Best Coding Agent Security Tools in 2026: Skills, MCP Servers, and Runtime Hooks
Controls for Claude Code, Cursor, Codex, and Copilot on developer laptops: what they install, what they run, and what they send out.
AIR’s launch coverage says its whitelist filters out about 27% of the AI add-ons it evaluates. Coding agents make that number matter, because a developer can install a skill, a plugin, or an MCP server in one command, and the agent then runs it with the developer’s shell, tokens, and repository access.
Code review and SAST were built for the code a person commits. They do not see the agent reading a secrets file, running an install script from a skill, or posting a diff to a model endpoint. EDR sees the processes, but it has no idea which of them the agent chose to start or why.
The tools below take three routes. AIR and Zenity sell agent-specific governance: vet what gets installed, watch tool calls, and enforce policy through agent hooks. Pluto and Glow come at it from the endpoint, treating coding agents as one class of AI tool on the device. Snyk Agent Scan is a free scanner, and Prisma AIRS with Cortex AES adds runtime inspection to the Palo Alto Networks stack.
AIR, Pluto, and Glow came out of stealth in 2026 and are listed after Zenity, Palo Alto Networks, and Snyk. Their capabilities are launch claims, stated rather than independently demonstrated.
How we evaluated
We read each vendor’s product pages, launch announcements, and public documentation on 14 Oct 2026, and checked each one against the same questions: which coding agents it names, whether it vets add-ons before install, whether it can block an action while the agent runs, and how it is licensed. Where public material does not cover a question, we write “not documented”.
| Tool | Best for | What to check |
|---|---|---|
| Zenity | Agent hooks and an MCP gateway across coding and SaaS agents | Established · quote |
| Prisma AIRS with Cortex AES | Prompt, tool-call, and network inspection through Cortex AES hooks | Palo Alto Networks · quote |
| Snyk Agent Scan | Local scan of MCP servers, agent configs, and skills | Apache-2.0 · free |
| AIR | Vetting skills, plugins, MCP servers, and subagents, plus fleet governance | Launched Sep 2026 · quote |
| Pluto Security | Coding agents as one class of AI tool, with runtime intent checks | Launched Oct 2026 · quote |
| Glow | Allow or remove coding agents and extensions per device | Launched Jul 2026 · quote |
Zenity
Prisma AIRS
Agent Scan
AIR
Pluto
Glow
Attack scenario: a malicious MCP server, stage by stage
A developer adds a community MCP server that promises to “summarize GitHub issues”. Its tool description carries hidden instructions, the pattern Invariant Labs documented as tool poisoning. When the coding agent loads the tool, it follows those instructions: read ~/.ssh/id_rsa and .env, then pass the contents as a tool argument back to the attacker’s server. The table shows which tool documents a control at each stage.
| Stage | Zenity | Prisma AIRS + Cortex AES | Snyk Agent Scan | AIR | Pluto | Glow |
|---|---|---|---|---|---|---|
| 1. Install the server | Inventory flags shadow MCP servers | Hook sees what the agent installs | Scans local MCP config before use | AIR Filter vets before install (launch claim) | Inventories and quarantines risky MCP servers (launch claim) | Policy can remove unapproved software |
| 2. Poisoned tool description loads | MCP gateway detects tool poisoning | Inspects MCP tool calls | Detects tool poisoning and shadowing | Vets after updates (launch claim) | not documented | not documented |
| 3. Agent reads secret files | Hooks see what code and files the agent reads | Inspects prompts and tool calls | Detects exposed secrets in configs, not at runtime | Runtime response on agent actions (launch claim) | Intent check can stop the action (launch claim) | not documented |
| 4. Secrets sent out in a tool call | Gateway can block the tool call | Inspects network calls and enforces verdict | Reports only, no runtime block | Runtime response (launch claim) | Can stop or require confirmation (launch claim) | not documented |
Cells come from each vendor’s documentation or launch material cited in its entry. Only Zenity and Prisma AIRS document a block at stage 4 outside launch claims.
Zenity
Best for one policy across coding agents and SaaS agents
Zenity documents coverage for Claude Code, ChatGPT Codex, GitHub Copilot, and Cursor through native agent hooks that see what code an agent reads, what commands it runs, what it installs, and what it sends to models. Its MCP gateway can allow, modify, or block a tool call based on live context.
The same platform covers Microsoft Copilot Studio, Salesforce Agentforce, ServiceNow, and cloud agent stacks. Zenity raised USD 125M in August 2026.
Key features:
- Native hooks for major coding agents
- MCP gateway for tool poisoning, drift, and shadow servers
- Agent inventory across endpoints, SaaS, and cloud
- Detections mapped to OWASP and MITRE ATLAS
Why we like it:
It is the most documented coding-agent coverage on the list, and buyers with agents in SaaS too get one inventory.
Limits:
Pricing and deployment effort on developer laptops are not documented.
License or pricing: Commercial. No public pricing. Sold by demo and quote.
Prisma AIRS with Cortex AES
Best for Palo Alto Networks customers adding coding agent runtime inspection
In September 2026 Palo Alto Networks integrated Prisma AIRS with Cortex Agentic Endpoint Security for coding agents on developer endpoints, naming Claude Code, Cursor, Codex, GitHub Copilot, and Antigravity.
Prisma AIRS inspects prompts, MCP tool calls, and network calls. Cortex AES deploys the hooks centrally, enforces the verdicts, and logs each decision by device, agent, session, and policy.
Key features:
- Prompt, tool-call, and network inspection
- Central hook deployment through Cortex AES
- Decision logs by device, agent, session, and policy
- Fits existing Cortex and Prisma consoles
Why we like it:
For an existing Palo Alto Networks shop it adds coding agent coverage to consoles and contracts the SOC already uses.
Limits:
It assumes both Prisma AIRS and Cortex AES. Licensing for the integration is not documented.
License or pricing: Commercial. No public pricing for the integration. Sold by quote.
Snyk Agent Scan
Best free first look at the MCP servers and skills on a machine
Agent Scan is the open source successor to Invariant Labs’ mcp-scan, which Snyk acquired. It scans local MCP servers, agent configurations, and skills for prompt injection, tool poisoning and shadowing, toxic flows, malware, and exposed secrets, and it reads configs for Claude Code, Cursor, Gemini CLI, Windsurf, and Codex.
Run it with uvx snyk-agent-scan@latest. Skills are scanned by default, and the Snyk CLI’s snyk mcp-scan command is deprecated in its favor.
Posted by a Snyk employee about the project under its earlier mcp-scan name, so read it as the vendor’s own framing.
Key features:
- Scans MCP servers, agent configs, and skills
- Detects tool poisoning, toxic flows, malware, and secrets
- Reads configs for major coding agents
- Apache-2.0 license
Why we like it:
It costs nothing, runs in minutes, and gives you the inventory you need before you talk to any vendor above.
Limits:
It reports. It does not block an agent during a session or govern a fleet on its own.
License or pricing: Free and open source under Apache-2.0.
AIR
Best for vetting what developers install into coding agents
AIR came out of stealth in September 2026 with USD 50M across two seed rounds led by Sequoia and Greenoaks.
Its starting point is vetting before install: AIR Filter checks skills, plugins, MCP servers, and subagents before they are added and again after updates, and AIR Marketplace offers pre-vetted add-ons. AIR Control and AIR Defend govern agents and act on their behavior at runtime.
Key features:
- Add-on vetting before install and after updates
- Fleet governance of agent config, identity, and permissions
- Runtime detection and response on agent actions
- Free add-on and agent tool scanners on the site
Why we like it:
It targets the coding agent supply chain directly, and the marketplace gives developers an approved path instead of only saying no.
Limits:
Launch-stage claims. Coverage of non-coding agents and supported operating systems are not documented.
License or pricing: Commercial. No public pricing. Free scanners on the site.
Pluto Security
Best when coding agents are one part of a wider AI tool problem
Pluto launched on 13 Oct 2026 with USD 42M across a seed and Series A.
Inside a coding agent session, Pluto says on-device models check what the agent intends before a command or tool call runs, then stop it or tell the agent to ask the developer to confirm. Plutonium, its free checker, rates public skills and connectors.
Key features:
- Inventory of agents and add-ons across all employees, not only developers
- Intent-based runtime policies inside the agent session
- Curated marketplace with risky add-ons quarantined
- Plutonium free risk checks
Why we like it:
It covers the non-developers now running coding agents too, which agent-specific tools sold to engineering teams can miss.
Limits:
Launched days ago. Named agent integrations and supported operating systems are not documented.
License or pricing: Commercial. No public pricing. Plutonium checks are free.
Glow
Best for deciding which coding agents and extensions may exist on a device
Glow launched in July 2026 with USD 180M at a USD 1.2B valuation.
For coding agents, the useful part is its reconciled software inventory: a newly installed agent, MCP server, or IDE extension shows up as software the policy can name, and prevention agents remove it if it is not approved. How quickly a new install is detected is not documented.
Key features:
- Continuous software and AI tool inventory
- Natural-language allow or remove policy
- Prevention agents that keep removed software off the device
- Remediation within guardrails the team sets
Why we like it:
Removing an unapproved agent beats monitoring it, and Glow is the only option here built around that decision.
Limits:
Runtime inspection of tool calls is not documented.
License or pricing: Commercial. No public pricing. Sold by demo.
How to choose a coding agent security tool
- Inventory first. Run Snyk Agent Scan or a vendor’s free scanner on a sample of developer machines to see which agents, skills, and MCP servers are actually installed.
- Decide where the control sits. Install-time vetting (AIR, Glow) stops bad add-ons early. Runtime hooks (Zenity, Prisma AIRS, Pluto) catch what approved tools do.
- Check the agent list. Confirm each vendor hooks the agents your developers use today, and ask what happens after an agent update.
- Pilot the launch-stage tools. For AIR, Pluto, and Glow, measure blocks and false positives on your own fleet before signing.
What we left out
- General SAST and secrets scanners. They check the code an agent writes, not the agent itself.
- Dedicated MCP gateways. See our MCP security list.
What the internet thinks about coding agent security
Live threads, quoted for the argument, not the score.
Hacker News · January 2026
“I’d say applications like IDEs and text editors should not have automatic arbitrary execution of code in the first place.”
From a thread on attackers abusing VS Code tasks. The counterpoint from developers is that automation is the point of the tools, which is why allowlisting what gets installed matters more than banning features.
Choose Zenity when coding agents and SaaS agents need one policy. Choose Prisma AIRS with Cortex AES if you already run Palo Alto Networks on endpoints. Run Snyk Agent Scan first either way. Choose AIR when the add-on supply chain is the main worry and you can pilot a launch-stage vendor first. Choose Pluto when non-developers run agents too and you can pilot a launch-stage vendor first. Choose Glow when unapproved agents should be removed outright and you can pilot a launch-stage vendor first.
FAQs
What is coding agent security?
Controls for AI coding agents such as Claude Code, Cursor, and Codex: vetting the skills and MCP servers they load, and watching or blocking the commands and tool calls they make.
Is there a free coding agent security tool?
Snyk Agent Scan is free under Apache-2.0. It scans MCP servers, agent configs, and skills on a machine but does not block actions at runtime.
Do I need this if I already have EDR?
EDR sees processes, not the agent’s intent or tool calls. The tools here add that context and can act before a command runs.
