sage — Agent Detection & Response (ADR) for AI coding agents

What it is

Sage is an Agent Detection & Response plugin from Gen Digital Inc. that checks an AI coding agent's tool calls (shell commands, URL fetches, file writes) before they run. It may appear as Norton Sage or Avast Sage, depending on how it was installed. The page is a README and gives no detection rates, benchmarks or version numbers.

Preconditions / Affected

• Claude Code needs Node.js 18 or later.
• Cursor and VS Code use the "Gen Sage" extension from each marketplace.
• OpenClaw and OpenCode install from npm.
• AMSI integration works only on Windows and on WSL through PowerShell interop. It does nothing on macOS or on Linux outside WSL, so those platforms rely on the other layers.

What to do

Claude Code:

/plugin marketplace add https://github.com/gendigitalinc/sage.git
/plugin install sage@sage

OpenClaw:

openclaw plugins install @gendigital/sage-openclaw

OpenCode: add the package to ~/.config/opencode/opencode.json:

{
  "plugin": ["@gendigital/sage-opencode"]
}

The page points to ai.gendigital.com/sage for current install instructions, and to a User Guide for configuration and troubleshooting. It also links a separate Privacy document. Read that before enabling it, because the URL reputation layer is cloud-based and the page does not say what data it sends.

Caveats

• The two licenses differ. Source code is Apache 2.0, but the threat rules in threats/ fall under Detection Rule License 1.1, which the page does not summarize. Check its terms before reusing or redistributing the rules.
• Rule contributions follow a process described in CONTRIBUTING.md.
• The page does not describe how a blocked action is handled, whether the layers can be tuned, or what latency they add. Those details may be in the User Guide.