Prismor

Runtime security for Claude Code, Codex, Langchain and other AI agents frameworks/harness.

Website • Onboard with Skill

_{Plus Grok Build, Crush, OpenHands, Qwen Code, Continue CLI, Goose, Hermes, OpenClaw, Devin CLI, Factory Droid, Aider, and more — see AGENT_INTEGRATIONS.md for the full coverage matrix}

The Problem

Quick Start (30s)

pip install prismor
prismor setup

For the Skill, curl, and git-clone alternatives, plus PEP 668 systems and secret-cloaking setup, see the full installation guide.

Capabilities

• 🛡️ Prismor covers the policy engine, session logs, security audit, and CLI reference
• 📦 Supply Chain covers install-time enforcement, IOC matching, and risk scoring
• 🛜 Network Isolation covers policy-driven egress control, raw IP detection, and tunnel blocking
• 🔍 Skill Scanner covers MCP server and skill risk scanning across supported agents
• 🚦 MCP Guardrails let you block a specific MCP server or tool, or require human approval before the agent calls it, with a policy rule you write yourself
• 🛰️ MCP Gateway is a single MCP connector that fronts every other MCP server you use — each tools/call is policy-evaluated before it forwards and each response is injection-scanned before the model sees it, so a poisoned tool result never becomes context. prismor mcp-gateway install moves an existing .mcp.json behind it
• 🛤️ LLM Proxy governs an agent Prismor cannot hook, through the one thing every agent has: its model traffic. Point it at prismor proxy with ANTHROPIC_BASE_URL, OPENAI_BASE_URL, or the Google Gen AI SDK's HttpOptions(base_url=...) and nothing else about the agent changes. Every tool call the model proposes — Anthropic tool_use, OpenAI tool_calls, Gemini functionCall — is reshaped into the same event a Bash hook produces and judged by the same rule, with streamed calls held until they can be judged
• Claude Inference Hooks makes Prismor the AI security server behind Claude Enterprise: Anthropic sends every governed prompt from claude.ai, Claude Code and Cowork to prismor inference-hook serve, which runs your policy on the transcript and answers allow/deny before the model runs — signed requests (Standard Webhooks), fail-closed, shadow mode, nothing to install on user devices. prismor inference-hook test sends signed sample frames to check the wiring
• 🏷️ Tool Tags classify tools by capability (read, write, network, exec) so a rule can say "nothing that reads private data may also reach the network" instead of naming every tool one by one — MCP tools self-declare via _meta, and prismor tags lists, tests, and lints the rule expressions
• 🔐 Sweep and Cloak covers secret prevention at tool boundaries, practical setup, best practices, threat model, and cleanup for leaked secrets
• 🦞 OpenClaw Integration covers runtime hooks, prompt-injection scanning, and project or user-scope setup for OpenClaw
• 🤖 Hermes Agent Cloaking covers Hermes-specific secret cloaking with pip entry-point auto-discovery, filesystem install, and pre_gateway_dispatch paste guard
• 🧠 Semantic Guard: opt-in hybrid layer that adds an LLM-assisted intent check for paraphrased prompt-injection attempts the regex rules cannot catch
• 🪤 Canary plants honeytoken credential files that trip a CRITICAL finding the moment an agent reads them, catching recon behavior
• 🪪 IAM gives each agent a named identity and least-privilege permission profile when several agents share a workspace
• 🧩 Framework Agents guards production agents (OpenAI Agents SDK, LangChain/LangGraph in Python and JS, CrewAI, browser-use, Pydantic AI, AutoGen Core, Agno, Semantic Kernel, Google ADK, BeeAI, Claude Agent SDK, Vercel AI SDK, Mastra) with one call — wrap each request in use_subject("user:alice") and a multi-tenant agent gets per-user attribution, per-user IAM profiles, and per-user suspension
• 🎯 Scoped Agent synthesizes minimal, task-specific rules per session so an injected pivot off-task gets blocked
• 🧬 Learning mines session history to propose new rules, flag false positives, and detect evasion
• ⚖️ Layered Policy & Exemptions covers per-rule observe/enforce, the non-overridable floor, and admin-granted, time-boxed exemptions across org / project / repo layers
• 🔐 Explicit enforce selection & the unlock window — enforce setup starts with nothing blocking and you pick the set; prismor allow makes narrow exceptions, and prismor unlock opens a password-gated, time-boxed window in which an agent may edit policy (never the self-protection rules that guard Prismor itself)
• 📡 Live Telemetry covers the optional enterprise control-plane link — device enrollment, signed remote policy, and redacted telemetry streamed to a self-hosted org dashboard
• 🔌 Telemetry Sinks forward every finding to what you already run — an OpenTelemetry collector (OTLP/HTTP logs), Splunk HEC, Datadog, syslog, a webhook, or a local file in JSON/CEF/OCSF — dispatched before the blocking decision and never able to stall a tool call
• 📊 Dashboard covers the terminal and local web dashboards plus session forensics, with prismor tokens breaking down where a session's context and token spend actually went
• 🩺 Health and Recovery — prismor doctor health-checks every subsystem (hooks, policy signature, enrollment, telemetry sink, chain state), and prismor pause / pause-hard suspends enforcement only for a human during an incident while observe-mode logging keeps running
• 🧾 Signed Audit Trail hash-chains and Ed25519-signs every agent action locally, so prismor trail verify proves the history hasn't been edited, deleted, or rewritten
• 🔖 Signed Telemetry Receipts is the wire schema for the records a device reports — canonical bytes, the two integrity layers, and a dependency-free reference verifier, so a SIEM or an auditor can check a receipt without Prismor
• 📑 Attestation Bundle packages posture, agent inventory, host discovery, framework-control coverage (OWASP LLM/Agentic, NIST AI RMF, EU AI Act), and the trail anchor into one Ed25519-signed file an auditor re-verifies with prismor attest verify
• 🔦 Host Discovery sweeps the machine with prismor discover and flags any AI agent running without Prismor hooks (shadow AI)
• ⏪ Transcript Ingest reconstructs what your agents did before Prismor was installed — prismor ingest --discover replays on-disk session transcripts through the live policy engine, so the dashboard is populated on day one and you can see exactly what flipping a rule to enforce would have blocked, plus --coverage for sessions that ran unmonitored
• 🗺️ Agentic AI Architecture Review is a design-time checklist for multi-agent/tool-using systems — permission scope, memory integrity, inter-agent trust, human-oversight placement — each item mapped to a real control ID and, where one exists, the Prismor rule that backstops it
• 🐳 Docker and Containers covers container hardening, prerequisites, and known limitations

Full command map across every capability: CLI Reference.

These capabilities map to the OWASP Top 10 for LLM Applications - covering prompt injection (LLM01), sensitive information disclosure (LLM02), supply chain (LLM03), improper output handling (LLM05), and excessive agency (LLM06).

Scenarios and Use Cases

Real workflows with the commands and config that make them work — onboarding a team in observe mode, per-user IAM attribution for multi-agent and framework pipelines, shadow AI discovery, step-up approval for high-stakes operations, and generating a signed attestation bundle for a compliance audit. See USE_CASES.md.

Configuration

Full command map: docs/cli-reference.md.

Governance Modes

prismor setup asks you to pick one posture instead of configuring six policy axes by hand. Each compiles into .prismor/policy.yaml — enforcement, egress, tool access, tag rules, sandbox and data boundary together.

prismor mode list                            # compare the three
prismor mode explain dev-safe                # the trade, including what it does NOT stop
prismor mode apply dev-safe                  # compile it into this workspace
prismor mode apply regulated-airgap --observe   # what it would block, blocking nothing

Every mode states its residual risk. Full breakdown: docs/modes.md.

Observe / Enforce (per-rule, policy-authoritative)

Enforcement is decided per rule by your policy, not by a single global switch. Each rule carries a mode, and settings.default_mode (default observe) covers any rule that doesn't set one:

Out of the box everything observes — nothing is blocked until you flip rules (or default_mode) to enforce in your policy:

# .prismor/policy.yaml
settings:
  default_mode: observe        # global default for rules without their own mode
rules:
  - id: destructive-rm-rf
    mode: enforce              # this rule blocks; the rest still just observe

Policy is authoritative: a rule set to enforce blocks regardless of how the hook was installed (--mode), so an admin who flips a rule to enforce via the control plane blocks even on observe-installed devices. See Layered Policy & Exemptions for org / project / repo precedence and the non-overridable floor.

prismor setup makes the choice explicit rather than implied: an observe install ships with the defaults on, while an enforce install starts with nothing selected and asks you to pick what blocks (the safety floor is pre-marked recommended — press a to take it). Your selection is written to .prismor/policy.yaml as settings.selection: explicit plus one line per rule, so what blocks is readable in the file. When a rule then blocks something legitimate, the deny message prints the exact prismor allow <rule> --pattern '<literal>' that fixes it — for the human to run; agents are stopped from editing Prismor's own config by always-on self-protection rules, unless the human opens a short password-gated window with prismor unlock. See Choosing what blocks and Making exceptions.

The install flag still sets the starting posture, and an observe install combined with PRISMOR_LOCAL_DRY_RUN=1 acts as a local dry-run kill-switch that suppresses all blocking:

prismor install-hooks --agent all --mode observe    # start in observe everywhere
prismor install-hooks --agent all --mode enforce    # honor policy enforce rules

Upgrading from a pre-mode release? Backward compatibility is preserved: a policy that predates per-rule modes (it sets settings.block_categories but no default_mode and no rule-level mode) keeps its original behavior — those categories still block when installed with --mode enforce. The moment your policy adopts the per-rule model (any mode/default_mode), it becomes fully policy-authoritative as described above.

Architecture

flowchart TD

%% ── sources ────────────────────────────────────────────────
subgraph SRC["Agents Prismor protects"]
    direction LR
    AC["<b>Coding agents</b><br/>Claude Code · Codex · Cursor · Windsurf · Copilot<br/>OpenClaw · Hermes · Grok · Kiro · Crush<br/>OpenHands · Qwen · Continue · Goose"]
    AF["<b>Production frameworks</b><br/>OpenAI Agents · LangChain / LangGraph · CrewAI · browser-use<br/>Pydantic AI · AutoGen Core · Agno · Semantic Kernel · Google ADK<br/>BeeAI · Claude Agent SDK · Vercel AI SDK · Mastra"]
end

%% ── stage 1 ────────────────────────────────────────────────
subgraph ENTRY["Stage 1  ·  Integration surface"]
    direction LR
    H(["<b>Runtime hooks</b><br/>pre / post tool-call<br/>per-agent config"])
    G(["<b>MCP gateway</b><br/>fronts every MCP server<br/>injection-scans responses"])
    F(["<b>Framework adapters</b><br/>in-process + HTTP eval server<br/>per-user via use_subject"])
end

%% ── stage 2 ────────────────────────────────────────────────
subgraph EVAL["Stage 2  ·  Evaluated before the call executes"]
    direction TB
    D(["<b>Tool-call dispatcher</b>"])
    P["<b>Policy engine</b><br/>YAML rules · per-rule observe / enforce<br/>layered org → project → repo · non-overridable floor"]
    CHK["<b>Pre-execution checks</b><br/>Semantic guard · Egress control · MCP guardrails · Tool tags<br/>IAM and agent controls · Scoped session rules<br/>Script-content inspection · Docker sandbox"]
    SEC["<b>Secret and supply-chain protection</b><br/>Cloak placeholders + output scrub · Env guard · Sweep<br/>Canary tripwires · Skill scanner<br/>Supply-chain scoring → npm · pip · cargo · go"]
end

FEED[/"Signed advisory feed  ·  Prismor intel + NVD"/]
V{"<b>Allow  ·  Warn  ·  Block</b><br/>every block prints narrowest-first unblock steps"}

%% ── stage 3 ────────────────────────────────────────────────
subgraph EV["Stage 3  ·  Evidence and feedback"]
    direction LR
    ST[("<b>Session store</b><br/>SQLite + JSONL<br/>session forensics")]
    VIEW["<b>Views</b><br/>Web + terminal dashboard<br/>Status · Tokens · Audit · Doctor"]
    PROOF["<b>Tamper-evident</b><br/>Signed trail — hash chain + Ed25519<br/>Attestation bundle · Host discovery"]
    LEARN["<b>Learning</b><br/>propose rules · flag false<br/>positives · detect evasion"]
end

PAST[/"Transcript ingest  ·  replays pre-install history through the live policy"/]

%% ── stage 4 ────────────────────────────────────────────────
subgraph ORG["Stage 4  ·  Optional self-hosted control plane"]
    direction LR
    RP["<b>Signed remote policy</b><br/>layered rules · time-boxed<br/>exemptions · pause / resume"]
    TEL["<b>Live telemetry</b><br/>redacted events<br/>offline spool"]
    OD["<b>Org dashboard</b><br/>policy · devices<br/>sessions · approvals"]
end

%% ── flow ───────────────────────────────────────────────────
AC --> ENTRY
AF --> ENTRY
ENTRY --> D
D --> P
P --> CHK
P --> SEC
FEED -.-> SEC
CHK --> V
SEC --> V
V --> ST
PAST -.-> ST
ST --> VIEW
ST --> PROOF
ST --> LEARN
LEARN -.->|"proposed rules"| P
RP ==>|"authoritative once enrolled"| P
ST -->|"redacted"| TEL
TEL --> OD

See the decision contract for the event shape and verdict vocabulary, and [governance surf