# Golem docs

> How to install Golem, connect each agent to it, write rules, and check the signed record it keeps, with guides that answer common questions about securing coding agents. Every page is also served as Markdown at the same address with .md on the end.

## Start

- [Golem documentation](https://docs.golem.team/index.md): Install Golem, connect your agents to it, decide what they may do, and check the signed record of what they did.
- [Install Golem](https://docs.golem.team/install.md): Put the Golem agent on a Mac, Linux or Windows machine with one line, check it with golem doctor, and take it all back with one command.
- [Roll out to a fleet](https://docs.golem.team/fleet.md): Push the same installer through Jamf, Intune or Kandji, watch before you enforce, and fix risky agent settings with the MDM you already run.

## Agents

- [Claude Code](https://docs.golem.team/agents/claude-code.md): Connect Claude Code to Golem: hooks that block or hold a call before it runs, Golem's own MCP tools, and the shell jail on macOS, Linux and Windows.
- [Cursor](https://docs.golem.team/agents/cursor.md): Connect Cursor to Golem through its hooks and MCP settings, and how a held call behaves in each of Cursor's run modes.
- [Codex](https://docs.golem.team/agents/codex.md): Connect OpenAI's Codex to Golem through its hooks and MCP settings, approve the hooks once, and lock its riskiest settings through requirements.toml.
- [GitHub Copilot](https://docs.golem.team/agents/copilot.md): Connect GitHub Copilot's agent mode to Golem through its hooks and MCP configuration.
- [Gemini CLI](https://docs.golem.team/agents/gemini-cli.md): Connect Google's Gemini CLI to Golem through its hooks and MCP settings, and turn off its YOLO mode for the fleet.
- [Devin Desktop](https://docs.golem.team/agents/devin.md): Connect Devin Desktop, formerly Windsurf, to Golem through its hooks and MCP configuration.
- [Antigravity](https://docs.golem.team/agents/antigravity.md): Connect Google Antigravity to Golem through its hooks, MCP configuration and skills, so its built-in tools are checked as well as its MCP calls.
- [OpenClaw](https://docs.golem.team/agents/openclaw.md): Connect OpenClaw to Golem with the plugin the Golem agent installs, so its tool calls are checked and signed.
- [Hermes Agent](https://docs.golem.team/agents/hermes.md): Connect Hermes Agent to Golem with its plugin, so each tool call is checked against your rules and recorded.
- [Browser extension](https://docs.golem.team/agents/browser-extension.md): Record what people send to ChatGPT, Claude.ai, Gemini and other AI chat sites in Chrome, and what comes back, with the Golem extension.

## Protect

- [Rules and CEL](https://docs.golem.team/rules.md): Every rule is a sentence over a CEL expression with one setting from Off to Block. How rules are written, tested, rolled out and promoted.
- [Block, hold and contain](https://docs.golem.team/response.md): What happens when a rule fires: a refusal with a reason, a hold for a decision, a session locked down or restricted with Safely, or a machine quarantined.
- [Redaction](https://docs.golem.team/redaction.md): Mask secrets and personal data on the machine before anything is stored, and keep the record verifiable.
- [Shell jail and sandbox](https://docs.golem.team/shield.md): A kernel jail around every shell command an agent runs, and a throwaway VM for work that reads what a stranger wrote.

## Investigate

- [Coverage](https://docs.golem.team/coverage.md): What Golem captures for each agent, what it finds on its own across your machines, and where it cannot see.
- [Session review](https://docs.golem.team/review.md): Golem's Triage readers read what an agent said beside what it did, on the model and key you choose, under a monthly ceiling, and raise flags for a person.
- [The defender's agents](https://docs.golem.team/defender.md): Golem's investigator works your alerts and undecided inventory as cases, the supervisor checks every step, and you decide what either may close or do without a person.
- [Cases and evidence export](https://docs.golem.team/cases.md): Triage a flag, gather evidence into a case, run the clock to containment, and export a signed package an auditor can check offline.
- [Agent coordination](https://docs.golem.team/coordination.md): Agents see who else is working on the same repositories and message each other through Golem, with every message labelled as coming from another agent.

## Trust

- [The signed record](https://docs.golem.team/record.md): What each entry signs, how entries chain, how keys tie to a machine and an agent, and how to check it all with verify.py.
- [Where your data goes](https://docs.golem.team/data.md): What stays with you, what Golem's service holds, where raw payloads are stored and under whose key, and who can read them.
- [People, agents and access](https://docs.golem.team/access.md): People, machines and agents get access in the same terms, scopes, through workspace roles and tokens that last five minutes at most.
- [Limits, and what Golem does not do](https://docs.golem.team/limits.md): Where each protection works, where it is only as strong as the client's hook, and what Golem deliberately leaves alone.

## Guides

- [How do I stop Claude Code from running dangerous commands?](https://docs.golem.team/guides/dangerous-commands.md): Claude Code's permission rules and PreToolUse hooks, what they leave open, and where a rule outside the agent and a kernel jail around each command help.
- [How do I keep an audit trail of what our AI coding agents did?](https://docs.golem.team/guides/audit-trail.md): What Claude Code, Codex and Cursor record on their own, what OpenTelemetry export adds, and why a record written on the agent's own machine is not yet evidence.
- [How do I tell if a coding agent was prompt-injected?](https://docs.golem.team/guides/prompt-injection.md): Where injected instructions reach a coding agent, what gives one away, what detection can and cannot do, and why tightening a session after it reads untrusted text works better.
- [How do I control which MCP servers developers' agents use?](https://docs.golem.team/guides/mcp-servers.md): Find the MCP servers agents can reach, allowlist them with each client's own settings, scan their definitions, and block unapproved ones at the call.
- [What is AI Detection and Response (AiDR)?](https://docs.golem.team/guides/what-is-aidr.md): The category of tools that watch AI agents at work, notice when one goes wrong and act on it; how it maps to EDR, the public reference work, and who builds it.
- [How do I roll out coding-agent security with Jamf, Intune or Kandji?](https://docs.golem.team/guides/mdm-rollout.md): Push each agent's managed settings through the device management you already run, then add a monitor installed the same way, in the right user context.
- [How do I let an agent work on a repository I don't trust?](https://docs.golem.team/guides/untrusted-repositories.md): What a stranger's repository can do to an agent and its machine, and the trade-offs of read-only review, dev containers, VMs, hosted sandboxes and Golem's sandbox_run.
- [What happens when developers run agents with permission prompts off?](https://docs.golem.team/guides/permission-prompts-off.md): What bypass mode, Run Everything and --yolo actually allow, how to find out who runs that way, how to lock it, and how to put a person back in front of risky calls.
- [How do I prove what an AI agent did, for an incident or an auditor?](https://docs.golem.team/guides/prove-what-an-agent-did.md): What evidence an investigator or auditor needs about an agent's actions, how to keep chain of custody, and a worked offline check of a Golem evidence export with verify.py.
- [Can several coding agents work on one repository without colliding?](https://docs.golem.team/guides/agents-sharing-a-repository.md): Worktrees, branch ownership and a few habits that stop agents trampling each other's work, and agents that can see and message each other through Golem.

## Elsewhere

- [Golem home](https://golem.team/): what Golem does and the questions a security team asks.
- [Capabilities](https://golem.team/capabilities): every capability, and the path a call takes.
- [Signed record format](https://golem.team/ledger-format.md): what each entry signs and how entries chain.
- [Offline verifier](https://golem.team/verify.py): checks an evidence export without trusting Golem.
- [All the docs in one file](https://docs.golem.team/llms-full.txt)