Guardian Agent for Developers: Preventing and AutoFixing Agentic Development Risks

Published July 28 2026 · 9 min. read

## The Problem: The Backlog Is Unwinnable The speed of development, the persistence of dependency changes, and the [explosion of AI code generation](https://apiiro.com/blog/half-of-googles-code-is-now-ai-generated-heres-what-that-means-for-security-leaders/) have led to a similarly sized [explosion of the attack surface](https://apiiro.com/blog/attack-surface/). Up to 5x new risks can now enter the codebase through the new default of agentic development: AI-generated code and automated changes across the development workflow. In addition, frontier models can now find and exploit vulnerabilities on their own, and the window between a risk appearing and a risk being exploited [is shrinking to hours, not days](https://zerodayclock.com/). Finding vulnerabilities was the hard part for a long time. It isn't anymore. The hard part now is fixing and preventing them fast enough to matter. Detection-first AppSec was built for the opposite problem. Issues that get found after code is written, after dependencies are added, after secrets are committed, or after a pull request is opened are all forcing developers to stop what they are doing, understand the finding, investigate the fix, and retroactively remediate the issue. Such a reactive model does not scale in an agentic development world. ## Apiiro Guardian for Developers [Apiiro Guardian Agent](https://apiiro.com/blog/apiiro-guardian-agent/) is built around a simple principle: > Prevent risks before they enter the codebase. AutoFix what already got in. This is the needed shift in agentic development: > From bolt-on, after-the-fact detection and prioritization, to developer-native, built-in prevention and remediation. We have built the Guardian Agent to be available where engineering and security teams work, so it can be operationalized across multiple interfaces and interception points in the development process.  ## Prevention: Stop Risk Before It Enters the Codebase The best vulnerability or misconfiguration is the one that never gets committed. Most "shift-left" security still waits for the code to exist, scanning at save, commit, or push. Then, security asks a developer or agent to fix what it finds. Guardian starts one step earlier: it shapes the code as it's being generated, so the risky version is never written. Prevention works in two layers: - **Secure Prompt** prevents the risk from ever being generated, so there's nothing to fix. - **Secure Code (pre-commit)** is the safety net. It catches what the prompt layer didn't cover, or risk that didn't come from a prompt at all.  ### Secure Prompt: Secure-by-Design AI-Generated Code AI agents are powerful, but they do not automatically generate world-class secure code aligned to specific organizational policies. A developer may ask a coding agent to generate code, and the agent may return something that works functionally, but violates security or compliance expectations. For example, AI-generated code may: - Miss access-control checks - Miss input validation - Introduce risky configuration - Leak secrets and sensitive data - Use insecure authentication patterns - Use unapproved dependencies - Ignore license restrictions - Generate code that conflicts with internal policies Preventing all of these requires accurate dynamic guidance of the agent for safe and compliant code generation. Guardian's Secure Prompt does exactly that. It brings the Apiiro Data Fabric (the organization's policies, software architecture, application context, compliance requirements, and risk priorities) seamlessly into each of the relevant prompts. ### Example: Secure Prompt in Action A developer asks a coding agent: > "Create an API endpoint that accepts customer information and stores it." Without policy context, the AI may generate code that works, but misses important safeguards. With Secure Prompt, the agent can be guided to consider: - Required input validation - Approved authentication patterns - Sensitive data handling rules - Logging restrictions - Dependency and license policies - Relevant compliance requirements - Application-specific risk context The result is faster and safer code generation. Guardian shifts security from reviewing AI-generated code after it appears, to influencing the code before it is created. **Original Prompt** ``` Add GET /api/v1/analytics/messages/search in routers/analytics.py ⎿ UserPromptSubmit says: Apiiro enrichment applied: ``` **Apiiro Guardian Enriched Prompt** ``` Authentication: Authenticate callers as administrators using Authlib Python (see backend/open_webui/config.py:19) or Microsoft Entra Python (see backend/open_webui/routers/openai.py:13); this endpoint must only be accessible to authorized administrators. Authorization: Implement object-level authorization to ensure administrators can only access feedback records they are permitted to view. The repository_profile insight "Missing authorization" indicates this is a common issue. ```  💡 👉 To see in detail how Secure Prompt prevents 80% of risks, read our [deep-dive test case](https://apiiro.com/blog/preventing-the-risks-ai-ships-healthcare-organization-achieves-80-risk-elimination-with-guardian-agent/). And to see how Guardian achieves risk elimination at Fortune 500 enterprise scale, read the [results of our latest PoC](https://apiiro.com/blog/preventing-the-risks-ai-ships-healthcare-organization-achieves-80-risk-elimination-with-guardian-agent/). ### Secure Code: Verify the Code Pre-Commit As a second defense-in-depth layer, Guardian performs a security code review and fix for code generated by the agent before it enters the branch, through pre-commit protection. The pre-commit verification includes prevention of: - **SAST risks**, using Guardian AI SAST - **OSS packages with vulnerabilities or unsanctioned licenses**, using Guardian AI SCA - **Malicious open source packages** carrying malware or backdoors, caught before they're pulled into the build, using Guardian AI SCA - **Secrets risks**, using Guardian secrets scanner - **Infra-as-Code risks**, using Guardian IaC scanner - **Secure coding policy violations**, using Guardian code patterns scanner - Plus additional scanners in our roadmap **When any of these risks are identified by Guardian, they are sent back to the coding agent with clear evidence and fix instructions.** This matters because timing changes risk; a secret detected after a commit becomes an incident, a vulnerable dependency detected after merge becomes backlog, and a policy violation detected after CI becomes rework. See the [breakdown of cost across these three stages](https://apiiro.com/blog/preventing-the-risks-ai-ships-healthcare-organization-achieves-80-risk-elimination-with-guardian-agent/) in one [Fortune 500 healthcare organization's high-business-impact codebase](https://apiiro.com/blog/preventing-the-risks-ai-ships-healthcare-organization-achieves-80-risk-elimination-with-guardian-agent). With Guardian, the issues are detected and surfaced before commit, so the agent can fix them immediately while the context is still fresh. ### Example: Preventing a Malicious Package - The clearest test of a prevention layer is a risk that detection tooling structurally cannot see. Malicious packages are that test: there is no CVE to match, no advisory to look up, and no severity score to sort by. The package is simply hostile, and by the time a scanner keyed on advisories has an entry for it, the credentials are already gone. - Here, a developer asks a coding agent to do something entirely routine: "commit the staged dependency bump."  *A coding agent tries to commit `@ctrl/tinycolor@4.1.1`. Apiiro's pre-commit hook fires, flags it as a critical malicious package, and the commit never lands.* What happens in those few seconds: 1. **The agent does its job.** It inspects the staged diff, confirms the change, and runs `git commit`. 2. **Guardian's pre-commit hook intercepts.** The Apiiro Combined Fast Scan runs against the staged change and returns `Total New Risks: 1`. The commit exits with code 1. 3. **The finding is specific, not generic.** `@ctrl/tinycolor@4.1.1` is identified as a critical malicious package, one of the 500+ packages trojanized in the Shai-Hulud npm worm of September 2025. 4. **The agent stops, and explains why.** With the block and its evidence returned to the agent, it reports the finding in context, states plainly that it has not bypassed the hook and will not commit as-is, and recommends the two safe paths: revert to the original `^4.1.0` range, or pin to a version confirmed clean after the incident. That last beat is the one worth sitting with. The agent was mid-task, in auto mode, with every incentive to finish. It did not work around the control, because the control was not a suggestion it could weigh; it was a hook that fired at a fixed point in the workflow, with evidence the agent could reason about. **Advisory tooling asks an agent to cooperate. Enforcement does not depend on it.** ## Remediation: AutoFix Risks with Context Prevention is the first line of defense, focused on newly generated code. But it can't solve risks that are already in the codebase, nor discover new risks in existing codebases when new vulnerabilities are disclosed, or existing dependencies become deprecated. That is why Guardian Agent also includes **AutoFix for developers.** **AutoFix helps developers remediate issues directly inside their workflow, without needing to leave the IDE, terminal, or AI coding environment.** When Guardian identifies a risk, or if the risk was sourced from an existing 3rd party scanner, the agent leverages the Data Fabric to instantly answer: *What exactly is the risk? Where does it exist? Is it built, deployed, reachable or used? Why does it matter? Which policy does it violate? What is the right fix? Will the fix break anything?* After answering these questions, Guardian will: - Explain the issue in context - Provide evidence for the exploitation likelihood and impact of that risk - Recommend a safe remediation path based on the risk exploitation path, software architecture, call flow, existing code and organizational policies - Define a fix safety check process - Validate that the issue is resolved All automatically, instantly and accurately. This changes remediation from a manual static recommendation into an automated, dynamic action, applied before the vulnerability enters the codebase, where the cost of a fix is a fraction of what it is after. ### Example: AutoFix a SAST Risk with Guardian CLI or MCP **A developer asks for a fix, not a report:** "fix my top 3 SAST risks in this repo."  - Guardian pulls the repo's **833 open risks** from the Data Fabric and narrows to critical Apiiro AI-SAST findings. - For each one, **Guardian returns the exact flagged construct**, its **exploitation path, and a remediation grounded** in *this* repository's **architecture**. - Because Guardian maps the call flow, the fix lands at the **root cause**, not the symptom. One **patch closes both call sites**, and the identical defect is found in a second file the finding never mentioned. ### Example: AutoFix an SCA Risk with Guardian IDE Extension  - The Guardian extension surfaces the repo's full risk picture inside VS Code, **119 risks** across Secrets, SCA, and SAST. - Selecting a finding opens it against the line that declares it. `pug@2.0.4`, a **direct dependency** in `package.json`. - The Data Fabric supplies what the advisory can't. - **Provenance:** the risk entered through a top-level dependency declared in a specific upstream manifest, linked directly. - **Supply-chain health:** low maintainer count, sparse commits. - And **reachability**, `pug` is declared but not imported anywhere in code. - Fixability is decided before the developer touches anything: **2 of 2 introduced vulnerabilities are fixable**. - From the **Remediation** tab, the fix is applied in place and re-validated, same editor, same file, no ticket, no dashboard, no context switch. ## How Guardian Integrates Across Developer Workflows Guardian is designed to meet developers where they already work. It can be delivered through Apiiro's developer integrations, plugins, CLI, hooks, skills, MCP server, and IDE extension. Every interface is powered by the same Guardian Agent and the same Data Fabric, so prevention and remediation behave identically whether a developer is in the terminal, in an IDE, or running a fully autonomous agent. ### Guardian Plugin and CLI Apiiro plugins are powered by the [Apiiro CLI](https://apiiro.com/blog/security-tools-were-built-for-humans-we-built-one-for-ai-agents-introducing-apiiro-cli/) and are designed to bring Guardian capabilities into agentic development environments. These plugins can support prevention and remediation across all leading Agents and IDEs: - Claude - Cursor - Codex - GH Copilot - Devin ### Guardian Skills Apiiro plugins include a set of skills that support secure development workflows: | Skill | Purpose | | --- | --- | | **guardian-fix** | Helps remediate identified risks | | **guardian-query** | Provides Guardian guidance and secure development assistance | | **guardian-setup** | Helps configure the Apiiro developer workflow | | **guardian-secure-prompt** | Adds policy-aware security context to AI prompts | | **guardian-threat-model** | Helps reason about design and architecture risk | | **guardian-risks** | Surfaces relevant Apiiro risk context | | **guardian-scan** | Runs scans from the developer workflow | In addition to working on their own, Guardian's skills can be chained into playbooks. A developer (or an agent) can run intent → threat-model → secure-prompt → build → scan in sequence: understand the change, model its risk, enrich the prompt, generate secure code and verify it. **Try it:** Fix production risk without leaving the terminal. "Find risks with the biggest production impact on this repo, trace each to the code that introduced it, apply the fix, and open a PR." Behind the scenes, Guardian pulls the risks and their context from the Data Fabric, traces each to the responsible code and owner, guides the agent to generate a policy-aligned verified fix, and opens the pull request – all from the developer's existing workflow. ### Guardian Hooks AI coding agents increasingly run unattended, generating and committing code without stopping to ask. Guardian's hooks fire at fixed points in the workflow (before a prompt runs, before a commit lands) whether or not a human is watching. This way prevention doesn't depend on the developer remembering to trigger an MCP tool, and it doesn't switch off when the agent runs on its own. | Hook Stage | Purpose | | --- | --- | | **Before Prompt Execution** | Applies Secure Prompt enrichment | | **Before Git Commit** | Applies Secure Code scanning and blocking | ### Guardian MCP The Apiiro MCP server connects any MCP-compatible AI assistant or agent directly to the Guardian Agent and the Data Fabric. Through the open MCP standard, agents get Guardian's capabilities as tools they can invoke on demand, in Claude, Cursor, Copilot, or any custom agent with no Apiiro-specific integration work. MCP is the on-demand interface. Tools run only when the agent chooses to call them, and results are advisory. By design, MCP is not an enforcement mechanism. The protocol has no fixed workflow points to intercept. Enforcement is delivered by the Apiiro plugin, which wraps the CLI and installs Guardian Hooks that fire whether or not the agent acts. **Try it:** from any MCP-connected assistant, ask "does this repo handle PII, and are any of its API endpoints missing authorization?" The assistant resolves the repo in Apiiro, queries the Data Fabric, and answers with the exact endpoints and the code behind them. ### Guardian IDE Extension For IDE-based development, Apiiro also provides the Guardian extension, supported in VS Code and JetBrains. This gives developers a direct remediation experience inside the IDE, allowing them to understand and fix risks without leaving their coding environment. ## Where We Are Heading This is a starting point. We're adding more scanners to the pre-commit layer, better integrating Guardian Secure Prompt and [AI Threat Modeling](https://apiiro.ai/blog/introducing-ai-threat-modeling/), deepening the context Guardian grounds on so every prompt and every fix gets sharper over time. Guardian also learns your organization's policies and each developer's patterns through organizational memory, so guidance gets more precise the more it's used. AI has changed how software is created. Security needs to change where it operates. Late detection, manual triage, and disconnected remediation cannot keep up with agentic development. With Guardian, securing code becomes actionable, seamless and continuous: Prevent risk before it enters the codebase. AutoFix what remains. Deliver it where developers already work. [See Guardian in action](https://apiiro.com/demo).

Itay Nussbaum