Antimalware for agents.
Your AI virus analyst, on call 24/7.

Signatures are written by human analysts days after a sample appears. AI-written malware never had a signature. Andy reverse-engineers every file, package, and instruction your agent is about to act on, in real time, before it runs.

Add Andy to your agent API reference

Two questions, one verdict

Every scan answers what the file does and how it reached your agent.

PAYLOAD  What does it do?

Scripts, packages, PDFs, Office docs, binaries. Static triage plus an AI analyst reading the actual code: credential theft, exfiltration, download-and-execute, persistence, obfuscation.

DELIVERY  Who told you to open it?

Prompt injection and social engineering aimed at agents: hidden instructions, forged system messages, urgency, "ignore previous instructions", requests for keys. A clean file with a poisoned email is still an attack.

HASH FIRST  Fast when it can be

Your client sends a SHA-256 first. Anything Andy has already analyzed returns in milliseconds. Only unknown content is uploaded. Full analysis typically finishes in under a minute.

The threats agents actually face

Not ransomware in a Word doc. This.

Typosquatted packages

pip install requets with a postinstall that reads ~/.aws and your .env. Agents install dependencies hundreds of times a day.

curl | bash from a README

The install instructions say pipe it into a shell. The agent does. Andy reads what the script really does first.

Phishing for agents

An email assistant gets "please process the attached invoice". The PDF carries instructions addressed to the assistant and a payload. Andy scores both the lure and the file.

Malicious MCP servers and skills

Plugins for agents are code with full access to the agent's environment. Andy reads them like any other package.

Integrate in one minute

CLI, MCP server, or a Claude Code hook. Exit codes and a JSON verdict your agent can branch on.

# install
pip install andymal
export ANDY_API_KEY=andy_...

# before opening a file the agent received
andy scan invoice.pdf --context-file email.txt

# before installing a dependency
andy scan pypi:requets
andy scan npm:lodahs@latest

# any text that asks the agent to do something
cat README.md | andy scan -
# MCP (Claude Code, Claude Desktop, any MCP client)
{"mcpServers": {"andy": {"command": "andy-mcp",
   "env": {"ANDY_API_KEY": "andy_..."}}}}

# Claude Code hook: auto-check pip/npm installs and curl|bash before they run
cp client/hooks/pretooluse.py ~/.andy/  # see client/hooks/settings.example.json

Verdict shape: {"verdict": "malicious", "action": "block", "payload": {...}, "delivery": {...}, "summary": "...", "report_url": "..."}

How Andy is different

  1. Analysis, not signatures. The expensive part of a security vendor is the analyst who reverse-engineers samples. Andy is that analyst as a service, running on every file, instantly.
  2. Built for agents. The threat model is credential theft, supply chain, and instruction hijacking, not a human clicking an attachment.
  3. Delivery is a first-class verdict. Prompt injection is malware for agents. Nobody else scores it.
  4. Every scan makes the next one faster. Verdicts are cached by content hash and shared across all customers.