AI coding agents now write a large share of production code, and only about 10% of AI-generated code is both functionally correct and secure. Today, Endor Labs is a launch partner for the new Plugin marketplace in Google Antigravity, which brings AURI by Endor Labs into Antigravity with one-click setup. That puts security checks and fixes inside the agent's workflow, while code is being written, instead of in a review after the session ends. In our benchmark, AURI Agents complete security tasks 2.8x faster and use 12x fewer tokens than a general-purpose agent working without Endor Labs context.
Why this partnership matters now
Antigravity is Google's agentic development platform. Agents in Antigravity plan work, write code, pull in dependencies, and run tasks across the development lifecycle. The Plugin marketplace, announced today, packages agents, skills, and MCP servers into installable bundles so developers can add specialized tools to their agents without leaving Antigravity.
Google and Endor Labs have worked together on securing agentic development before. In May 2026, Google was a launch partner for Endor Labs Coding Agent Governance. Now, Endor Labs is a launch partner for the Plugin Marketplace in Antigravity.
What's in the Endor Labs plugin
The plugin brings two things into Antigravity.
Secure code by default with the Endor Labs MCP server
The Endor Labs MCP server gives the Antigravity agent security context while it works. Before the agent adds a dependency, it can check the package for known vulnerabilities and malicious code. As it writes, it can scan the project for security flaws and exposed secrets, and pull the details of any vulnerability it finds. The agent gets the same context a security engineer would use, so the code it produces is secure before it ever reaches a pull request.
Automate security work with AURI Agents
AURI Agents are pre-built security agents grounded in Endor Labs data: reachability, upgrade impact, findings, and policies. Inside Antigravity, you can hand them the work that usually sits in a backlog:
- SCA Remediation picks the safest fix for a vulnerable dependency, using reachability and upgrade impact analysis, and opens a pull request with the evidence attached.
- AI SAST Triage confirms true positives against the code, generates patches for the confirmed ones, and routes the rest with a reason.
- Dependency Decision Helper answers "should I add this package?" before the agent installs it.
- Vulnerability Explainer turns a CVE ID into a plain-language answer to "what does this mean for me, and what do I do about it?"
The agents run on your infrastructure, with your LLM keys and your source-control credentials. Most are read-only by default. The ones that can change code or open pull requests say exactly what they are allowed to do and ask for confirmation first.
See it in action
Install the plugin, then ask Antigravity to scan your project. Endor Labs reviews your code for flaws, checks dependencies for vulnerabilities or malware, and blocks exposed secrets.Ask the SCA Remediation agent to fix one, and it chooses the safest upgrade, applies it, adds tests, and opens a pull request with the evidence in the PR body. Rescan to confirm the fix landed and nothing new came in. The whole loop runs inside the Antigravity session.
Get started
The Endor Labs plugin is available in the Plugin marketplace in Antigravity today. Install the Endor Labs plugin and ask Antigravity to scan your project.
What's next?
When you're ready to take the next step in securing your software supply chain, here are 3 ways Endor Labs can help:
