prismor

The Problem

AI agents execute shell commands, read and write files, access credentials, and call external APIs. They do this autonomously, often across many steps, with limited checkpoints.

This creates risks that traditional security tooling isn't designed for:

• Prompt injection - malicious content in a file, issue, or web page can redirect the agent mid-task
• Unintended destructive actions - an agent misinterprets an instruction and runs something irreversible
• Secret exfiltration - an agent reads .env or credential files as part of a debugging task and sends the content outbound
• Lack of visibility and identity - an agent can spawn subagents and lack complete visibility for the end user
• Privilege escalation - an agent modifies sudoers, CI pipelines, or file permissions to resolve a permission error
• Dependency manipulation - an agent installs or rewrites a package at the direction of injected input
• Supply chain risk - an agent installs a vulnerable or 0-day package while optimizing for code velocity

Standard OS-level and endpoint security tools monitor the kernel and filesystem. But they lack the context to make AI usable

Quick Start (30s)

pip install prismor
prismor setup

For the Skill, curl, and git-clone alternatives, plus PEP 668 systems and secret-cloaking setup, see the full installation guide.

Capabilities

• 🛡️ Prismor covers the policy engine, session logs, security audit, and CLI reference
• 📦 Supply Chain covers install-time enforcement, IOC matching, and risk scoring
• 🛜 Network Isolation covers policy-driven egress control, raw IP detection, and tunnel blocking
• 🔍 Skill Scanner covers MCP server and skill risk scanning across supported agents
• 🚦 MCP Guardrails let you block a specific MCP server or tool, or require human approval before the agent calls it, with a policy rule you write yourself
• 🛰️ MCP Gateway is a single MCP connector that fronts every other MCP server you use — each tools/call is policy-evaluated before it forwards and each response is injection-scanned before the model sees it, so a poisoned tool result never becomes context. prismor mcp-gateway install moves an existing .mcp.json behind it
• 🧭 Prompt Guardrails add plain-language rules to the agent's context, such as "never push to main", set per agent in the console and tuned per session; a running session picks up an edit on its next prompt
• 🛤️ LLM Proxy governs an agent Prismor cannot hook, through the one thing every agent has: its model traffic. Point it at prismor proxy with ANTHROPIC_BASE_URL, OPENAI_BASE_URL, or the Google Gen AI SDK's HttpOptions(base_url=...) and nothing else about the agent changes. Every tool call the model proposes — Anthropic tool_use, OpenAI tool_calls, Gemini functionCall — is reshaped into the same event a Bash hook produces and judged by the same rule, with streamed calls held until they can be judged
• Claude Inference Hooks makes Prismor the AI security server behind Claude Enterprise: Anthropic sends every governed prompt from claude.ai, Claude Code and Cowork to prismor inference-hook serve, which runs your policy on the transcript and answers allow/deny before the model runs — signed requests (Standard Webhooks), fail-closed, shadow mode, nothing to install on user devices. prismor inference-hook test sends signed sample frames to check the wiring
• Microsoft Copilot Studio makes Prismor an external threat detection provider for Copilot Studio agents: before each tool a generative-orchestration agent runs, Copilot Studio sends the planned call and the outputs of earlier tools to the eval-server, which answers block or allow within the one-second window. Entra ID token auth, fail-closed on timeout
• 🏷️ Tool Tags classify tools by capability (read, write, network, exec) so a rule can say "nothing that reads private data may also reach the network" instead of naming every tool one by one — MCP tools self-declare via _meta, and prismor tags lists, tests, and lints the rule expressions
• 🔐 Sweep and Cloak covers secret prevention at tool boundaries, practical setup, best practices, threat model, and cleanup for leaked secrets
• 🦞 OpenClaw Integration covers the OpenClaw plugin that screens every tool call, and project or global setup
• 🤖 Hermes Agent Integration covers the Hermes policy plugin, secret cloaking (decloak at execution, output scrubbing, paste guard) and how Hermes enables plugins
• ☁️ Hosted Agent VMs governs agents that run on a machine you never log into (Claude Code on the web, Cursor cloud agents, Copilot coding agent, OpenHands Cloud, Codex cloud, Replicas): the platform's setup script installs the binary, and install-hooks --portable writes a hook config that is safe to commit
• 🧠 Semantic Guard: opt-in hybrid layer that adds an LLM-assisted intent check for paraphrased prompt-injection attempts the regex rules cannot catch
• 🚧 Data Boundary decides what may be sent where: real emails, phones, SSNs, cards, IBANs and secrets are screened against the destination's trust tier, so an agent following a third-party setup guide can't ship your data to a service you never approved
• 🧑‍🤝‍🧑 Subagents enforces the same policy inside Claude Code subagents, refuses approval prompts a background subagent can't ask for, and tells you in one line what happened inside each one. Limiting subagents caps how many an agent launches, lets a delegation expire, and screens what a subagent is handed
• 🔎 Dev Insights: prismor rca, blame, friction and session --changes answer where an agent run went wrong, who wrote a line, and what agents keep tripping over