Skip to main content
Lumos sees every tool call an AI agent makes and decides whether to allow or deny it. That includes calling an MCP server (for example, sending a Slack message) and running a local tool (for example, a Bash command or browser use). Lumos uses the ToolUse hook interface, which every major agent harness supports, including Claude Code, Codex, and Cursor. It works with any model and on every operating system (macOS, Windows, Linux). It also works for cloud agents. When you use Claude Code on the web, the harness runs on an Anthropic server and still calls the Lumos hook. Lumos doesn’t support all of these clients yet; see client coverage below.

​
The path of a tool call

  1. Prompt. The employee asks the agent to pull a customer record from Salesforce and post it in Slack.
  2. Request. The agent sends the prompt to the model, directly or through your LLM router.
  3. Suggested tool call. The model replies with a tool to run, here Salesforce’s get_record.
  4. Check the call. Before the tool runs, the hook’s PreToolUse event sends the tool name and arguments to Lumos.
  5. Allow or deny. Lumos checks your policies against the call and the person’s identity, such as groups, department, and title. A denied call stops here, and Lumos logs it as denied.
  6. Allowed call. The tool runs on an external MCP server, directly or through your MCP gateway, or locally, like Bash or a local MCP server.
  7. Result. The output returns to the agent.
  8. Log the outcome. After the tool runs, the hook’s PostToolUse event reports the completed call to Lumos, which logs it.
  9. Response. The employee sees the answer.
Steps 2 through 8 repeat for every tool call: here once for Salesforce, then again for Slack.

​
Rollout

  • Your MDM pushes the hook config (Jamf, Intune, or Kandji) as managed settings employees can’t edit or remove. No Lumos software is installed.
  • Each device enrolls once and gets a device token. Lumos attributes every call to the person your device inventory assigns that device to.
  • For a trial, one command installs the hooks in a user’s own settings, without an MDM.

​
LLM routers and MCP gateways

Both stay in place. Lumos adds per-person policy and a log of every call.
  • LLM routers change where inference goes, not where tools run, so the hook works the same.
  • MCP gateways see a call only after Lumos allows it. Built-in tools and local MCP servers never pass through a gateway, and the hook still covers them.

​
Verdicts and timing

  • Allow is silent. The agent’s own permission prompts still apply.
  • Deny stops the call and names the policy: Blocked by your organization’s Lumos policy “<name>”.
  • Checks time out after 4 seconds. The call proceeds and is logged as not evaluated.
  • Unenrolled or revoked devices are denied.
  • Policy edits apply within seconds. Identity changes, such as a group removal, apply within 5 minutes.

​
What Lumos receives

​
Client coverage

For which harnesses, operating systems, and cloud agents Lumos supports today, see Supported agents and clients.