Skip to content
MoorAI
03 — agents & architecture

Agent hook

Also written lifecycle hook

A command an agent host runs at fixed points in its loop — before a tool call, after a tool call, when a prompt is submitted, when a session starts or stops — receiving the event as structured data. A hook that runs before a tool call can return a decision, so it is where a policy can allow, ask or deny; the others observe, add context or log. Each host defines its own events and configuration: Claude Code, Codex, Gemini CLI and Cursor all have hooks, under different names.

How MoorAI handles it: MoorAI enforces through the PreToolUse hook in Claude Code and pre-tool hooks in Codex CLI, GitHub Copilot CLI, Gemini CLI and Cursor; its coverage heartbeat reports a hook that was disabled or removed.

Sources

Related terms

  • PreToolUse hook Agents & architecture

    A callback the agent host invokes after the model has requested a tool call but before the call executes, handing over the tool name and arguments and…

  • Agent host Agents & architecture

    The program that runs the agent loop — the CLI, IDE extension or desktop app that assembles the context, sends it to the model, receives the tool calls…

  • Inference hooks Agents & architecture

    A Claude Enterprise feature, in beta, that sends each governed request to the organization's own AI security server before inference runs and waits for an…

Agents & architecture

Where the attacks above actually land. The vocabulary here is worth precision, because the difference between "the model decided" and "the tool ran" is the difference between a risk and an incident.

Agent hook is term 10 of 16 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 82 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act, W3C Trace Context, the MCP specification — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.