Sage — Safety for Agents

Protect your AI coding agent from dangerous commands, malicious URLs, and harmful file operations.

What is Sage?

Sage is a security layer for AI coding assistants. It intercepts tool calls — shell commands, URL fetches, file writes — and checks them for threats before they execute. If something looks dangerous, Sage blocks it or asks you to approve.

What it protects against

• Malicious URLs — phishing, malware, and scam sites detected via cloud reputation
• Dangerous commands — reverse shells, pipe-to-curl, credential theft, data exfiltration
• Prompt injection — heuristics + a fine-tuned ML model detect injected instructions in fetched content
• Suspicious file operations — writes to sensitive paths, credential files, system configs
• Supply-chain attacks — malicious or typosquatted npm/PyPI packages
• Compromised plugins — automatic scanning of installed Cursor/VS Code extensions at activation

Install

1. Install the extension from the marketplace — see the install guide for Cursor or VS Code
2. Sage auto-enables protection on startup — no configuration needed

To verify it's working, ask your agent to run echo __sage_test_deny_cmd_a75bf229__. Sage should block this harmless canary command.

What Sage intercepts

Sage hooks into Cursor and VS Code agent tool calls:

• Shell commands — Bash, terminal execution
• File operations — Write, Edit, Delete, Read
• Web requests — URL fetches, downloads

How it works

When your AI agent makes a tool call, Sage evaluates it and returns a verdict:

Sage is designed to fail open: if anything goes wrong internally, the action proceeds. Your agent is never blocked due to a Sage error.

Commands

Open the command palette (Ctrl+Shift+P / Cmd+Shift+P):

Configuration

Sage works out of the box with no configuration. To customize behavior, edit ~/.sage/config.json or run Sage: Open config from the command palette:

{
  "sensitivity": "balanced",
  "url_check": { "enabled": true },
  "heuristics_enabled": true
}

See Configuration for all options.

VS Code vs Cursor

The extension serves both editors but installs hooks at different paths and handles different tool vocabularies.

Cursor

• Hook path: ~/.cursor/hooks.json
• MCP server: Sage registers and enables the sage MCP server automatically on startup.

VS Code

• Hook path: ~/.copilot/hooks/hooks.json — shared with Copilot CLI, so protection extends to CLI agent sessions on the same machine automatically.
• MCP server: start the sage MCP server manually via MCP: List Server → sage → Start server.

The VS Code hook runner intercepts tool names from two products that share the ~/.copilot/hooks/ path:

VS Code Copilot Chat — tool names from the ToolName enum:

Copilot CLI — tool names from the CLI command reference:

Links

• User Guide — verify install, handle alerts, manage false positives
• Configuration — all config options
• Exceptions — pattern-based allow/deny rules
• Privacy — what data is sent, what stays local
• GitHub