The project applies the term Agent Detection & Response (ADR) to this class of tooling. The name is a deliberate parallel to the endpoint detection and response (EDR) category that has been standard in enterprise security for over a decade.
What Sage does
Sage works through hook systems native to the agent platforms it supports. It intercepts tool calls, including Bash commands, URL fetches, and file writes, in Claude Code, Cursor/VS Code, and OpenClaw.
Each intercepted action passes through several detection layers. URL reputation checking runs cloud-based malware, phishing, and scam detection. Local heuristics use YAML-based threat definitions for dangerous patterns. Package supply-chain checks cover registry existence, file reputation, and age analysis for npm and PyPI packages. Plugin scanning runs at session start and checks other installed plugins for threats.
Källa: Helpnetsecurity
