Sage is a lightweight security layer that intercepts dangerous commands, malicious URLs, and credential leaks — catching threats before your AI agent executes them.
Get Started
Pick your platform. Sage runs silently in the background — zero config needed.
# From npm (recommended)openclaw plugins install @gendigital/sage-openclaw
Detection
Multiple detection layers working together — from local pattern matching to cloud-based reputation checks.
Reverse shells, pipe-to-shell attacks, destructive actions like rm -rf /, privilege escalation, and download-and-execute chains.
Cloud-based reputation checks catch malware hosting, phishing, scam sites, and suspicious executable downloads.
Detects API key patterns (AWS, OpenAI, GitHub), credential file reads, .env exposure, and SSH key access before they leave your machine.
Verifies npm/PyPI packages exist, checks for typosquatting, flags suspiciously new packages, and validates file reputation via hash checks.
Catches base64 decode-and-execute chains, hex escapes, eval() on untrusted input, and string concatenation tricks.
Flags cron job installs, systemd unit files, shell RC modifications, LaunchAgents, git hooks, and attempts to disable Sage itself.
Architecture
Sage hooks into your agent's tool calls and analyzes them before execution.
Your AI agent issues a tool call — a bash command, URL fetch, or file write. Sage intercepts it before execution.
Sage extracts artifacts: URLs, shell commands, file paths, package names, and content patterns from the tool input.
Extracted artifacts are checked against local YAML heuristics, URL reputation APIs, and package supply-chain checks — all in parallel.
The decision engine combines all signals into a verdict: allow, ask, or deny. Results are cached and audit-logged.
No threats detected. The tool call proceeds normally.
Suspicious activity. You're prompted to review before execution.
Confirmed threat. The tool call is blocked automatically.
Philosophy
Security that stays out of your way until it matters.
If Sage errors, your agent keeps working. Every error path returns an allow verdict. Security should never break your workflow.
Only URLs and package hashes are sent to reputation APIs. Commands, file content, and source code never leave your machine.
All threat patterns live in YAML files — not hardcoded. Easy to audit, extend, and contribute new rules without touching code.
Three presets: paranoid, balanced, relaxed that let you tune how aggressively Sage flags actions.
Install and go. No API keys needed for basic protection. URL reputation and supply-chain checks work out of the box.
Apache 2.0 licensed. Inspect every line, contribute rules, or fork it. Security through transparency.