RAD Security's AgentKeeper governs AI coding and productivity agents: hooks in Claude Code, Cursor, Copilot, Windsurf, Codex CLI and Gemini CLI evaluate actions on the developer's workstation, and an MCP Gateway routes tool calls. Smartflow is an inline control plane on the request path, on the customer's own infrastructure, applying policy to every model call and MCP tool call routed through it. Both decide before an action runs. They diverge on what each can reach, on who decides and what the record shows, and on where the control plane can run.
The short version
AgentKeeper is built for the developer workstation. RAD says it "evaluates each action before it runs," starts free for one workstation, and moves teams from monitor mode to enforcement by tool, group, repo or path. A security team rolling out coding agents should have it on the list.
For a regulated buyer, three narrow lines decide it: agents that run beyond the laptop, a re-verified person deciding a consequential action on the record, and a control plane that runs air-gapped.
Feature Comparison
| Capability | Smartflow | AgentKeeper |
|---|---|---|
| Primary job | Runtime enforcement inline at the gateway, on every model call and MCP tool call routed through it. | Governs AI coding and productivity agents: finds the agents in use, applies monitor, warn or block policy, and records each decision. |
| Enforcement point | The request path. Policy is evaluated before the prompt reaches the model and before a tool call executes. | Hooks inside each supported agent, with "pre-execution enforcement where supported integrations expose that control point," plus an MCP Gateway. Cursor file edits are audit-only. |
| Coverage | Every call routed through the gateway, from any origin. | Claude Code, Claude Cowork, Claude Chat, Cursor, Copilot agent mode in VS Code, Windsurf, Codex CLI, Gemini CLI and Google Antigravity IDE. Browser extension and custom agent support are listed on Enterprise. |
| What it inspects | Inline content inspection: PII, prompt injection, output moderation. | The agent's "reads, writes, commands, fetches, and prompts," with detections for secret leakage, prompt injection and data exfiltration, and guardrails for credentials, PHI and PII. |
| When a person must decide | The action pauses as an approval ticket until someone with approval rights approves or denies it. With step-up, set per action, the approver re-verifies their identity before the approval counts. | Monitor, warn or block, set through org policy, group overrides, blocked tools and sensitive path controls. RAD also mentions an "ask" verdict and controls that "require approval"; who approves, and how, is not documented. |
| Evidence | A record of each decision, bound to the human who owns the agent, hash-chained, time-stamped under RFC 3161 and written to your SIEM, with an optional write-once archive. | Prompt and tool context kept with the session; repository, workstation, user, policy and verdict shown together, with replay. Audit logs on Team, OTLP forwarding on Enterprise. Hash chaining or signed timestamps are not documented. |
| Deployment | On-premises, air-gapped, Kubernetes-native. | Hosted by default. BYOC or on-premises in the customer's Kubernetes cluster, VPC or private cloud account. Air-gapped operation is not documented. |
| MCP | MCP JSON-RPC gateway with tool caching, under agent identity. | MCP Gateway normalizes each routed call into server, tool, arguments and decision. It runs standalone or with hooks, and reviews MCP drift across hosts. |
| Agent identity | AIDA issues a cryptographic credential to the agent itself, scoped and revocable independently of its launcher. | An identity graph attributes actions to the developer, workstation and group. A credential issued to the agent itself is not documented. |
| Model routing and cost | Routing and failover across model providers, with caching. | Usage and cost telemetry. Routing or failover across model providers is not documented. |
| Regulatory frameworks | Examination packages and model inventory for FINRA 3110, HIPAA, SOX and the EU AI Act, generated from enforcement records. | No framework mappings are published. BYOC is positioned for regulated environments. |
Where the control sits
AgentKeeper places policy inside each agent. In Claude Code it installs as a plugin, and its PreToolUse hook "Evaluates tool calls before execution." In Cursor, shell commands, file reads and MCP calls are checked before they run, and file edits are audit-only because "Cursor cannot intercept writes before they happen." In VS Code the hooks cover Copilot agent mode; RAD states that Copilot in other editors or on github.com is outside them. At its best, hook coverage reaches actions that never become a model call or an MCP call, such as a shell command or a file read on the laptop.
Smartflow sits on the request path, so coverage does not depend on which agent produced the call: every call routed through it, from any application, agent or script, is governed the same way. The trade is that a call has to be pointed at the gateway. Commands a coding agent runs directly in its terminal do not pass through MCP. APERION's Claude Code guide governs those with Claude Code's own managed controls, and APERION Shield wraps MCP servers that run on the laptop.
Who decides, and what the record shows
AgentKeeper's documented modes are monitor, warn and block. RAD keeps enforcement deterministic, because a simple policy "should not depend on another model making a probabilistic decision." The evidence stays with the session. RAD does mention approval: its blog gives "An agent cannot install packages without approval" as an example policy, its Antigravity page lists an "ask" verdict, and a research brief lists "require approval" among AgentKeeper's controls. The workflow behind them is not documented: who approves, how that person is verified, and what the record shows.
Smartflow adds an outcome between allow and block. An action that needs a person pauses as an approval ticket: pending until someone with approval rights approves or denies it, redeemed once when the action runs, and expired after 24 hours. With step-up, set per action, the approver re-verifies their identity before the approval counts. Each decision produces a record bound to the human who owns the agent, hash-chained, carrying an RFC 3161 timestamp and written to your SIEM. AIDA gives the agent a credential of its own, so the agent is a party in the record.
For a supervisor, that is the difference between a verdict a rule produced and a decision a named person made, re-verified where policy requires it.
Where the control plane runs
AgentKeeper is hosted by default, which RAD calls "the fastest path for most teams." For regulated environments it runs as BYOC or on-premises in the customer's Kubernetes cluster, VPC or private cloud account, on AWS, Azure, GCP, sovereign cloud or private Kubernetes, with private ingress or VPN-only access. Air-gapped operation is not documented.
Smartflow runs on-premises and Kubernetes-native, and is designed to run air-gapped: configured with local embeddings and a local model, policy, cache and audit make no call to us or anyone else. For most buyers, BYOC answers the data-boundary question. For an enclave with no egress, air-gapped operation decides it.
Where AgentKeeper is strong
AgentKeeper reaches further into the developer workstation than a gateway does. It evaluates the shell commands, file reads and web fetches an agent makes on the laptop, and in Windsurf five pre-hooks put a decision in front of every command, file read, file write, MCP call and prompt.
It is easy to start. One workstation is free with no credit card, the Claude Code plugin is MIT-licensed, and fleet rollout runs through Jamf, Iru/Kandji and repo hooks. Pricing is published, which is unusual in this market. Teams start in monitor mode and enforce by tool, group, repo or path, which is how controls should reach developers.
Enforcement is deterministic, with AI kept for intent, correlation and investigation. RAD positions AgentKeeper alongside EDR, adding the prompt, tool, policy and verdict that endpoint tools do not see, and publishes 13 practical research briefs on agent runtime threats. RAD Security was selected for RSA Innovation Sandbox and Black Hat Startup Spotlight in 2024 and raised a $14M Series A in 2025. For a security team whose immediate problem is coding agents on developer laptops, AgentKeeper is a strong, fast answer.
When to choose Smartflow
- Agents beyond the workstation: every application, agent and script governed on the same request path as coding agents, from any origin
- A person decides, on the record: the action pauses as an approval ticket, the approver re-verifies identity with step-up where policy requires it, and the record shows who decided
- Evidence for an examiner: hash-chained records with RFC 3161 timestamps in your SIEM, and examination packages for FINRA 3110, HIPAA, SOX and the EU AI Act
- Inside the perimeter, including air-gapped: on-premises and Kubernetes-native, with no call to us or anyone else when configured with local embeddings and a local model
Running both
The two sit at different layers. AgentKeeper sees what a coding agent does on the workstation, including shell commands and file reads that never leave the laptop. Smartflow governs the model calls and MCP tool calls that coding agents and other agents route through it, and writes the decision record to your SIEM. They overlap on MCP: each runs an MCP gateway, so a given MCP server should sit behind one policy path. The cost is two policy surfaces to keep aligned.
Common questions
Does AgentKeeper block an action before it runs? In Block mode, where the agent exposes a pre-execution hook. Cursor file edits are audit-only, and the hooks fail open if the service errors.
Can AgentKeeper run on-premises? Yes, as BYOC or on-premises in the customer's Kubernetes cluster, VPC or private cloud account. Air-gapped operation is not documented.
Can AgentKeeper route an action to a person for approval? RAD mentions approval: an "ask" verdict on its Antigravity page and "require approval" in a research brief. Who approves, how that person is verified and what the record shows are not documented. The documented modes are monitor, warn and block, and alerts go out by email or webhook.
What does AgentKeeper cost? Free for one workstation. Pro is listed at $15 a month for three workstations. Team is $23 per workstation per month on annual billing, or $29 monthly, up to 20 workstations. Enterprise is quoted.
Does Smartflow govern commands a coding agent runs in its terminal? Not through the gateway. APERION's Claude Code guide governs terminal commands with Claude Code's own managed controls, and APERION Shield covers MCP servers on the laptop.
Related reading
Smartflow for Claude Code · Smartflow for Claude Cowork · APERION Shield · MCP security · AI agent step-up approval guide · Human-in-the-loop · Tamper-evident audit log · Air-gapped AI deployment · All comparisons
Verified against each vendor's published documentation in November 2026. Vendor capabilities change. If something here is out of date, tell us and we will correct it.
RAD Security sources: agentkeeper.dev and its /pricing, /about, /agentkeeper-mcp, /claude-code-security, /cursor-security, /copilot-security, /windsurf-security, /codex-security, /gemini-security, /antigravity-security and /research pages; the agentkeeper.dev blog posts of September 4, 2026 (/blog/beyond-identity-agent-behavior, /blog/clawkeeper-to-agentkeeper); and github.com/rad-security/claude-code-plugin.
Put this in the path of your own agents.
Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.
Request a Demo Read the docs