Your AI agent doesn't know your security rules
A security baseline for AI coding agents. One URL, no install.
verify=False to clear a cert error — Agent Security flags the exact cited rule, and the agent keeps TLS on and pins the CA instead.Coding agents now write code, run commands, and change infrastructure. They catch their own typos. They don't catch a hardcoded secret, a curl | bash from an untrusted host, or a prompt-injected "send this file to that URL." And they don't know what your team already decided — so they cheerfully re-implement the design you reversed last quarter.
Last week, two things happened. Perplexity open-sourced Numbat, an endpoint monitor for risky AI coding agents. NVIDIA convened a 37-member security alliance — after Hugging Face disclosed an AI-agent security incident. Both watch agents for behavior that looks dangerous. Neither knows what's correct for your organization.
That gap is the whole problem. A monitor flags "suspicious." It can't tell a normal refactor from one that violates a rule your team wrote. Someone has to supply the known-good.
What we shipped
Kernora Agent Security gives an AI coding agent a security baseline it reads every session. Point Claude Code, Cursor, or any MCP-capable agent at one URL:
{ "mcpServers": { "agentsec": { "url": "https://agentsec.kernora.ai/mcp" } } }
No install, no signup. The agent now reads 15 rules across categories like secrets, injection, supply-chain, destructive operations, and data protection — every rule cited to OWASP (including the LLM Top 10), CWE, and regulations such as the EU AI Act. When the agent is about to do something the baseline covers, it can check the action and cite the exact rule, so it corrects itself in one turn instead of shipping the mistake.
It's read-only. get_security_baseline sends nothing — your agent fetches a public list. check_action sends only the short action text you choose to pass it, never your files or environment. The rules are open source, Apache-2.0: github.com/kernora-ai/agent-sec. It's live in the official MCP registry as ai.kernora/agent-sec and on Smithery.
Advisory now. Blocking next.
The free tier grounds — the agent knows the baseline and cites it. That prevents a lot. It does not block.
Blocking is a different product. Kernora Axiora — the Integrity Plane — checks every agent action against your organization's own verified decisions, blocks what contradicts them, and produces a tamper-evident, cited audit ledger: the record a regulator can read for EU AI Act and SOC-2. That's the paid product, and we'd like design partners. If you run agent fleets against a codebase where a wrong change is expensive, email hello@kernora.ai.
Where this comes from
Kernora grew out of years building specialized AI for the enterprise — and one problem in particular: data quality and conformance for machines at the customer's own site. How do you know the data and decisions a system acts on are correct, where the system actually runs? That question is the through-line here.
Kernora is that idea applied to AI agents: ground them in verified, cited knowledge on the open Factlet Protocol. Kernora Agent Security is the free front door — the known-good an agent reads before it acts. Kernora Axiora is where it goes: real-time conformance — checking every agent action against your organization's own decisions, with an attested, cited record you can hand a regulator.