Prismor: Open-source runtime control plane for AI agents
Prismor is a free, open-source security layer for AI coding agents. It sits between an agent such as Claude Code, Codex, or Cursor and the actions that agent wants to take, and it checks each tool call against a policy before the call runs. Every call gets one of three verdicts: allow, warn, or block.
AI coding agents run shell commands, read and write files, handle credentials, and call outside APIs, often chaining many steps with little human review. Anyone running one is exposed to a poisoned file, issue, or web page that redirects the agent mid-task, to an agent that opens a .env file while debugging and sends its contents out, and to installs of compromised packages. Endpoint security tools watch the kernel and file system, so they only see what the agent does after the choice is made. PrismorSec built Prismor to step in before that point.
It logs first and blocks later
Prismor’s rules start in observe mode by default, logging each call and any finding to a dashboard that runs locally and reads from local databases. Users then pick which rules to switch to enforce, which blocks the action in real time. PrismorSec measured the added delay at 0.8 milliseconds per tool call across 10,000 simulated agent sessions.
The prismor setup command asks users to choose one of three preset postures, and the project scores each one itself. The dev-safe preset, meant for feature work on unfamiliar code, rates 31 percent coverage and 9 percent friction. The regulated-airgap preset, which cuts off network and shell access, rates 100 percent coverage and 90 percent friction. Of the three presets, the one that covers everything also gets in the way of nearly everything.
Package checks and the vendor’s numbers
Prismor also wraps package managers such as npm and pip, scoring each install on package age, maintainer count, install scripts, and known indicators of compromise, the traces a documented attack leaves behind. A score of 60 or higher blocks the install, and a match on a known indicator always does. The shipped rules cover two attacks from May 2026, mini-shai-hulud and the AntV hijacked-maintainer incident.
Pattern-matching rules catch the obvious prompt injections, like a file that tells the agent to “ignore previous instructions.” They struggle when an attacker says the same thing in different words. Prismor’s optional semantic guard is built for those. A quick check handles the clear cases, and anything it’s unsure about goes to an LLM for a second look. PrismorSec tested the guard on more than 800 cases and says it improved the catch rate by 30 percent without flagging any more harmless text.
Prismor is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
