prismor is a self-hosted runtime control plane that observes, gates, or blocks the tool calls made by AI agents like Claude Code and Codex under user-defined policies, built for authorized security teams.
| Tool | PrismorSec/prismor — self-hosted runtime control plane and policy engine for AI agents, written in Python and Apache-2.0 licensed |
| Category | AI agent runtime security / policy enforcement |
| Primary Use | Observing or enforcing policy over tool calls, MCP servers, egress, and secrets made by coding agents during authorized development and assessment work |
| Safe Use | Deployed on systems and agents you own or are explicitly authorized to govern, as a defensive guardrail and audit layer for internal AI adoption |
| Telemetry Note | As a defensive control, prismor produces session logs and security audit trails in a local dashboard; agents under its hooks generate policy-evaluation events visible to the operator |
prismor from PrismorSec positions itself as runtime security for the current generation of autonomous coding agents — Claude Code, Codex, Gemini CLI, Cursor, GitHub Copilot, OpenCode, Kiro, Kimi Code, Trae, and Google Antigravity, with a longer tail including Grok Build, OpenHands, Aider, Goose, and Devin CLI documented in AGENT_INTEGRATIONS.md. The premise is straightforward: these agents execute shell commands, read and write files, touch credentials, and call external APIs autonomously across many steps, with few natural checkpoints. Traditional endpoint tooling watches the kernel and filesystem but has no semantic context for what the agent is trying to accomplish, which is the gap prismor fills from inside the agent harness itself.
The README's threat model is unusually well articulated for a young project. It enumerates prompt injection delivered through files, issues, or web pages that redirects the agent mid-task; unintended destructive actions from misread instructions; secret exfiltration when an agent reads .env during debugging and ships the contents outbound; privilege escalation such as editing sudoers or CI pipelines to "fix" a permission error; dependency manipulation and supply-chain risk where the agent installs a vulnerable or outright malicious package in pursuit of code velocity; and the visibility problem introduced by agents that spawn subagents the user cannot see. Each of these is a failure mode that OS-level controls structurally cannot reason about, because the malicious instruction arrives as legitimate API traffic into a legitimate process.
Architecturally, prismor is a policy engine plus session logging plus a local self-serve dashboard, deployed in your own environment rather than a SaaS. The core loop is observe versus enforce: in observe mode you get full visibility of agent activity, while enforce mode blocks or requires human-in-the-loop approval on actions matching your rules. Rules are written by the operator, which matters — the project is explicitly customizable to an organization's own risk posture rather than shipping a fixed allowlist. The installation story is minimal: pip install prismor followed by prismor setup, with curl and git clone alternatives plus PEP 668 guidance and secret-cloaking setup relegated to the full installation docs.
The most interesting engineering decision in the codebase is the interception matrix. Native hooks cover agents like Claude Code directly, but for agents prismor cannot hook, the LLM Proxy mode governs through the one channel every agent shares: model traffic. Point the agent at prismor proxy via ANTHROPIC_BASE_URL, OPENAI_BASE_URL, or the Google Gen AI SDK's HttpOptions(base_url=...), and every tool call the model proposes — Anthropic tool_use, OpenAI tool_calls, Gemini functionCall — is normalized into the same event shape a Bash hook would produce and judged by the same rules. Streamed calls are held until they can be judged. That normalization layer is the clean way to do cross-framework governance without maintaining per-agent forks.
The MCP Gateway extends the same idea to tool infrastructure: a single MCP connector that fronts every other MCP server in use. Each tools/call is policy-evaluated before forwarding, and each response is injection-scanned before it reaches the model, so a poisoned tool result never becomes part of the agent's context. prismor mcp-gateway install migrates an existing .mcp.json behind the gateway. Alongside it, MCP Guardrails let you block a specific MCP server or tool outright, or require human approval before the agent may call it, with a rule you author yourself. The Skill Scanner rounds this out with risk scanning of MCP servers and skills across supported agents — directly relevant to the sloppy-supply-chain problem in agent marketplaces.
Enterprise integration is clearly a design goal, not an afterthought. The Claude Inference Hooks feature makes prismor the security server behind Claude Enterprise: Anthropic forwards every governed prompt from claude.ai, Claude Code, and Cowork to prismor inference-hook serve, which runs your policy against the transcript and answers allow/deny before the model executes. The README notes signed requests via Standard Webhooks, fail-closed behavior, a shadow mode for safe rollout, and prismor inference-hook test for validating wiring with signed sample frames. On the Microsoft side, prismor can act as an external threat-detection provider for Copilot Studio agents, evaluating planned tool calls and prior tool outputs within a one-second window, with Entra ID token authentication and fail-closed on timeout.
Data movement controls are where prismor shows defensive depth beyond simple command filtering. The Data Boundary feature screens real emails, phone numbers, SSNs, cards, IBANs, and secrets against the destination's trust tier — the scenario being an agent following a third-party setup guide that quietly ships your data to a service you never approved. Optional PII detection via Presidio (pip install "prismor[pii]") catches names, places, and NHS numbers the regex rules miss, deliberately off by default so the hook path stays within a regex performance budget. Sweep and Cloak handles secret prevention at tool boundaries, with decloak-at-execution and output scrubbing in the Hermes integration.
Tool Tags abstract away the whack-a-mole of naming every dangerous tool: capabilities are classified as read, write, network, or exec, so a policy can express invariants like "nothing that reads private data may also reach the network." MCP tools self-declare their capabilities via _meta, and prismor tags lists, tests, and lints the rule expressions — a small touch that suggests the authors expect rules to be reviewed like code. Subagent governance closes the visibility hole the threat model opened: the same policy applies inside Claude Code subagents, background subagents cannot obtain approvals they have no way to ask for, delegation counts are capped, delegations can expire, and each subagent reports what happened in one line.
For defenders, the network isolation layer adds policy-driven egress control, raw IP detection, and tunnel blocking — the exfiltration paths an injected agent is most likely to reach for. The Semantic Guard is an opt-in hybrid layer adding an LLM-assisted intent check for paraphrased prompt-injection attempts the deterministic regex rules cannot catch, which is an honest acknowledgment of where pure pattern matching fails. Hosted Agent VMs support extends governance to cloud-run agents on machines you never log into — Claude Code on the web, Cursor cloud agents, Copilot coding agent, OpenHands Cloud — using install-hooks --portable to write a hook config that is safe to commit to a repository.
Supply-chain enforcement runs at install time, with IOC matching and risk scoring applied when the agent attempts to add a package, directly targeting the "agent installs a 0-day dependency for velocity" scenario. Dev Insights tooling — prismor rca, blame, and friction — gives operators post-hoc root-cause and workflow-impact analysis, which matters when a misconfigured rule quietly breaks an engineering team's agent workflows and gets security tooling uninstalled. Prompt Guardrails take a softer approach: plain-language rules injected into the agent's context, such as a "never push to main" instruction, set per agent and tuned per session, with edits picked up on the next prompt.
The project carries an OpenSSF Best Practices badge, an Apache-2.0 license, 347 stars, and a Python codebase published to PyPI as prismor — a healthy distribution posture for a security control you are being asked to put in the loop of your agents' model traffic. The documentation tree is granular, with per-feature docs covering threat models, cleanup procedures for leaked secrets, and a CLI reference, which is what you want to see before trusting a tool whose failure mode is either blocking legitimate work or failing open on malicious work. From a defensive perspective, prismor is best understood as a control plane for the emerging agent threat surface: not a replacement for endpoint or network security, but the semantic layer those tools lack, deployed on agents and infrastructure you own or are authorized to govern, with an audit trail that turns autonomous agent behavior into something a human can actually review.
PrismorSec/prismor.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.