Protect R&D and clinical data as agents join the lab

Research, clinical, and engineering teams use coding assistants and agents on pipelines that hold trial data and proprietary science. Knostic governs what those agents can do, install, and move.

Get a Demo

Packages & Repos

Packages installed by coding agents across your org

Package Vulnerabilities (OSV) Outcome

unused-imports MALICIOUS No fix available Published 27 Oct 2025 · OSV Detected

@kirin/e2e… No known vulnerabilities Allowed

Claude Code — ~/demo

> install the npm package unused-imports

● Installing the unused-imports npm package
└ $ npm install unused-imports

● Done. The unused-imports package has been installed successfully.

✻ Cogitating…

›

Kirin Security Alert

Critical risk detected

Hallucinated package installed. Please review package...

The agent's shortcut is the competitor's windfall.

A poisoned package in an analysis pipeline, a hidden instruction in a shared skill, or a prompt that carries trial results out of the building. Knostic stops each before it executes and records the decision for GxP and your IP program.

How Knostic works in pharma

Scientific software supply chain

Before Knostic

A researcher's agent installs a package or skill that reuses known malicious code. It runs with access to trial data.

After Knostic

AgentMesh rates every package, skill, MCP server, and extension. Kirin blocks the dangerous ones before install.

Validated code

Before Knostic

Pipeline code is generated with no review of dependencies or data handling, then runs on regulated data.

After Knostic

Agents follow your coding rules, dependencies are checked, and OpenAnt finds exploitable issues before release.

Inventory for GxP

Before Knostic

Which AI tools touch regulated data? Nobody can say.

After Knostic

Every agent and tool discovered and attributed by team, ready for your validation records.

Key capabilities

Package and component vetting

Hallucinated, typosquatted, and malicious packages blocked before they reach the pipeline.

IP and trial-data protection

Sensitive values in prompts and outputs caught before they leave the agent.

Action guardrails

Destructive and data-moving operations blocked or escalated.

Shadow AI discovery

See every agent and assistant in use across R&D and clinical teams.

Validation evidence

Decision logs and inventory for GxP, 21 CFR Part 11, and IP controls.

Secure AI SDLC

Coding rules enforced in the agent and OpenAnt vulnerability discovery.

Frequently asked questions

Knostic provides enforced controls and decision logs that support validation and audit. Your validation program determines compliance; Knostic supplies controls and evidence.

Yes. Kirin runs inside Cursor, Claude Code, GitHub Copilot, Windsurf, Codex, JetBrains, Devin Desktop, Gemini CLI, and Claude Cowork.

Install steps are compared against the registry and AgentMesh verdicts. Packages that do not exist, are typosquats, or are known malicious are blocked.

Discovery within hours of installing Kirin; enforcement once you have reviewed the results.