Prismor Adds Runtime Policy Enforcement for Claude Code, Codex and Other AI Agents
Prismor is an open-source runtime security layer for AI agents that intercepts tool calls before execution and applies policy decisions such as allow, warn or block. The project supports coding agents including Claude Code, Codex and Cursor, alongside agent frameworks and MCP-based workflows, and is distributed under the Apache-2.0 license.
The project addresses execution risk in increasingly capable coding agents: a model can invoke shells, modify files, call MCP tools, install packages and handle credentials as part of an ordinary session. Prismor places an enforcement layer on those actions and records the resulting activity in a local audit trail.
Its current documentation provides a pip installation path with pip install prismor, followed by prismor setup. A self-hosted dashboard can run locally on 127.0.0.1:7070, keeping workspace event data on the operator's machine in the default local deployment.
What Prismor enforces
Prismor evaluates agent actions against configurable policy before the underlying tool call executes. Its documented controls cover command execution, secret leakage, prompt-injection signals, agent identity and software-supply-chain activity.
Policies can be kept as code. A project can define enforcement behavior in .prismor/policy.yaml, allowing teams to version security rules with the rest of their infrastructure configuration. The project supports observe-oriented operation as well as enforcement workflows that can block an action or require human approval.
Secret protection is another execution-path control. Prismor can cloak sensitive values before they are exposed to the model, reducing the amount of credential material entering model context. Its dashboard records sessions, findings, threat categories, agent breakdowns and a live event stream for later investigation.
Agent and framework coverage
The official documentation lists Claude Code, Cursor, Windsurf, OpenClaw, Hermes, Grok Build and Kiro CLI among supported agents and states that more than 55 agent integrations are covered. The broader project documentation also describes integrations for Codex, GitHub Copilot, OpenCode, Qwen Code, OpenHands, Aider and other agent runtimes.
Prismor also targets framework-level deployments. Its product documentation describes integrations with the OpenAI Agents SDK, LangChain, CrewAI and MCP-compatible agents. The same policy layer can therefore sit around tool execution in custom agent applications as well as coding-agent clients.
Operators should verify the project's current integration matrix before relying on a specific interception path. Agent products change their hook, MCP and configuration interfaces frequently, and enforcement coverage depends on the relevant execution path being mediated by the control layer.
Local setup
The documented quick start is:
pip install prismor
prismor setup
prismor setup launches an interactive configuration flow for enforcement mode, agent selection, secret cloaking and installation scope. The documentation also exposes a non-interactive setup path for automation.
The dashboard can then be started with:
prismor dashboard
By default it opens the local dashboard on port 7070. A different port or headless operation can be selected from the CLI.
For source-based installation, the project documents cloning the repository and running its initialization script:
git clone https://github.com/PrismorSec/prismor.git ~/.prismor
bash ~/.prismor/scripts/init.sh .
Supply-chain controls
Prismor includes a package-installation gate for npm, pip, pnpm and other supported package-manager flows. Its documented scoring considers signals including package age, maintainer count, install scripts and known indicators of compromise. The default policy bands shown by the project are scores below 30 for allow, 30–59 for warn and 60 or above for block, with known-IOC matches blocked directly.
The project also provides a supplychain harden command that writes package-manager lockdown configuration into supported project configuration files. This extends controls beyond an interactive alias so CI jobs and IDE integrations can inherit package-manager restrictions.
These controls add a policy decision to package installation. Teams still need dependency review, lockfiles, provenance controls and ordinary endpoint protections around the agent environment.
Where the architecture fits
Prismor is most relevant when an agent already has meaningful execution authority: repository write access, shell access, package installation, MCP tools, deployment credentials or other capabilities with side effects. Runtime mediation creates a separate decision point between model intent and execution.
That separation is useful for organizations adopting multiple agent products. A policy layer can provide a common place to express restrictions and collect audit evidence even when individual agents expose different approval interfaces.
The security boundary depends on integration completeness. High-assurance deployments should test each enabled agent, tool transport and package-manager path against the expected policy and confirm that privileged actions traverse the interception layer before using it as a production control.
Bottom line
Prismor packages several controls that are becoming important for agentic development environments: pre-execution tool-call policy, secret masking, human approval, supply-chain checks and local auditability. Its Apache-2.0 distribution and self-hosted path make the underlying enforcement model inspectable and deployable independently of a proprietary agent platform.
The practical evaluation criterion is coverage. Teams should map every privileged action their agents can take, confirm which paths Prismor actually intercepts, and then test allow, warn, block and approval behavior against those paths before using it as a production control.