Install MoorAI and guard Claude Code

1. Install MoorAI and its Claude Code hooks

   curl -fsSL https://raw.githubusercontent.com/gitayg/moorai/main/scripts/install.sh | sh

   The script clones MoorAI to ~/.moorai, installs its dependencies and registers MoorAI’s PreToolUse, PostToolUse and UserPromptSubmit hooks in ~/.claude/settings.json. It needs git and Node 18 or later, and no account. Set MOORAI_NOHOOK=1 to skip hook registration, or MOORAI_HOME to install somewhere else. To remove the hooks later: node ~/.moorai/cli/moorai-hook.mjs uninstall, which removes only MoorAI’s entries.

   Prefer a desktop app? Download MoorAI for macOS (Apple silicon, signed and notarized, or brew install --cask gitayg/tap/moorai) or Windows (x64 installer). On Linux, install the agent package instead.

2. Add Codex, Copilot CLI, Gemini CLI or Cursor

   node ~/.moorai/cli/moorai-agent-hook.mjs codex install     # or: copilot | gemini | cursor

   Each command registers a pre-tool hook in that agent’s own config (~/.codex/hooks.json, ~/.copilot/hooks/moorai.json, ~/.gemini/settings.json, ~/.cursor/hooks.json) that runs the same engine and policy as the Claude Code hook. In Codex, trust the hook once with /hooks. These four adapters are built from each vendor’s documentation and tested against its documented hook payloads; they have not yet been run end to end against the live agents. Enforcement is validated on Claude Code.

3. Check that it is working

   node ~/.moorai/cli/moorai-doctor.mjs
   node ~/.moorai/cli/moorai-explain.mjs "cat .env"

   moorai-doctor is read-only: it reports MoorAI’s hook registration in each agent, Claude Code’s managed settings that can switch hooks off, enrollment (coach or enforce), which policy is enforced and whether its signature verifies, and runs a live self-test of the real hook on a benign and a known-bad command. It exits 1 if any check fails. moorai-explain runs a string through the same engine and policy the hook uses and shows each finding, the final decision and the safer alternative, locally.

4. Enroll the device to enforce

   Until a device is enrolled, MoorAI coaches: in Claude Code a flagged call goes on to its normal permission prompt with a note, shown to you and handed to the agent, that names what was caught and the safer way. Nothing is blocked and nothing is posted anywhere. Enrolled in a MoorAI console (free self-hosted, or hosted by MoorAI), the same findings are blocked, held for sign-off or end the session, per policy; with no policy set, built-in defaults block a reverse shell and a local secret leaving the machine. Enroll from the desktop app’s settings panel, or with an installation token from the console.

V=1.38.1   # the release you are installing
base=https://github.com/gitayg/moorai/releases/download/v$V
curl -fL -O "$base/moorai_${V}_all.deb" -O "$base/moorai-$V-linux.tar.gz" -O "$base/SHA256SUMS"
sha256sum -c SHA256SUMS
sudo dpkg -i "moorai_${V}_all.deb"   # or: tar -xzf "moorai-$V-linux.tar.gz" && sudo sh "moorai-$V/install.sh"
moorai-install-hooks                 # as each user: registers the hooks in ~/.claude/settings.json

docker run --rm ghcr.io/gitayg/moorai-server:1.4.1

What the console receives from an enrolled device: a category, a risk level and a keyed one-way hash (plus the login and hostname, which the console pseudonymises on arrival), never the prompt, the file or the matched text. MoorAI is governance, not a sandbox: by default it fails open if the hook crashes or times out, and an administrator can set it to fail closed. Full install notes and every command are in the README. Next: Claude Code security · MCP security · capabilities · pricing.