Prismor

formerly Immunity Agent

Runtime security for AI coding agents. Policy enforcement, secret prevention, supply-chain blocking, and session auditing — all running locally on your machine.

What it does

AI coding agents execute shell commands, read files, call APIs, and install packages autonomously. Prismor sits between the agent and the operating system to:

  • Block dangerous actions before they run — destructive commands, privilege escalation, reverse shells, secret exfiltration
  • Intercept package installs and score them for supply-chain risk before they touch your disk
  • Prevent secrets from reaching the model — register a secret under a placeholder name; Prismor resolves it locally through supported hooks or prismor cloak run
  • Log every tool call to a local SQLite store for session review and auditing
  • Keep a tamper-evident audit trail where every action is hash-chained and Ed25519-signed, so prismor trail verify catches edited, deleted, or rewritten history
  • Find shadow AI on the host with prismor discover, flagging any agent installed on the machine that runs without Prismor hooks
  • Hand auditors a signed evidence bundle with prismor attest, packaging posture, agent inventory, host discovery, framework-control coverage (OWASP LLM/Agentic, NIST AI RMF, EU AI Act), and the trail anchor into one file anyone re-verifies with prismor attest verify

Supports Claude Code, Cursor, Windsurf, and more.

Install

pip install prismor

Requires Python ≥ 3.8 and PyYAML (installed automatically).

Quick start

Install Prismor hooks into your project (enforces policy on every agent tool call):

prismor install-hooks --agent claude --workspace . --mode observe

Start in observe mode to log would-be blocks without interrupting the agent. Switch to enforce when ready:

prismor install-hooks --agent claude --workspace . --mode enforce

Wrap your package manager to score installs before they run:

prismor supplychain npm install express
prismor supplychain pip install requests
prismor supplychain cargo add serde

Check a command against policy before running it:

prismor check "rm -rf /"
# BLOCK  destructive_command  CRITICAL

Audit your workspace security posture:

prismor audit

Scan AI tool configs for leaked secrets:

prismor sweep

Launch the self-hosted dashboard (reads from local SQLite, no cloud):

prismor dashboard   # opens http://127.0.0.1:7070 in your browser

Detection coverage

Prismor ships with 56 rules covering the OWASP Top 10 for LLM Applications:

Category Severity What it catches
Destructive command CRITICAL rm -rf /, mkfs, dd to disk
Secret exfiltration CRITICAL cat .env | curl, piping credentials outbound
RCE canary CRITICAL Reverse shells, bash -i /dev/tcp
Privilege escalation CRITICAL chmod +s, sudoers edits, useradd
Remote execution HIGH curl | bash, wget | sh
Secret access HIGH Reads of .env, .aws/credentials, .ssh/id_rsa
Path traversal HIGH ../../etc/passwd, /proc/self/environ
DB modification HIGH DROP TABLE, DELETE FROM in shell commands
Prompt injection HIGH ignore instructions, reveal system prompt
Risky write MEDIUM Edits to Dockerfile, CI workflows, package.json

Rules are defined in YAML and fully customizable per-project.

Supply chain enforcement

The prismor CLI wraps your package manager and evaluates every install against live threat intelligence before it runs. Packages are scored on age, maintainer count, install scripts, and known IOCs. Ships with IOC coverage for recent attacks including the AntV hijacked-maintainer attack (May 2026) and the mini-shai-hulud campaign (May 2026).

prismor supplychain npm install @tanstack/react-router
  BLOCK  score 100  @tanstack/react-router
         42 @tanstack/* packages compromised via CI/CD cache poisoning

Verdicts: < 30 allow · 30–59 warn · ≥ 60 block. IOC matches always block.

Secret cloaking

Register a secret under a placeholder name:

prismor cloak add stripe_key
# prompts for the value — never stored in shell history
prismor cloak add --env-file .env
# imports each KEY=VALUE entry as @@SECRET:KEY@@

Reference it in agent instructions:

Run: curl https://api.stripe.com -H "Authorization: Bearer @@SECRET:stripe_key@@"

Claude/Hermes cloaking can substitute the real value at execution time and scrub echoed values before they return to the model. Codex hooks are block-only, so Prismor blocks literal placeholder execution there; use the Prismor-owned runner instead:

prismor cloak run -- curl https://api.stripe.com -H "Authorization: Bearer @@SECRET:stripe_key@@"

Modes

Mode Behaviour
observe Logs all findings, never blocks. Good for the first 24–48 h on a new workspace.
enforce Blocks dangerous actions in real time before the agent executes them.

Links

Project links

Data verified by PyPI on Sep 7, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (1.50.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for prismor from gravatar.com prismor

Credits

Author: Prismor Security

GitHub Statistics

Data verified by PyPI on Sep 7, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.8

Provides Extra

agno autogen-core beeai browser-use claude-agent-sdk crewai dev frameworks google-adk langchain openai-agents pydantic-ai semantic semantic-kernel signing

Tags

ai-agents claude-code llm policy-enforcement prompt-injection security supply-chain

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

prismor-1.45.0.tar.gz (1.0 MB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

prismor-1.45.0-py3-none-any.whl (1.1 MB view details)

Uploaded Python 3

File details

Details for the file prismor-1.45.0.tar.gz.

File metadata

  • Download URL: prismor-1.45.0.tar.gz
  • Upload date:
  • Size: 1.0 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for prismor-1.45.0.tar.gz
Algorithm Hash digest
SHA256 1f7d032aff42dbb745669b63a83d4b17ee91992b833dea77ae5e2a4d078ac1df
MD5 00ee73e48c8adcb86c64e81e01a9a5d2
BLAKE2b-256 f31f504caa68f7b0cbc45a838704c90280f12e69ad499eb0b700bee5fdc62ca7

See more details on using hashes here.

Provenance

The following attestation bundles were made for prismor-1.45.0.tar.gz:

Publisher: release.yml on PrismorSec/prismor

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file prismor-1.45.0-py3-none-any.whl.

File metadata

  • Download URL: prismor-1.45.0-py3-none-any.whl
  • Upload date:
  • Size: 1.1 MB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for prismor-1.45.0-py3-none-any.whl
Algorithm Hash digest
SHA256 46d161a2c92d8602cf36beaf7489721551b46775cbd7d8968f6391fb746b46e5
MD5 8f5da9696a433ae510744669e6573e97
BLAKE2b-256 659536e164fd9526d65c55d09e95ee89c6debd6b3a59939d1cae189514e55432

See more details on using hashes here.

Provenance

The following attestation bundles were made for prismor-1.45.0-py3-none-any.whl:

Publisher: release.yml on PrismorSec/prismor

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

1.50.0

2 files

1.49.3

2 files

1.49.2

2 files

1.49.1

2 files

1.49.0

2 files

1.48.0

2 files

1.47.2

2 files

1.47.1

2 files

1.47.0

2 files

1.46.0

2 files

1.45.3

2 files

1.45.2

2 files

1.45.1

2 files

This release

1.45.0 This release

2 files

1.44.0

2 files

1.43.0

2 files

1.42.2

2 files

1.42.1

2 files

1.42.0

2 files

1.41.0

2 files

1.40.1

2 files

1.40.0

2 files

1.39.0

2 files

1.38.1

2 files

1.38.0

2 files

1.37.0

2 files

1.36.0

2 files

1.35.0

2 files

1.34.2

2 files

1.34.1

2 files

1.34.0

2 files

1.33.0

2 files

1.32.1

2 files

1.32.0

2 files

1.31.0

2 files

1.30.3

2 files

1.30.2

2 files

1.30.1

2 files

1.30.0

2 files

1.29.0

2 files

1.28.0

2 files

1.27.0

2 files

1.26.5

2 files

1.26.4

2 files

1.26.3

2 files

1.26.2

2 files

1.26.1

2 files

1.26.0

2 files

1.25.1

2 files

1.25.0

2 files

1.24.1

2 files

1.18.3

2 files

1.18.2

2 files

1.18.1

2 files

1.18.0

2 files

1.17.15

2 files

1.17.14

2 files

1.17.13

2 files

1.17.12

2 files

1.17.11

2 files

1.17.10

2 files

1.17.9

2 files

1.17.8

2 files

1.17.7

2 files

1.17.6

2 files

1.17.5

2 files

1.17.4

2 files

1.17.3

2 files

1.17.2

2 files

1.17.1

2 files

1.17.0

2 files

1.16.0

2 files

1.15.1

2 files

1.15.0

2 files

1.14.2

2 files

1.14.1

2 files

1.13.0

2 files

1.3.0

2 files

1.2.3

2 files

1.2.2

2 files

1.2.1

2 files

1.2.0

2 files

1.1.7

2 files

1.1.6

2 files

1.1.5

2 files

1.1.4

2 files

1.1.3

2 files

1.1.2

2 files

1.1.1

2 files

1.0.5

2 files

0.1.2

2 files

0.1.1

2 files

0.1.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page