AI Model Runtimes

The red team ships as GitHub Copilot CLI primitives, but the same team runs natively on Claude Code, OpenAI Codex CLI, and Cursor. Every runtime shares one decision engine, so a given command reaches an identical allow / ask / deny outcome everywhere — the read-only guarantee never forks per platform.

One core, four runtimes¶

The platform-neutral guard (guardrails/guard.mjs, wrapping the unit-tested evaluators in guardrails/core/) is the single source of truth for read-only enforcement. Each runtime has a thin adapter that translates the runtime’s hook payload into that core and maps the verdict back into the runtime’s native wire format.

The Copilot definitions under .github/ are the canonical source. The per-platform files are produced by an anti-drift generator, so the team can never silently diverge between runtimes:

node tools/agents/build-agent-defs.mjs          # regenerate every runtime
node tools/agents/build-agent-defs.mjs --check  # CI: fail if any runtime is stale

GitHub Copilot CLI¶

The default runtime. Check out the repo and Copilot auto-discovers the Pentest Manager and its specialists. See Getting Started.

/agent redteam-orchestrator

Claude Code¶

The generator emits Claude subagents, slash commands, and skills, plus a PreToolUse hook that reproduces the Copilot guardrail exactly (and a SessionStart banner). After checkout:

/agent redteam-orchestrator

The hook is registered in .claude/settings.json; on a mutating az/azd/Az PowerShell command it returns permissionDecision: "deny" (or "ask" in controlled-validation mode).

OpenAI Codex CLI¶

Codex reads the team’s roster and read-only posture from AGENTS.md and loads the 18 domain skills from .agents/skills/ (the open agent-skills standard). Enforcement is a Claude-compatible lifecycle hook plus a hardened config:

• .codex/hooks/redteam-guard.mjs runs on PreToolUse, PermissionRequest, and SessionStart (matcher *, so shell, MCP, and file tools are all gated). Because Codex fails open on an unsupported ask decision and on any non-2 exit code, the adapter blocks every deny / ask / error path with stderr + exit 2 — the only signal Codex honours — and stays silent on allow.

• .codex/config.toml pins a defense-in-depth read-only posture: approval_policy = "untrusted" (auto-run only known-safe reads), sandbox_mode = "workspace-write" with network_access = true (so az can read Azure while writes stay in the workspace).

Then ask Codex to “run an Azure red team assessment”; it follows the same flow as the Copilot orchestrator using the .agents/skills/ knowledge.

Cursor¶

The team is expressed as Cursor rules (an always-applied read-only posture rule plus a description-triggered rule per specialist) and commands, with skill knowledge referenced at its canonical .github/skills/ location. Enforcement is .cursor/hooks/redteam-guard.mjs, registered in .cursor/hooks.json with failClosed: true:

• beforeShellExecution evaluates every terminal command and denies anything not provably read-only (asks in controlled-validation mode).

• beforeMCPExecution surfaces every MCP tool call for explicit approval, because the shell-oriented engine cannot prove an arbitrary MCP action is read-only.

Verifying parity¶

The adapters are covered by tools/agents/adapter-parity.test.mjs, which spawns every runtime adapter against the shared golden fixtures (guardrails/fixtures/decisions.json) and asserts each one maps the same inputs to the same allow / deny outcome in its own wire format — including Codex’s fail-closed exit 2 contract.

node --test                                     # run all guard + adapter parity suites

See also Safety & Guardrails for the enforcement model in depth.