FileDNA Guard
The Content Security Layer for AI agents.
FileDNA Guard sits ahead of coding agents and AI assistants, so a file an agent reads, writes, or acts on has already been verified clean — before it ever reaches the agent’s context or the disk.
How It Works
Guard hooks into an agent’s file access path, classifies where the content came from, and applies a policy — not a blanket block.
1
Intercept
Guard hooks into the agent’s file access path at one of three points: a launcher shim installed ahead of the agent in PATH, native tool-call hooks (like Claude Code’s PreToolUse event on Read/Write/Edit), or an MCP proxy that inspects file-like content returned by MCP servers before it reaches the agent’s context.
2
Classify origin
Every file is evaluated against where it came from: a developer’s own workspace, a freshly downloaded dependency or plugin, or content returned by a third-party MCP server — each origin maps to a different handling mode.
3
Decide the mode
Trusted workspace content is scanned and blocked-with-alert if something’s wrong, never silently rewritten. Untrusted content, such as new downloads, new skills, or third-party MCP output, is reconstructed either automatically or based on workspace settings.
4
Resolve atomically
A reconstructed file is written to a temporary path and atomically swapped in, so the agent never reads a half-written file, and the original is preserved unless the engine positively confirms it’s clean or fixed.
Key Capabilities
Built around how agent platforms actually intercept and time file access — not a bolt-on scanner.
Three interception points, one policy
Whichever mechanism fits your agent platform — shim, native hook, or MCP proxy — the same origin-based policy and the same FileDNA verdict apply underneath.
Fail-open or fail-closed, by design
Deployments that must never block a workflow can run fail-open; deployments where an unverifiable file should never reach an agent can run fail-closed. It’s a configuration decision, not a hidden default.
Built for the timing agent platforms actually have
Interception is designed to return well inside the timeout budgets agent platforms enforce on their own hooks, so a slow scan degrades to a fail-open/fail-closed decision instead of silently disappearing.
Scoped honestly
Guard covers an agent’s native file tools and MCP-mediated content. It does not claim to catch everything a shell command or a compiler touches directly — that’s a stated boundary, not a gap we’re hiding.
Who It’s For
Engineering teams running coding agents against real codebases, where a newly installed plugin, skill, or dependency is exactly the kind of untrusted content CADR was built for.
AI platform teams building their own agent runtime who want a content-security layer in front of file tools without building file inspection themselves.
Security teams who’ve adopted an agent-security tool for action-level guardrails and want file-content verification as the layer underneath it, not a competing product.