---
schema_version: "newruntime-agent-readable-v0.2"
type: "post"
stable_id: "post:cline-hooks-agent-harness-guardrails"
slug: "cline-hooks-agent-harness-guardrails"
title: "Cline Hooks Put Deterministic Rules Inside The Agent Loop"
description: "Cline's plugin hooks show how an agent harness can journal every run and block dangerous tool calls without waiting for the model to choose a guardrail."
retrieval_nugget: "Cline's plugin hooks show how an agent harness can journal every run and block dangerous tool calls without waiting for the model to choose a guardrail. An MCP server exposes tools that a model may choose to call. A harness plugin solves a different problem: its hooks run automatically at defined points in the loop."
status: "published"
published_at: "2026-08-03"
updated_at: "2026-08-03"
record_date: "2026-08-03"
date_kind: "published_at"
topics: ["agent-harnesses","coding-agents","mcp","observability"]
source_urls: ["https://cline.bot/blog/extend-cline-with-plugins-and-hooks"]
visuals: [{"id":"cline-hooks-agent-harness-guardrails","kind":"editorial-diagram","role":"hero","src":"https://newruntime.com/images/posts/cline-hooks-agent-harness-guardrails.webp","alt":"Hand-drawn agent loop with fixed hook points before and after runs, model calls, and tool calls, including a journal path and a deterministic block gate before a destructive command executes.","caption":"MCP expands the tools an agent may choose; harness hooks run automatically at fixed lifecycle boundaries.","credit":"New Runtime synthesis from Cline","source_url":"https://cline.bot/blog/extend-cline-with-plugins-and-hooks","generated_with":"gemini-3.1-flash-image","width":1600,"height":900,"legend":[{"label":"Observe","description":"Run and tool hooks can record status, duration, iterations, token use, and cost."},{"label":"Block","description":"A before-tool hook can reject a destructive operation before execution."},{"label":"Rewrite","description":"Model and tool boundaries can redact input or transform returned results."},{"label":"Reuse","description":"One plugin can attach to CLI, editor, and SDK versions of the same harness."}]}]
routes: {"html":"https://newruntime.com/posts/cline-hooks-agent-harness-guardrails/","markdown":"https://newruntime.com/posts/cline-hooks-agent-harness-guardrails.md","json":"https://newruntime.com/posts/cline-hooks-agent-harness-guardrails.json"}
source_format: "markdown"
---

# Cline Hooks Put Deterministic Rules Inside The Agent Loop

## Retrieval answer

Cline's plugin hooks show how an agent harness can journal every run and block dangerous tool calls without waiting for the model to choose a guardrail. An MCP server exposes tools that a model may choose to call. A harness plugin solves a different problem: its hooks run automatically at defined points in the loop.

An MCP server exposes tools that a model may choose to call. A harness plugin solves a different problem: its hooks run automatically at defined points in the loop. That distinction makes hooks useful for controls that cannot depend on model initiative.

Cline packages a plugin as one object that can be reused across its CLI, VS Code, JetBrains, and SDK surfaces. Seven lifecycle boundaries cover the whole run, individual tool calls, model calls, and streamed events: `beforeRun`, `afterRun`, `beforeTool`, `afterTool`, `beforeModel`, `afterModel`, and `onEvent`.

The first example is an execution journal. A `beforeRun` hook records the start, while `afterRun` appends duration, status, iterations, input and output tokens, and total cost to a JSONL file. Because failed and aborted runs also reach the hook, the journal records outcomes rather than assuming completion.

The second example is a deterministic tool guard. A `beforeTool` hook inspects shell commands and returns `skip: true` when a pattern matches operations such as recursive deletion, forced pushes, filesystem formatting, or destructive database commands. The tool never executes, and the reason returns to the agent so the loop can finish honestly.

The same boundaries can redact secrets before a model call, send progress events to an interface, rewrite tool results, or emit operational metrics. The SDK runner installs journal and guard plugins together through its extensions configuration, keeping the policy separate from the prompt that defines the task.

For New Runtime, this is a practical separation of concerns. MCP remains the capability surface. Plugins become the deterministic enforcement and observation layer. Prompts can describe policy, but controls that must always run belong at lifecycle boundaries owned by the harness.