Govern Qwen Code with Agentic Control Plane
See, control, and price every tool call Qwen Code makes — shell, file edits, MCP — from one dashboard. Qwen Code's hooks are Claude Code's contract, so this is the same hook, one file.
TL;DR
curl -sf https://agenticcontrolplane.com/install.sh | bash
The installer detects Qwen Code (~/.qwen or qwen on your PATH), merges PreToolUse and PostToolUse hooks plus the ACP MCP connector into ~/.qwen/settings.json, and opens your browser once to provision a workspace and save the key to ~/.acp/credentials. Restart Qwen Code. Every tool call is governed from the next session.
What the installer writes
{
"hooks": {
"PreToolUse": [{ "matcher": "*", "hooks": [{ "type": "command", "name": "acp", "command": "env ACP_CLIENT=qwen-code node $HOME/.acp/govern.mjs", "timeout": 5000 }] }],
"PostToolUse": [{ "matcher": "*", "hooks": [{ "type": "command", "name": "acp", "command": "env ACP_CLIENT=qwen-code node $HOME/.acp/govern.mjs", "timeout": 5000 }] }]
},
"mcpServers": { "acp": { "command": "sh", "args": ["-c", "exec npx -y mcp-remote https://api.agenticcontrolplane.com/mcp --header \"Authorization: Bearer $(cat ~/.acp/credentials)\""] } }
}
Existing hooks and MCP servers are preserved; re-running the installer replaces only its own entries. The user-level file is used because project-level hooks require folder trust and user-level hooks do not. If disableAllHooks is set, the installer warns and nothing runs until it is removed.
How it works
- Before each call (
PreToolUse): the hook sends the tool name and arguments to your workspace policy and returnsallow,askordeny. A deny ispermissionDecision: "deny"with the reason shown to the model. An ask prompts you in the interactive session; in headless runs Qwen Code resolves it to a deny, by its own rule. - After each call (
PostToolUse): the tool output is recorded and scanned, and the session’s model usage is priced from the transcript. - Every mode. The hook runs in
plan,default,auto-edit,autoandyolo. Qwen Code’s own approval mode decides whether it prompts; the hook decides whether the call runs. - Fail-open by default. If the gateway is unreachable, attended sessions continue with a loud warning and the lapse is logged locally; set
echo closed > ~/.acp/failmodeto fail closed instead.
Verified
Wired inside a fresh Linux container under the Terminal-Bench runner on 2026-09-03 with Qwen Code 0.23.0: the hook fired on the first tool call and the session appeared in the workspace’s runs API under the qwen-code client name.
Uninstall
Remove the two acp entries under hooks and the acp entry under mcpServers in ~/.qwen/settings.json.