a newer Skarn needs a newer link.

Paste that into the MCP settings of any client the buttons above do not cover and that reads this JSON shape. A few do not: Codex CLI and Grok Build take TOML, and Zed nests the same server under context_servers. The block for each client is on Integrations.

What is free, and what a license adds

The free tier is the full local product, not a trial: the whole detection engine and rule set, attack-chain correlation, the risk score, every session-recall command, the localhost web UI, text, JSON, SARIF and NDJSON output, redaction, CI gating, a personal baseline, custom rules, and the guard in audit mode. skarn check needs a free license, issued at getskarn.com/free after a one-time email confirmation; skarn assess and the recall commands need none; the license is verified offline. A license unlocks the org capabilities - policy as code, org-distributed baselines, a tamper-evident audit log, the maintained detection feed, and guard enforcement. A paid flag without a covering license refuses before any scan runs with exit 5; a missing license refuses with exit 7 and points you at the free registration. Nothing in the free scanner is time-limited or crippled to sell the paid tiers.

Common questions

How do I wire the real-time guard?

Run skarn setup. It detects the installed agents it supports (Claude Code, Cursor, Codex CLI, Copilot CLI, Gemini CLI and Grok Build), merges the guard hook into each one's own config in audit mode, backs up every file it changes, and ends with a self-test. Run skarn doctor to confirm the wiring. Claude Code, Codex CLI, Gemini CLI and Antigravity can install the same hooks as a plugin instead, and Cursor from its own plugin repository; the commands are in the Wire the guard section of this page.

Does installing Skarn require an account or a license key?

Installing needs no account: the tap, the npm packages, the binaries, and the image are public. Running differs by command. skarn assess scans with no account and no license; skarn check, the repeatable scriptable scan, needs a free license, issued at getskarn.com/free to anyone who registers and confirms their email, and verified offline. A paid license token additionally unlocks the Team and Enterprise features.

What should I run first?

Run skarn assess. It scans every AI coding session on the machine with no configuration and prints a redacted risk summary. It makes no network call and writes nothing to your session files.

Are the binaries signed?

The macOS binaries are Developer ID signed and Apple-notarized, so they run without a Gatekeeper warning. The Homebrew formula pins each platform's asset by sha256, and the npm packages carry the same binaries pinned by npm integrity hash. The install script verifies the Windows binary against the checksum GitHub computed for it, but the Windows binaries are not yet Authenticode-signed, so a first run may show a SmartScreen prompt. The container image is cosign-signed (Sigstore keyless) with an SPDX SBOM and SLSA build provenance.

Does Skarn phone home when I install or run it?

No. The binary sends nothing: no upload, no telemetry, no network call when it scans. skarn assess needs no account, and skarn check verifies its free license offline, so nothing leaves the machine either way. The one online feature is the opt-in maintained rule feed, a paid feature you invoke with a flag.

Which assistants does it read?

Claude Code, Gemini CLI, Codex CLI, Cursor, GitHub Copilot, Kimi Code CLI, Grok Build, Grok Bot, Antigravity, OpenCode. Skarn finds their session stores automatically; no path configuration is needed for a standard install.