Website • Onboard with Skill

_{Plus Grok Build, Crush, OpenHands, Qwen Code, Continue CLI, Goose, Hermes, OpenClaw, Devin CLI, Factory Droid, Aider, and more — see AGENT_INTEGRATIONS.md for the full coverage matrix}

The Problem

Quick Start (30s)

For the Skill, curl, and git-clone alternatives, plus PEP 668 systems and secret-cloaking setup, see the full installation guide.

Capabilities

• 🛡️ Prismor covers the policy engine, session logs, security audit, and CLI reference
• 📦 Supply Chain covers install-time enforcement, IOC matching, and risk scoring
• 🛜 Network Isolation covers policy-driven egress control, raw IP detection, and tunnel blocking
• 🔍 Skill Scanner covers MCP server and skill risk scanning across supported agents
• 🚦 MCP Guardrails let you block a specific MCP server or tool, or require human approval before the agent calls it, with a policy rule you write yourself
• 🛰️ MCP Gateway is a single MCP connector that fronts every other MCP server you use — each tools/call is policy-evaluated before it forwards and each response is injection-scanned before the model sees it, so a poisoned tool result never becomes context. prismor mcp-gateway install moves an existing .mcp.json behind it
• Claude Inference Hooks makes Prismor the AI security server behind Claude Enterprise: Anthropic sends every governed prompt from claude.ai, Claude Code and Cowork to prismor inference-hook serve, which runs your policy on the transcript and answers allow/deny before the model runs — signed requests (Standard Webhooks), fail-closed, shadow mode, nothing to install on user devices. prismor inference-hook test sends signed sample frames to check the wiring
• 🏷️ Tool Tags classify tools by capability (read, write, network, exec) so a rule can say "nothing that reads private data may also reach the network" instead of naming every tool one by one — MCP tools self-declare via _meta, and prismor tags lists, tests, and lints the rule expressions
• 🔐 Sweep and Cloak covers secret prevention at tool boundaries, practical setup, best practices, threat model, and cleanup for leaked secrets
• 🦞 OpenClaw Integration covers runtime hooks, prompt-injection scanning, and project or user-scope setup for OpenClaw
• 🤖 Hermes Agent Cloaking covers Hermes-specific secret cloaking with pip entry-point auto-discovery, filesystem install, and pre_gateway_dispatch paste guard
• 🧠 Semantic Guard: opt-in hybrid layer that adds an LLM-assisted intent check for paraphrased prompt-injection attempts the regex rules cannot catch
• 🪤 Canary plants honeytoken credential files that trip a CRITICAL finding the moment an agent reads them, catching recon behavior
• 🪪 IAM gives each agent a named identity and least-privilege permission profile when several agents share a workspace
• 🧩 Framework Agents guards production agents (OpenAI Agents SDK, LangChain/LangGraph in Python and JS, CrewAI, browser-use, Pydantic AI, AutoGen Core, Agno, Semantic Kernel, Google ADK, BeeAI, Claude Agent SDK, Vercel AI SDK, Mastra) with one call — wrap each request in use_subject("user:alice") and a multi-tenant agent gets per-user attribution, per-user IAM profiles, and per-user suspension
• 🎯 Scoped Agent synthesizes minimal, task-specific rules per session so an injected pivot off-task gets blocked
• 🧬 Learning mines session history to propose new rules, flag false positives, and detect evasion
• ⚖️ Layered Policy & Exemptions covers per-rule observe/enforce, the non-overridable floor, and admin-granted, time-boxed exemptions across org / project / repo layers
• 🔐 Explicit enforce selection & the unlock window — enforce setup starts with nothing blocking and you pick the set; prismor allow makes narrow exceptions, and prismor unlock opens a password-gated, time-boxed window in which an agent may edit policy (never the self-protection rules that guard Prismor itself)
• 📡 Live Telemetry covers the optional enterprise control-plane link — device enrollment, signed remote policy, and redacted telemetry streamed to a self-hosted org dashboard
• 🔌 Telemetry Sinks forward every finding to what you already run — an OpenTelemetry collector (OTLP/HTTP logs), Splunk HEC, Datadog, syslog, a webhook, or a local file in JSON/CEF/OCSF — dispatched before the blocking decision and never able to stall a tool call
• 📊 Dashboard covers the terminal and local web dashboards plus session forensics, with prismor tokens breaking down where a session's context and token spend actually went
• 🩺 Health and Recovery — prismor doctor health-checks every subsystem (hooks, policy signature, enrollment, telemetry sink, chain state), and prismor pause / pause-hard suspends enforcement only for a human during an incident while observe-mode logging keeps running
• 🧾 Signed Audit Trail hash-chains and Ed25519-signs every agent action locally, so prismor trail verify proves the history hasn't been edited, deleted, or rewritten
• 🔖 Signed Telemetry Receipts is the wire schema for the records a device reports — canonical bytes, the two integrity layers, and a dependency-free reference verifier, so a SIEM or an auditor can check a receipt without Prismor
• 📑 Attestation Bundle packages posture, agent inventory, host discovery, framework-control coverage (OWASP LLM/Agentic, NIST AI RMF, EU AI Act), and the trail anchor into one Ed25519-signed file an auditor re-verifies with prismor attest verify
• 🔦 Host Discovery sweeps the machine with prismor discover and flags any AI agent running without Prismor hooks (shadow AI)
• ⏪ Transcript Ingest reconstructs what your agents did before Prismor was installed — prismor ingest --discover replays on-disk session transcripts through the live policy engine, so the dashboard is populated on day one and you can see exactly what flipping a rule to enforce would have blocked, plus --coverage for sessions that ran unmonitored
• 🗺️ Agentic AI Architecture Review is a design-time checklist for multi-agent/tool-using systems — permission scope, memory integrity, inter-agent trust, human-oversight placement — each item mapped to a real control ID and, where one exists, the Prismor rule that backstops it
• 🐳 Docker and Containers covers container hardening, prerequisites, and known limitations

Full command map across every capability: CLI Reference.

These capabilities map to the OWASP Top 10 for LLM Applications - covering prompt injection (LLM01), sensitive information disclosure (LLM02), supply chain (LLM03), improper output handling (LLM05), and excessive agency (LLM06).

Scenarios and Use Cases

Real workflows with the commands and config that make them work — onboarding a team in observe mode, per-user IAM attribution for multi-agent and framework pipelines, shadow AI discovery, step-up approval for high-stakes operations, and generating a signed attestation bundle for a compliance audit. See USE_CASES.md.

Configuration

Full command map: docs/cli-reference.md.

Governance Modes

prismor setup asks you to pick one posture instead of configuring six policy axes by hand. Each compiles into .prismor/policy.yaml — enforcement, egress, tool access, tag rules, sandbox and data boundary together.

Every mode states its residual risk. Full breakdown: docs/modes.md.

Observe / Enforce (per-rule, policy-authoritative)

Enforcement is decided per rule by your policy, not by a single global switch. Each rule carries a mode, and settings.default_mode (default observe) covers any rule that doesn't set one:

Out of the box everything observes — nothing is blocked until you flip rules (or default_mode) to enforce in your policy:

Policy is authoritative: a rule set to enforce blocks regardless of how the hook was installed (--mode), so an admin who flips a rule to enforce via the control plane blocks even on observe-installed devices. See Layered Policy & Exemptions for org / project / repo precedence and the non-overridable floor.

prismor setup makes the choice explicit rather than implied: an observe install ships with the defaults on, while an enforce install starts with nothing selected and asks you to pick what blocks (the safety floor is pre-marked recommended — press a to take it). Your selection is written to .prismor/policy.yaml as settings.selection: explicit plus one line per rule, so what blocks is readable in the file. When a rule then blocks something legitimate, the deny message prints the exact prismor allow <rule> --pattern '<literal>' that fixes it — for the human to run; agents are stopped from editing Prismor's own config by always-on self-protection rules, unless the human opens a short password-gated window with prismor unlock. See Choosing what blocks and Making exceptions.

The install flag still sets the starting posture, and an observe install combined with PRISMOR_LOCAL_DRY_RUN=1 acts as a local dry-run kill-switch that suppresses all blocking:

Upgrading from a pre-mode release? Backward compatibility is preserved: a policy that predates per-rule modes (it sets settings.block_categories but no default_mode and no rule-level mode) keeps its original behavior — those categories still block when installed with --mode enforce. The moment your policy adopts the per-rule model (any mode/default_mode), it becomes fully policy-authoritative as described above.

Architecture

See the decision contract for the event shape and verdict vocabulary, and governance surfaces for which surface to use per agent.

Selected Capabilities, Walked Through

Three modules from Capabilities, with setup, output, and results.

Hybrid Semantic Prompt-Injection Defense

Disabled by default. See docs/semantic-guard.md for full setup.

Self-Hosted Dashboard

Supply Chain Enforcement

See docs/supply-chain.md for the full scoring table, ecosystem support, and IOC format.

Disabling Prismor

This does not affect policy rules set to mode: enforce in .prismor/policy.yaml — those remain policy-authoritative regardless of how the hook was installed (see Observe / Enforce above).

3. Clear a session's scoped-agent rules

Scoped Agent synthesizes a per-session allowed_tools/deny_tools list at .prismor/scoped/{session_id}.json. This check is independent of hook --mode — a tool in deny_tools is hardcoded to action: block / mode: enforce in prismor/runtime/scoped_agent.py, so it blocks even when hooks are installed with --mode observe. Uninstalling hooks or switching to observe mode will not lift a scoped denial.

There's no bulk-clear — each session is cleared by ID individually. If a session was scoped before you ran scope clear, the cleanest fix is usually to start a fresh session rather than chase the existing one's cached state.

Benchmarks

See benchmark.md for the full methodology, per-category breakdown, and latency analysis.

Contributing

PRs are welcome. Read CONTRIBUTING.md before you start — it explains the one thing that matters most here: reuse the mechanisms that already exist, and solve the problem in the fewest lines you can. Smaller diffs get merged faster.

The short version:

• New detection rules go in prismor/runtime/default_policy.yaml, following the schema in prismor/runtime/policy_schema.json — detection patterns never go in Python
• Check the extension-point table before adding a new module; most changes are configuration, not code
• Tests live in tests/ — run bash scripts/run_security_tests.sh before opening a PR
• Open an issue first if you're unsure where something fits

By participating you agree to the Code of Conduct.

• Prismor.dev