Evidence CodeMarine can inspect
- Workspace changes made through Windsurf
- Dependency and configuration changes
- Supported hook events
Windsurf integration
Independent security around Windsurf.
Workspace, dependency and agent-configuration security with local write and shell adapters.
INTEGRATION PROFILE Beta
- Provider
- Windsurf
- Primary transport
- Workspace watcher and Windsurf hooks
- Workspace scanning
- Available
- Blanket runtime protection
- Not claimed
What the integration can see and where it stops.
Workspace observation and pre-execution control are shown separately.
Defined blocking potential
- Supported local write and shell actions after setup
What you should not assume
- Hook installation does not prove host invocation until live canaries ship
- Native MCP denial is part of the planned coverage expansion
- Unmediated tools remain outside preventive coverage
Native controls protect Windsurf. CodeMarine protects the shared environment.
Keep provider permissions and sandboxes. Add one deterministic policy around the workspace and the rest of your stack.
Controls the surfaces and execution modes owned by the provider.
Secures resulting code, software supply chain and supported actions under one control model.
A configured adapter is only the start.
Effective protection needs the right adapter, current configuration, healthy decision path and matching host proof.
No live proof means Setup needed or Beta.
- 01
InstallPlace the supported adapter and configuration.
- 02
VerifyCheck version, integrity and workspace binding.
- 03
ProveRun a harmless nonce-bound canary through the real host.
- 04
MaintainExpire proof when the host, policy or configuration changes.
Evaluate CodeMarine with Windsurf.
Map the current workspace, provider paths and limits before deciding which controls to rely on.
