Endor Labs + Google Antigravity: Secure code by default in agentic workflows

Endor Labs has launched a new plugin for Google Antigravity's Plugin marketplace, integrating Endor Labs' AURI agents into the platform with one-click setup. This integration embeds security checks and fixes directly into the agent's workflow while code is being written, shifting security review from post-session to in-process. The system introduces an Endor Labs MCP server that provides the Antigravity agent with security context during development. AURI Agents are pre-built security agents offering specific tasks like SCA Remediation, AI SAST Triage, Dependency Decision Helper, and Vulnerability Explainer. These agents utilize Endor Labs data for reachability, upgrade impact, and policies to automate security tasks. Benchmarks show that AURI Agents complete security tasks 2.8 times faster and use 12 times fewer tokens than general-purpose agents.

The narrative centers on shifting security from an external, retrospective review to an intrinsic, proactive component of the agentic development workflow. The core implication is that achieving production-grade security in AI-generated code requires embedding verifiable security context directly into the planning and execution phase, rather than applying it as a post-hoc filter. This approach leverages specialized agent capabilities (AURI) grounded in domain-specific knowledge to manage complex supply chain risks automatically. The performance metrics—2.8x faster and 12x fewer tokens compared to general agents—suggest that integrating security context is not an overhead but a net efficiency gain, framing security as an accelerator rather than a bottleneck. However, the dependence on an agent's internal "context" (the MCP server) to guarantee security raises questions about the integrity of that context itself. If the foundation of trust rests on Endor Labs' definitions of reachability and vulnerability impact, what happens when those definitions are incomplete or biased? The pattern observed is a move toward compartmentalizing responsibility, where specialized systems handle specific risks within an overarching agentic framework. This structure shifts agency: the agent becomes not just a coder, but a self-governing security auditor operating within the development cycle.