_{Plus Grok Build, Crush, OpenHands, Qwen Code, Continue CLI, Goose, Hermes, OpenClaw, Devin CLI, Factory Droid, Aider, and more — see AGENT_INTEGRATIONS.md for the full coverage matrix}

The Problem

Quick Start (30s)

For the Skill, curl, and git-clone alternatives, plus PEP 668 systems and secret-cloaking setup, see the full installation guide.

Capabilities

• 🛡️ Prismor covers the policy engine, session logs, security audit, and CLI reference
• 📦 Supply Chain covers install-time enforcement, IOC matching, and risk scoring
• 🛜 Network Isolation covers policy-driven egress control, raw IP detection, and tunnel blocking
• 🔍 Skill Scanner covers MCP server and skill risk scanning across supported agents
• 🚦 MCP Guardrails let you block a specific MCP server or tool, or require human approval before the agent calls it, with a policy rule you write yourself
• 🛰️ MCP Gateway is a single MCP connector that fronts every other MCP server you use — each tools/call is policy-evaluated before it forwards and each response is injection-scanned before the model sees it, so a poisoned tool result never becomes context. prismor mcp-gateway install moves an existing .mcp.json behind it
• 🏷️ Tool Tags classify tools by capability (read, write, network, exec) so a rule can say "nothing that reads private data may also reach the network" instead of naming every tool one by one — MCP tools self-declare via _meta, and prismor tags lists, tests, and lints the rule expressions
• 🔐 Sweep and Cloak covers secret prevention at tool boundaries, practical setup, best practices, threat model, and cleanup for leaked secrets
• 🦞 OpenClaw Integration covers runtime hooks, prompt-injection scanning, and project or user-scope setup for OpenClaw
• 🤖 Hermes Agent Cloaking covers Hermes-specific secret cloaking with pip entry-point auto-discovery, filesystem install, and pre_gateway_dispatch paste guard
• 🧠 Semantic Guard: opt-in hybrid layer that adds an LLM-assisted intent check for paraphrased prompt-injection attempts the regex rules cannot catch
• 🪤 Canary plants honeytoken credential files that trip a CRITICAL finding the moment an agent reads them, catching recon behavior
• 🪪 IAM gives each agent a named identity and least-privilege permission profile when several agents share a workspace
• 🧩 Framework Agents guards production agents (OpenAI Agents SDK, LangChain/LangGraph in Python and JS, CrewAI, browser-use, Pydantic AI, AutoGen Core, Agno, Semantic Kernel, Google ADK, BeeAI, Claude Agent SDK, Vercel AI SDK, Mastra) with one call — wrap each request in use_subject("user:alice") and a multi-tenant agent gets per-user attribution, per-user IAM profiles, and per-user suspension
• 🎯 Scoped Agent synthesizes minimal, task-specific rules per session so an injected pivot off-task gets blocked
• 🧬 Learning mines session history to propose new rules, flag false positives, and detect evasion
• ⚖️ Layered Policy & Exemptions covers per-rule observe/enforce, the non-overridable floor, and admin-granted, time-boxed exemptions across org / project / repo layers
• 🔐 Explicit enforce selection & the unlock window — enforce setup starts with nothing blocking and you pick the set; prismor allow makes narrow exceptions, and prismor unlock opens a password-gated, time-boxed window in which an agent may edit policy (never the self-protection rules that guard Prismor itself)
• 📡 Live Telemetry covers the optional enterprise control-plane link — device enrollment, signed remote policy, and redacted telemetry streamed to a self-hosted org dashboard
• 📊 Dashboard covers the terminal and local web dashboards plus session forensics, with prismor tokens breaking down where a session's context and token spend actually went
• 🩺 Health and Recovery — prismor doctor health-checks every subsystem (hooks, policy signature, enrollment, telemetry sink, chain state), and prismor pause / pause-hard suspends enforcement only for a human during an incident while observe-mode logging keeps running
• 🧾 Signed Audit Trail hash-chains and Ed25519-signs every agent action locally, so prismor trail verify proves the history hasn't been edited, deleted, or rewritten
• 📑 Attestation Bundle packages posture, agent inventory, host discovery, framework-control coverage (OWASP LLM/Agentic, NIST AI RMF, EU AI Act), and the trail anchor into one Ed25519-signed file an auditor re-verifies with prismor attest verify
• 🔦 Host Discovery sweeps the machine with prismor discover and flags any AI agent running without Prismor hooks (shadow AI)
• ⏪ Transcript Ingest reconstructs what your agents did before Prismor was installed — prismor ingest --discover replays on-disk session transcripts through the live policy engine, so the dashboard is populated on day one and you can see exactly what flipping a rule to enforce would have blocked, plus --coverage for sessions that ran unmonitored
• 🗺️ Agentic AI Architecture Review is a design-time checklist for multi-agent/tool-using systems — permission scope, memory integrity, inter-agent trust, human-oversight placement — each item mapped to a real control ID and, where one exists, the Prismor rule that backstops it
• 🐳 Docker and Containers covers container hardening, prerequisites, and known limitations

Full command map across every capability: CLI Reference.

These capabilities map to the OWASP Top 10 for LLM Applications - covering prompt injection (LLM01), sensitive information disclosure (LLM02), supply chain (LLM03), improper output handling (LLM05), and excessive agency (LLM06).

Configuration

Full command map: docs/cli-reference.md.

Observe / Enforce (per-rule, policy-authoritative)

Enforcement is decided per rule by your policy, not by a single global switch. Each rule carries a mode, and settings.default_mode (default observe) covers any rule that doesn't set one:

Out of the box everything observes — nothing is blocked until you flip rules (or default_mode) to enforce in your policy:

Policy is authoritative: a rule set to enforce blocks regardless of how the hook was installed (--mode), so an admin who flips a rule to enforce via the control plane blocks even on observe-installed devices. See Layered Policy & Exemptions for org / project / repo precedence and the non-overridable floor.

prismor setup makes the choice explicit rather than implied: an observe install ships with the defaults on, while an enforce install starts with nothing selected and asks you to pick what blocks (the safety floor is pre-marked recommended — press a to take it). Your selection is written to .prismor/policy.yaml as settings.selection: explicit plus one line per rule, so what blocks is readable in the file. When a rule then blocks something legitimate, the deny message prints the exact prismor allow <rule> --pattern '<literal>' that fixes it — for the human to run; agents are stopped from editing Prismor's own config by always-on self-protection rules, unless the human opens a short password-gated window with prismor unlock. See Choosing what blocks and Making exceptions.

The install flag still sets the starting posture, and an observe install combined with PRISMOR_LOCAL_DRY_RUN=1 acts as a local dry-run kill-switch that suppresses all blocking:

Upgrading from a pre-mode release? Backward compatibility is preserved: a policy that predates per-rule modes (it sets settings.block_categories but no default_mode and no rule-level mode) keeps its original behavior — those categories still block when installed with --mode enforce. The moment your policy adopts the per-rule model (any mode/default_mode), it becomes fully policy-authoritative as described above.

Architecture

Selected Capabilities, Walked Through

Three modules from Capabilities, with setup, output, and results.

Hybrid Semantic Prompt-Injection Defense

Disabled by default. See docs/semantic-guard.md for full setup.

Self-Hosted Dashboard

Supply Chain Enforcement

See docs/supply-chain.md for the full scoring table, ecosystem support, and IOC format.

Disabling Prismor

This does not affect policy rules set to mode: enforce in .prismor/policy.yaml — those remain policy-authoritative regardless of how the hook was installed (see Observe / Enforce above).

3. Clear a session's scoped-agent rules

Scoped Agent synthesizes a per-session allowed_tools/deny_tools list at .prismor/scoped/{session_id}.json. This check is independent of hook --mode — a tool in deny_tools is hardcoded to action: block / mode: enforce in prismor/runtime/scoped_agent.py, so it blocks even when hooks are installed with --mode observe. Uninstalling hooks or switching to observe mode will not lift a scoped denial.

There's no bulk-clear — each session is cleared by ID individually. If a session was scoped before you ran scope clear, the cleanest fix is usually to start a fresh session rather than chase the existing one's cached state.

Benchmarks

See benchmark.md for the full methodology, per-category breakdown, and latency analysis.

Contributing

PRs are welcome. Read CONTRIBUTING.md before you start — it explains the one thing that matters most here: reuse the mechanisms that already exist, and solve the problem in the fewest lines you can. Smaller diffs get merged faster.

The short version:

• New detection rules go in prismor/runtime/default_policy.yaml, following the schema in prismor/runtime/policy_schema.json — detection patterns never go in Python
• Check the extension-point table before adding a new module; most changes are configuration, not code
• Tests live in tests/ — run bash scripts/run_security_tests.sh before opening a PR
• Open an issue first if you're unsure where something fits

By participating you agree to the Code of Conduct.

Star History

• Prismor.dev