From Mexico, I let coding agents read files, run shell commands and call tools on my machine every day. Each step looks harmless on its own. That’s exactly the problem Adversa AI says it’s going after. On October 29, the Tel Aviv company launched its Coding Agent Security Platform for Developer Endpoints, which it says connects what agents like Claude Code and Codex are asked to do with what they actually do, in real time, and blocks the dangerous step before it runs. The press release on PR Newswire went out the same day.
Chains, not single actions
The core idea is a behavior graph. Instead of judging one tool call at a time, the platform links model calls, tool and MCP calls, file access and outbound connections into a chain, and scores the risk as the chain builds. Adversa says it ships with more than 300 default policies across security, reliability and privacy, and that it follows the Cloud Security Alliance’s AARM standard for agentic runtime security.
It watches from four places, per the product page: a gateway on the agents’ own model and MCP traffic, endpoint sensors on developer machines that only track agent actions (not the developer’s), native hooks in agent harnesses, and the compliance APIs of the big agent vendors. It also tries to inventory the agentic supply chain: MCP servers, skills, hooks, plugins and instruction files.
The numbers are the vendor’s
Adversa reports that at one financial institution securing Codex, Claude Code and Copilot, blocking decisions took a median 0.2 ms, correlation cut the noise to one confirmed incident per 2,000 raw signals, and in week one it stopped a real chain: an agent loaded a malicious skill, followed its hidden instructions, read internal API secrets and tried to send them out. It also claims its Context Guard hits a 0.1% false-positive rate on public benchmarks. I haven’t seen independent numbers yet, so I’m reading all of that as vendor-reported.
One more thing to square: the release says the platform is generally available, while the product page says it’s in early access with first production deployments live and pilots run with the founding team. If you’re evaluating it, ask which one applies to you.
What I’d check first
- Start in observe mode, which the product page says is the default path, and look at what your agents really touch before turning on blocking.
- Ask how the endpoint sensor separates agent actions from your own, and where that data lives.
- Test the malicious-skill scenario yourself with a harmless canary secret.
- Check what the developer sees when a step gets blocked, because a confusing error just teaches people to turn the thing off.
My take: the skill-loading attack in that anecdote is the one that worries me most, since I install skills and MCP servers way faster than I review them. A tool that thinks in chains instead of single commands is the right shape for the problem. Whether this one delivers is something I’d want to see on my own repos first.
Hero photo: level crossing barrier in Ziersdorf by Linie29, CC BY 4.0, cropped and resized. Schematic: original by Tech & AI Pulse.
