Prismor

Prismor

formerly Immunity Agent

Runtime security hooks for Claude Code, Cursor, and other AI coding agents.Blocks dangerous commands, prevents secret leaks, and stops prompt injection in real time.

Website · Onboard with Skill · CLI Reference · Supply Chain · Sweep & Cloak

---

The Problem

AI coding agents execute shell commands, read and write files, access credentials, and call external APIs. They do this autonomously, often across many steps, with limited checkpoints.

This creates risks that traditional security tooling isn't designed for:

• Prompt injection - malicious content in a file, issue, or web page can redirect the agent mid-task
• Unintended destructive actions - an agent misinterprets an instruction and runs something irreversible
• Secret exfiltration - an agent reads .env or credential files as part of a debugging task and sends the content outbound
• Privilege escalation - an agent modifies sudoers, CI pipelines, or file permissions to resolve a permission error
• Dependency manipulation - an agent installs or rewrites a package at the direction of injected input
• Supply chain risk - an agent installs a vulnerable or 0-day package while optimizing for code velocity

Standard OS-level and endpoint security tools monitor the kernel and filesystem. By the time they see an action, the agent has already decided to take it. The gap is at the agent layer for avoiding the attack

---

Capabilities

• 🛡️ [Warden](docs/warden.md) covers the policy engine, session logs, security audit, and CLI reference
• 📦 [Supply Chain](docs/supply-chain.md) covers install-time enforcement, IOC matching, and risk scoring
• 🛜 [Network Isolation](docs/network-isolation.md) covers egress allowlists, raw IP detection, and tunnel blocking
• 🔍 [Skill Scanner](docs/skill-scanner.md) covers MCP server and skill risk scanning across supported agents
• 🔐 [Sweep and Cloak](docs/sweep-and-cloak.md) covers secret prevention at tool boundaries, practical setup, best practices, threat model, and cleanup for leaked secrets
• 🤖 [Hermes Agent Cloaking](docs/hermes.md) covers Hermes-specific secret cloaking with pip entry-point auto-discovery, filesystem install, and pregatewaydispatch paste guard
• 🧠 [Semantic Guard](docs/semantic-guard.md): opt-in hybrid layer that adds an LLM-assisted intent check for paraphrased prompt-injection attempts the regex rules cannot catch
• 🪤 [Canary](docs/canary.md) plants honeytoken credential files that trip a CRITICAL finding the moment an agent reads them, catching recon behavior
• 🪪 [IAM](docs/iam.md) gives each agent a named identity and least-privilege permission profile when several agents share a workspace
• 🎯 [Scoped Agent](docs/scoped-agent.md) synthesizes minimal, task-specific rules per session so an injected pivot off-task gets blocked
• 🧬 [Learning](docs/learning.md) mines session history to propose new rules, flag false positives, and detect evasion
• ⚖️ [Layered Policy & Exemptions](docs/policy-layers-and-exemptions.md) covers per-rule observe/enforce, the non-overridable floor, and admin-granted, time-boxed exemptions across org / project / repo layers
• 📡 [Live Telemetry](docs/live-telemetry.md) covers the optional enterprise control-plane link — device enrollment, signed remote policy, and redacted telemetry streamed to a self-hosted org dashboard
• 📊 [Dashboard](docs/dashboard.md) covers the terminal and local web dashboards plus session forensics
• 🐳 [Docker and Containers](docs/docker.md) covers container hardening, prerequisites, and known limitations

Full command map across every capability: [CLI Reference](docs/cli-reference.md).

These capabilities map to the OWASP Top 10 for LLM Applications - covering prompt injection (LLM01), sensitive information disclosure (LLM02), supply chain (LLM03), improper output handling (LLM05), and excessive agency (LLM06).

---

Quick Start

Platform-specific Install

Option A: curl (easiest):

curl -sSL https://prismor.dev/install | sh

Detects your environment and uses the right install method automatically.

Option B: give your agent a skill (zero-interrupt setup):

Point your agent at [SKILL.md](SKILL.md). It is a standing instruction file: the agent reads it at session start, checks whether Prismor is installed, and follows the decision tree throughout the session without pausing your workflow.

For Claude Code, add to your CLAUDE.md:

Read `SKILL.md` and follow its instructions for runtime security.

Or via raw URL (works in any agent config file: CLAUDE.md, AGENTS.md, .cursorrules, .windsurfrules):

Read `https://raw.githubusercontent.com/PrismorSec/prismor/main/SKILL.md` and follow its instructions.

See [SKILL.md](SKILL.md) for the full decision tree and hard rules.

Option C: pip:

pip install prismor
prismor setup          # interactive 4-step onboarding wizard

prismor setup lets you pick enforcement mode, toggle detection rules, select agents, and optionally enable secret cloaking. Pass --non-interactive to skip the TUI.

Option D: git clone + wizard:

pip3 install pyyaml                          # required dependency
git clone https://github.com/PrismorSec/prismor.git ~/.prismor
PRISMOR_MODE=enforce PRISMOR_CLOAK=1 bash ~/.prismor/scripts/init.sh .

This installs enforce-mode Warden hooks and the Cloak prevention layer. To register a secret, run prismor cloak add stripe_key and enter the value when prompted. Reference it in tool calls as @@SECRET:stripe_key@@ and the hook handles the rest.

Prefer the interactive wizard? Drop the env vars:

bash ~/.prismor/scripts/init.sh .

Command Reference

Full command map: [docs/cli-reference.md](docs/cli-reference.md).

Observe / Enforce (per-rule, policy-authoritative)

Enforcement is decided per rule by your policy, not by a single global switch. Each rule carries a mode, and settings.default_mode (default observe) covers any rule that doesn't set one:

| Mode | Behavior | |---|---| | observe (default) | Logs the tool call and the finding. Never blocks. Safe for onboarding and auditing. | | enforce | Blocks the action in real time before the agent executes it. |

Out of the box everything observes — nothing is blocked until you flip rules (or default_mode) to enforce in your policy:

# .prismor-warden/policy.yaml
settings:
  default_mode: observe        # global default for rules without their own mode
rules:
  - id: destructive-rm-rf
    mode: enforce              # this rule blocks; the rest still just observe

Policy is authoritative: a rule set to enforce blocks regardless of how the hook was installed (--mode), so an admin who flips a rule to enforce via the [control plane](docs/live-telemetry.md) blocks even on observe-installed devices. See [Layered Policy & Exemptions](docs/policy-layers-and-exemptions.md) for org / project / repo precedence and the non-overridable floor.

The install flag still sets the starting posture, and an observe install combined with PRISMOR_LOCAL_DRY_RUN=1 acts as a local dry-run kill-switch that suppresses all blocking:

prismor install-hooks --agent all --mode observe    # start in observe everywhere
prismor install-hooks --agent all --mode enforce    # honor policy enforce rules

> Upgrading from a pre-mode release? Backward compatibility is preserved: a policy that predates per-rule modes (it sets settings.block_categories but no default_mode and no rule-level mode) keeps its original behavior — those categories still block when installed with --mode enforce. The moment your policy adopts the per-rule model (any mode/default_mode), it becomes fully policy-authoritative as described above.

---

Disabling Prismor

There are three independent layers that can each restrict an agent session. Disabling one does not disable the others — pick the layer that matches what you're actually trying to turn off.

1. Uninstall hooks entirely

Removes the hook-dispatch entries from the agent's hooks config, so Warden stops receiving PreToolUse/PostToolUse/UserPromptSubmit events altogether.

prismor uninstall-hooks --agent claude --scope project   # this workspace only
prismor uninstall-hooks --agent claude --scope user      # global (all workspaces)
prismor uninstall-hooks --agent all --scope project      # every supported agent, this workspace

--scope defaults to project. Project and user scope edit different files — running only --scope user does not touch a workspace's local hooks, and vice versa:

| Agent | Project scope | User scope | |---|---|---| | Claude Code | /.claude/settings.json | ~/.claude/settings.json | | Cursor | /.cursor/hooks.json | ~/.cursor/hooks.json | | Windsurf | /.windsurf/hooks.json | ~/.codeium/windsurf/hooks.json | | OpenClaw | /.openclaw/plugins.json | ~/.openclaw/config.json | | Hermes | /.hermes/plugins.json | ~/.hermes/config.json | | Codex | /.codex/hooks.json | ~/.codex/hooks.json | | Copilot | /.github/copilot/hooks.json | ~/.copilot/hooks.json |

If you only run one scope, the other one's hooks (if installed) keep firing. Run both if you want Warden fully out of the picture for an agent.

A running session has already loaded its hook config — uninstalling mid-session won't take effect until you start a new session.

If prismor uninstall-hooks reports success but hooks are still firing, you're likely running a stale install — e.g. a pipx-installed copy that's an out-of-date snapshot of a dev checkout. Check which immunity and, if it resolves into a pipx venv, reinstall from the current source (pipx install --force ) before re-running the uninstall. As a last resort, hand-edit the hooks config file directly.

2. Soft-disable: observe mode + dry-run

Keep hooks installed but stop them from blocking:

prismor install-hooks --agent all --scope project --mode observe
PRISMOR_LOCAL_DRY_RUN=1   # set in your shell/session env

--mode observe logs findings without blocking. PRISMOR_LOCAL_DRY_RUN=1 additionally suppresses blocking for any finding that would otherwise block under observe-installed hooks (warden/cli.py, checked when args.mode == "observe"). This is the right lever if you want Warden's telemetry/logging to keep working while you temporarily stop enforcement.

This does not affect policy rules set to mode: enforce in .prismor-warden/policy.yaml — those remain policy-authoritative regardless of how the hook was installed (see [Observe / Enforce](#observe--enforce-per-rule-policy-authoritative) above).

3. Clear a session's scoped-agent rules

[Scoped Agent](docs/scoped-agent.md) synthesizes a per-session allowed_tools/deny_tools list at .prismor-warden/scoped/{session_id}.json. This check is independent of hook --mode — a tool in deny_tools is hardcoded to action: block / mode: enforce in warden/scoped_agent.py, so it blocks even when hooks are installed with --mode observe. Uninstalling hooks or switching to observe mode will not lift a scoped denial.

prismor scope list                    # find the session ID
prismor scope show --session-id ID    # inspect its allowed_tools / deny_tools
prismor scope clear ID                # remove the scoped rules for that session
prismor scope edit ID                 # or hand-edit deny_tools in $EDITOR

There's no bulk-clear — each session is cleared by ID individually. If a session was scoped before you ran scope clear, the cleanest fix is usually to start a fresh session rather than chase the existing one's cached state.

---

Benchmarks

Measured overhead is 0.8 ms per tool call across 10,000 simulated agent sessions, below the 1 ms threshold for every task category tested.

See [benchmark.md](benchmark.md) for the full methodology, per-category breakdown, and latency analysis.

---

Hybrid Semantic Prompt-Injection Defense

Regex rules catch known injection shapes. The opt-in semantic guard adds an intent-aware layer: a heuristic pre-screen handles clear-cut cases in |"PreToolUse / PostToolUse hooks"| Warden

subgraph Warden["Warden Runtime Monitor"] Policy["Policy Engine\n(YAML rules)"] Session["Session Store\n(SQLite / JSONL)"] Policy --> Session end

Warden -->|"action permitted"| Allow["ALLOW\n+ log event"] Warden -->|"rule matched"| Block["BLOCK\n+ log finding"]

IDE -->|"PreToolUse hook\n(inject @@SECRET@@)"| Cloak IDE -->|"PostToolUse hook\n(scrub output)"| Cloak

subgraph Cloak["Cloak Secret Prevention"] Store["Secrets Store\n(~/.prismor/secrets/)"] CloakHook["Substitute at\nexecution time"] Store --> CloakHook end

Sweep["Sweep: Secret Cleanup\n(scan & redact AI tool caches)"] IDE -.->|"offline scan"| Sweep

IDE -->|"prismor supplychain npm/pip/cargo..."| SC

subgraph SC["Supply Chain Install Enforcement"] Scorer["Risk Scorer\n(age · maintainers · scripts)"] IOC["IOC Database\n(known compromised packages)"] Feed["Advisory Feed\n(Warden / NVD)"] Scorer --> IOC Scorer --> Feed end

SC -->|"score |"score >= 60 or IOC match"| SCBlock["BLOCK\n+ log to Warden store"]

---

## Supply Chain Enforcement

`prismor` wraps your package manager and scores every install against live threat intelligence before it runs — age, maintainer count, install scripts, and known IOCs. Ships with coverage for **mini-shai-hulud** (May 2026) and the **AntV hijacked-maintainer** attack (May 2026).

```bash
prismor supplychain npm install express                    # passes, runs npm
prismor supplychain npm install @tanstack/react-router     # BLOCK: IOC match (score 100)
prismor supplychain pip install requests numpy
prismor supplychain pnpm add lodash

Verdicts: `

---

• Prismor.dev

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: PrismorSec
• Source: PrismorSec/prismor
• License: Apache-2.0
• Homepage: https://prismor.dev

Install and usage instructions live in the source repository linked above.