ThreatLocker Community Policies for agentic AI coding tools

Agentic AI tools like Claude Code, OpenAI Codex, and Google Antigravity require explicit application control policies to run safely in a managed environment. ThreatLocker maintains a set of community policies covering these tools and the child processes, file paths, and network destinations they depend on.

All policies described here are available in the ThreatLocker Community portal and can be directly added to your organization from there.

Before you begin

These policies are designed to be broadly applicable across organizations and do not cover every edge case. Project-specific tooling may require additional rules based on your environment.

All policies ship in Monitor Only mode. Review the Unified Audit log before switching to Secured Mode. Application Control Learning Mode can help automate discovery during an initial deployment period.

Community policies

Policy Name	Covers	Mode
Claude Code and Child Processes	Claude Code, Claude, Git, Python, NodeJS, Bruno, Azure CLI, GitHub Desktop, and GitHub CLI	Monitor Only
Claude CoWork and Hyper-V	Claude CoWork, Hyper-V	Monitor Only
Codex and Child Processes	OpenAI (Windows App ChatGPT) Codex, VS Code, VS Code Codex, NodeJS, Git, GitHub Desktop, and GitHub CLI	Monitor Only
Antigravity and Child Processes	Antigravity app + IDE + CLI (agy), Git, Python, NodeJS	Monitor Only
Agentic AI MCP Servers	19 MCP server Built-Ins including GitHub, Gmail, Google Drive, Puppeteer, Playwright, Chrome DevTools	Monitor Only

Adding Community Policies

First, select the Community tab from the left-hand side of the ThreatLocker Portal.

Selecting this will bring you to the ThreatLocker Community page. This will show you several lists of pre-existing ThreatLocker policies.

To locate the desired policy, navigate to the search bar located towards the top of the page.

Type the name of the policy into the search bar. (In this example, we will search for: Antigravity and Child Processes, but you can add any of the policies discussed in this KB.)

Selecting the policy will open a window on the right-hand side of the page labeled “Download Community Application Policy”. Here, you can create a new policy for the entire organization.

The most commonly required settings have already been added to each policy including associated tools as well as file and Internet Ringfencing. By default Applies To is set to Entire Organization with No Policy Expiration. If you wish to apply it to a Computer or a Group of Computers this can be changed here. To download a Community Policy into your organization, select the Download button located at the bottom of the Download Community Application Policy window.

Your new policy will now exist in the Organization and can be viewed in the Application Control page.

Policy details

Claude Code and Child Processes

This policy covers Claude Code and the child processes it spawns during normal operation.

Selected Applications

Python (Built-In)

Bruno (Built-In)

Claude Code (Built-In)

Claude (Built-In)

Azure CLI (Built-In)

NodeJS (Built-In)

GitHub Desktop (Built-In)

Git (Built-In)

GitHub CLI (Built-In)

(Optional) Browser workflow support: Add Chromium Ext Claude (Built-In) only if users need Claude to work with browser pages, such as reading the page they are on, clicking through a site, filling out forms, or sharing browser context with Claude Code. Basic Claude Code terminal use does not require the extension. Test this in Monitor Only and use Unified Audit to confirm whether the extension is needed in your environment.

Ringfencing

Application interaction: Restricted. Allow All Except Below (no exceptions defined by default).

File access: Restricted. Exceptions: c:\users\*\.claude\*.sh (Permit + Read/Write),
c:\users\*\.claude\settings.* (Permit + Read/Write), c:\users\*\.git\* (Permit + Read/Write).

Registry access: Not restricted.

Internet access: Restricted. Domain exclusions: anthropic.com, claude.ai, claude.com, claudemcpcontent.com, claudeusercontent.com, github.com, githubusercontent.com, storage.googleapis.com, and intercom.io.

Claude CoWork and Hyper-V

Claude Cowork is Claude's task delegation mode in the desktop app, designed for multi-step work across files, tools, and applications. Unlike Claude Code, Cowork runs directly in your environment and requires Hyper-V for certain sandboxed operations. This policy permits both Claude and Hyper-V to cover the full range of tasks Cowork may perform.

This policy is intentionally minimal: it allows Claude and Hyper-V, applies file access restrictions, and runs in Monitor Only mode while organizations assess their Cowork usage. File access exceptions can be added as needed based on the audit log.

Selected Applications

Claude (Built-In)

Hyper-V (Built-In)

Ringfencing

File access: Restricted. No file access exceptions defined by default. Add exceptions based on your audit log.

Application interaction, registry, internet: Not restricted.

Note: Hyper-V is included here specifically because Hyper-V is blocked by default in many ThreatLocker Workstation groups. Removing it from this policy will prevent sandboxed operations from completing, while basic file tools will continue to work.

Codex and Child Processes

OpenAI Codex is a cloud-connected coding assistant with deep Visual Studio Code integration.

Selected Applications

GitHub CLI (Built-In)

NodeJS (Built-In)

GitHub Desktop (Built-In)

Windows App ChatGPT Codex (Built-In)

Visual Studio Code Codex Ext. (Built-In)

Git (Built-In)

Visual Studio Code (Built-In)

Ringfencing

Application interaction: Restricted. No exceptions defined by default.

File access exceptions:

Path	Action
c:\users\\appdata\local\openai\	Permit + Read/Write
c:\users\\.codex\	Permit + Read/Write

Registry access: Restricted (no exceptions).

Internet access: Restricted. Domain exclusions: chatgpt.com, openai.com, api.openai.com, auth.openai.com, cdn.openai.com, github.com, and githubusercontent.com.

Antigravity and Child Processes

Google Antigravity is Google's entry into the agentic AI coding space, built on the Gemini platform. Google Antigravity ships as an Electron application with a companion IDE and a CLI (agy). The ThreatLocker Built-In covers these components, including agy.exe, under a single application definition.

Selected Applications

Google Antigravity (Built-In)

Git (Built-In)

GitHub CLI (Built-In)

GitHub Desktop (Built-In)

NodeJS (Built-In)

Python (Built-In)

Ringfencing

Application interaction: Restricted. No exceptions defined by default.

File access exceptions (app state and cache, conversation persistence, update staging):

Path	Action
c:\users\\.gemini\	Permit + Read/Write
c:\users\\appdata\local\antigravity-updater\	Permit + Read/Write
c:\users\\appdata\roaming\antigravity\	Permit + Read/Write

Registry access: Restricted (no exceptions).

Internet access: Restricted. Domain exclusions: gemini.google.com, googleapis.com, antigravity-unleash.goog, github.com, githubusercontent.com, googleusercontent.com, gstatic.com, and run.app.

Agentic AI MCP Servers

MCP (Model Context Protocol) is an open standard that allows AI to connect to external services, including: databases, cloud platforms, code repositories, communication tools, and more. Agentic AI tools with MCP support will attempt to launch MCP server processes when a connected integration is invoked.

This policy covers 19 MCP server Built-Ins that agentic AI tools may invoke when connecting to external services. File access is restricted with no exceptions by default. Organizations should review their MCP usage in Monitor Only Mode before switching to Secured Mode and add file access exceptions as needed based on the audit log.

Note: Not every organization will use every MCP server in this list. The policy is intentionally broad to cover the range of tools in common use. Removing Built-Ins that are not deployed in your environment is a reasonable hardening step.

Selected Applications (Built-Ins)

Sequential Thinking MCP Server

Supabase MCP Server

Azure MCP Server

Filesystem MCP Server

WhatsApp MCP Server

Puppeteer MCP Server

Playwright MCP Server

Github-MCP Server

Git-MCP Server

Sentry MCP Server

Context7 MCP Server

db-mcp

Gmail MCP Server

Brave Search MCP Server

Reddit MCP Server

Microsoft Fabric MCP Server

Google Drive MCP Server

Notion MCP Server

Chrome DevTools MCP Server

Ringfencing

File access: Restricted. No exceptions defined by default. Add exceptions based on your audit log.

Application interaction, registry, internet: Not restricted.

Project-specific tooling

Some tools invoked by AI coding assistants are project-local and cannot be covered by a community policy. Common examples include:

next.cmd: the Next.js development server (invoked from node_modules\.bin\)

eslint.cmd: ESLint linter (invoked from node_modules\.bin\)

Other project build and test runners

These executables live at paths that vary by developer and project.

Shell and container tooling can vary by environment. Some Windows developer environments rely on Git Bash, PowerShell, WSL, or other shells as part of normal Git and command-line workflows. Containerized development workflows may require Docker Desktop or Docker Compose. These tools are not required for every AI coding workflow, so organizations should review Unified Audit during Monitor Only testing and add them where needed.

Follow this approach:

Run in Monitor Only mode and observe the Unified Audit log for blocked executions.

When access requests are submitted, review the exact file path reported in the request details.

Add organization-specific rules using a wildcard path where appropriate, such as c:\users\*\appdata\local\npm-cache\_npx\*\node_modules\.bin\ for npx-cached packages.

Set the initiating process to the relevant AI tool executable (e.g., Antigravity.exe, claude.exe).

Note: ThreatLocker recognizes many common development tools as known applications. When approving an access request, check the Matching Applications dropdown before creating a custom rule. Selecting a known application allows its dependencies to be permitted automatically.

Deployment checklist

All five policies are available in ThreatLocker Community. Follow this recommended deployment sequence:

Add the relevant community policies from the ThreatLocker Community portal.

Verify the policies are set to Monitor Only mode before deploying.

Deploy policies and let the AI tools run normally for a representative period.

Review the Unified Audit log. Look for executions that would be blocked under Secured Mode.

Add organization-specific rules for any project-local tooling identified.

Switch policies to Secured Mode.