Sage plugin
A plugin that checks the commands, URLs and file writes an AI agent attempts and blocks the dangerous ones before they run
- 322 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The plugin sees every command, URL and file write before it runs and can block them
- URL reputation comes from a cloud service, so checked URLs leave the machine
- Scans installed plugins at session start and writes a decision log to disk
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/sageDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The plugin sees every command, URL and file write before it runs and can block them
- URL reputation comes from a cloud service, so checked URLs leave the machine
- Scans installed plugins at session start and writes a decision log to disk
This is third-party code. Review the repository files before installing.
What it does
Sage sits between the agent and the system and inspects every tool call before it runs: a shell command, a URL fetch, a file write. Checks come in layers. Cloud reputation catches malware, phishing and scam URLs. Local heuristics rely on 300+ YAML threat patterns and catch dangerous commands and links, credential exposure and obfuscation. Content the agent fetches is checked for prompt injection in two steps: heuristics first, then a fine-tuned ML model. For npm and PyPI packages the plugin checks registry existence, file reputation and package age. At session start Sage scans the plugins already installed. On Windows and WSL it adds AMSI scanning; on macOS and plain Linux that layer does nothing.
Who it is for. Developers who run Claude Code, Cursor or another agent with broad permissions and want malicious commands and links filtered automatically.
Good fit when
- The agent browses and installs packages, and you want URL and package reputation checked before install
- You need protection from prompt injection in pages and files the agent pulls into context
- You install third-party Claude Code plugins and want them scanned at session start
- The team works across several environments (Claude Code, Cursor, VS Code, OpenCode) and wants one approach to protection in each
- You want a local JSONL decision log to review blocks afterwards
Not a fit when
- You need a static audit of code or MCP servers: Sage checks the agent's actions as they happen and does not analyze project code
- The environment has no network access: URL reputation comes from a cloud check
- Limiting the agent's permissions in its own settings is enough and a separate protection layer is unnecessary
Example request
Install Sage in Claude Code and check that it blocks a script download from a suspicious URLLimitations
Sage installs separately for each environment: as a plugin in Claude Code (needs Node.js 18 or newer), as the Gen Sage extension from the marketplace in Cursor and VS Code, and as an npm package in OpenCode and OpenClaw. AMSI scanning works only on Windows and in WSL. Depending on how it was installed, the product may appear under another name, for example Norton Sage or Avast Sage. Before enabling it on work projects, read the Privacy section of the user guide: it lists what data goes to the cloud check. The code is Apache 2.0, and the threat detection rules in the threats folder use the separate Detection Rule License 1.1.
How to disable. In Claude Code remove the plugin with /plugin uninstall sage@sage, in Cursor and VS Code disable or uninstall the Gen Sage extension, in OpenCode delete @gendigital/sage-opencode from the plugin array in opencode.json. For OpenClaw use the regular OpenClaw plugin removal.
FAQ
How do I install Sage in Claude Code?
Run two commands: /plugin marketplace add https://github.com/gendigitalinc/sage.git and /plugin install sage@sage. Node.js 18 or newer is required.
Does Sage work in Cursor and VS Code?
Yes. Both have a Gen Sage extension in the marketplace. OpenCode uses the npm package @gendigital/sage-opencode, and OpenClaw has the command openclaw plugins install @gendigital/sage-openclaw.
How is Sage different from a regular antivirus?
An antivirus watches files and processes on the system. Sage intercepts the agent's tool calls before they run: a command, a URL, a file write.
Why is the plugin called Norton Sage or Avast Sage?
The product is made by Gen Digital, and depending on how it was installed it can appear under the Norton or Avast brand. The branding document in the repository has the details.
What does Sage write to disk?
A decision log in JSONL format: entries, signals and checked content. The log schema is in docs/audit-log.md in the repository.
Discussion
No questions or reviews yet.
Related
PluginsA Snyk CLI that discovers installed MCP servers, skills and agents on your machine and checks them for prompt injections and malicious payloads
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
Agentic SAST scanner: AI agents read your code, confirm findings through the call graph and scan a whole repository or a diff for pull request review
Agentic Radar analyzes multi-agent code on LangGraph, CrewAI, n8n, OpenAI Agents and AutoGen and builds an HTML report on tools and vulnerabilities
A security scanner for AI-written code: secrets, dependencies, MCP and CI, findings investigated with evidence, and fixes you approve
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| Sage (this entry) | yes | 322 | |
| HOL Guard | yes | 1,012 | a separate CLI with hooks and package-manager shims, without a cloud URL reputation check |
| CC Safety Net | no | 1,849 | a Claude Code hook for Git and file system commands only |
| Claude Hooks (Prompt Injection Defender) | no | 269 | a Claude Code hook that scans file |
README in short
Sage is part of Gen Digital's Gen Agent Trust Hub. The documentation covers the decision pipeline, the audit log and package protection.