Cline Integration

Connect Cline to Capsule Security for complete visibility into AI coding assistant activity in VS Code, including prompts, tool execution, and task lifecycle.

This integration uses Cline's hooks system. Capsule generates a cline-hooks.json containing one hook script per Cline event, each posting the event to Capsule with an embedded authentication token scoped to your organization. Separate Mac/Linux and Windows variants are available.

The following hooks are configured:

Before you begin, ensure you have:

• VS Code with the Cline extension installed
• A Capsule Security account with admin access

1. Log in to the Capsule Security portal

2. Navigate to Integrations and locate Cline

3. Click Install - Capsule generates the hook scripts with an embedded authentication token scoped to your organization

4. Select your platform (Mac, Linux, or Windows) to download cline-hooks.json

Copy the downloaded file into the Cline hooks directory for your platform:

To scope the hooks to a single repository instead, place the file in .clinerules/hooks/ in the project root.

1. Open VS Code with the Cline extension installed
2. Open the Cline sidebar panel
3. Navigate to the Hooks tab
4. Verify the Capsule hooks are listed and toggle them on

1. Start a Cline task in VS Code and let it run a simple action, for example:

   Create a new file called test.txt with the content "Hello World"

2. Log in to the Capsule Security portal

3. Navigate to Inventory > Agents and confirm the agent appears

4. Click on the agent and review the audit logs to verify events are captured:

   • Task start
   • User prompt
   • Tool invocations

5. To view the full conversation, navigate to Observability and filter by Activity Type - Session

If events do not appear:

1. Verify the file location - cline-hooks.json must be in the Cline hooks directory for your platform, or under .clinerules/hooks/ in the project you are working in

2. Confirm the hooks are enabled in the Cline Hooks tab - hooks placed on disk stay off until toggled on

3. Confirm the platform variant matches - the Windows download uses PowerShell hook commands and the Mac/Linux download uses shell commands; they are not interchangeable

4. Check token expiration - tokens are valid for 365 days; an expired token requires regenerating the hook scripts from the portal

5. Contact Capsule Security support if issues persist

UserPromptSubmit and PreToolUse are blocking hooks: Capsule evaluates the prompt or tool call server-side and returns a decision before Cline proceeds. The remaining hooks are observation-only.

To enforce policies on Cline activity:

1. Navigate to Policies in the portal
2. Define or assign policies that target Cline agents
3. Violations surface under Detections

Hook scripts execute with the signed-in user's environment credentials. Before deploying them:

1. Review the hook commands in the generated cline-hooks.json
2. Verify the endpoint URL matches your organization's Capsule instance
3. Protect the authentication token embedded in the scripts - never commit cline-hooks.json to version control

For help with this integration:

• Email: support@capsule.security
• Include: your organization ID, the platform the hook scripts were installed on, and any error messages

• Cline Hooks Documentation
• Capsule Policies
• Capsule Webhook Events