Prismor

formerly Immunity Agent

Runtime security for AI coding agents. Policy enforcement, secret prevention, supply-chain blocking, and session auditing — all running locally on your machine.

What it does

AI coding agents execute shell commands, read files, call APIs, and install packages autonomously. Prismor sits between the agent and the operating system to:

  • Block dangerous actions before they run — destructive commands, privilege escalation, reverse shells, secret exfiltration
  • Intercept package installs and score them for supply-chain risk before they touch your disk
  • Prevent secrets from reaching the model — register a secret under a placeholder name; Prismor resolves it locally through supported hooks or prismor cloak run
  • Log every tool call to a local SQLite store for session review and auditing
  • Keep a tamper-evident audit trail where every action is hash-chained and Ed25519-signed, so prismor trail verify catches edited, deleted, or rewritten history
  • Find shadow AI on the host with prismor discover, flagging any agent installed on the machine that runs without Prismor hooks
  • Hand auditors a signed evidence bundle with prismor attest, packaging posture, agent inventory, host discovery, framework-control coverage (OWASP LLM/Agentic, NIST AI RMF, EU AI Act), and the trail anchor into one file anyone re-verifies with prismor attest verify

Supports Claude Code, Cursor, Windsurf, and more.

Install

pip install prismor

Requires Python ≥ 3.8 and PyYAML (installed automatically).

Quick start

Install Prismor hooks into your project (enforces policy on every agent tool call):

prismor install-hooks --agent claude --workspace . --mode observe

Start in observe mode to log would-be blocks without interrupting the agent. Switch to enforce when ready:

prismor install-hooks --agent claude --workspace . --mode enforce

Wrap your package manager to score installs before they run:

prismor supplychain npm install express
prismor supplychain pip install requests
prismor supplychain cargo add serde

Check a command against policy before running it:

prismor check "rm -rf /"
# BLOCK  destructive_command  CRITICAL

Audit your workspace security posture:

prismor audit

Scan AI tool configs for leaked secrets:

prismor sweep

Launch the self-hosted dashboard (reads from local SQLite, no cloud):

prismor dashboard   # opens http://127.0.0.1:7070 in your browser

Detection coverage

Prismor ships with 56 rules covering the OWASP Top 10 for LLM Applications:

Category Severity What it catches
Destructive command CRITICAL rm -rf /, mkfs, dd to disk
Secret exfiltration CRITICAL cat .env | curl, piping credentials outbound
RCE canary CRITICAL Reverse shells, bash -i /dev/tcp
Privilege escalation CRITICAL chmod +s, sudoers edits, useradd
Remote execution HIGH curl | bash, wget | sh
Secret access HIGH Reads of .env, .aws/credentials, .ssh/id_rsa
Path traversal HIGH ../../etc/passwd, /proc/self/environ
DB modification HIGH DROP TABLE, DELETE FROM in shell commands
Prompt injection HIGH ignore instructions, reveal system prompt
Risky write MEDIUM Edits to Dockerfile, CI workflows, package.json

Rules are defined in YAML and fully customizable per-project.

Supply chain enforcement

The prismor CLI wraps your package manager and evaluates every install against live threat intelligence before it runs. Packages are scored on age, maintainer count, install scripts, and known IOCs. Ships with IOC coverage for recent attacks including the AntV hijacked-maintainer attack (May 2026) and the mini-shai-hulud campaign (May 2026).

prismor supplychain npm install @tanstack/react-router
  BLOCK  score 100  @tanstack/react-router
         42 @tanstack/* packages compromised via CI/CD cache poisoning

Verdicts: < 30 allow · 30–59 warn · ≥ 60 block. IOC matches always block.

Secret cloaking

Register a secret under a placeholder name:

prismor cloak add stripe_key
# prompts for the value — never stored in shell history
prismor cloak add --env-file .env
# imports each KEY=VALUE entry as @@SECRET:KEY@@

Reference it in agent instructions:

Run: curl https://api.stripe.com -H "Authorization: Bearer @@SECRET:stripe_key@@"

Claude/Hermes cloaking can substitute the real value at execution time and scrub echoed values before they return to the model. Codex hooks are block-only, so Prismor blocks literal placeholder execution there; use the Prismor-owned runner instead:

prismor cloak run -- curl https://api.stripe.com -H "Authorization: Bearer @@SECRET:stripe_key@@"

Modes

Mode Behaviour
observe Logs all findings, never blocks. Good for the first 24–48 h on a new workspace.
enforce Blocks dangerous actions in real time before the agent executes them.

Links

Project links

Data verified by PyPI on Sep 7, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (1.50.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for prismor from gravatar.com prismor

Credits

Author: Prismor Security

GitHub Statistics

Data verified by PyPI on Sep 7, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.8

Provides Extra

agno autogen-core beeai browser-use claude-agent-sdk crewai dev frameworks google-adk langchain openai-agents pydantic-ai semantic semantic-kernel signing

Tags

ai-agents claude-code llm policy-enforcement prompt-injection security supply-chain

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

prismor-1.47.0.tar.gz (1.0 MB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

prismor-1.47.0-py3-none-any.whl (1.1 MB view details)

Uploaded Python 3

File details

Details for the file prismor-1.47.0.tar.gz.

File metadata

  • Download URL: prismor-1.47.0.tar.gz
  • Upload date:
  • Size: 1.0 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for prismor-1.47.0.tar.gz
Algorithm Hash digest
SHA256 5445216448d2887268f3a4285bfce9eea4e53d5976d797f9fe83d15fc713a52b
MD5 489e38fc102867f0b31b73217eb218c1
BLAKE2b-256 9674bac1c9fe7b642de88947233fffc1c5591fe512e9d70d1953526e8e9bb89d

See more details on using hashes here.

Provenance

The following attestation bundles were made for prismor-1.47.0.tar.gz:

Publisher: release.yml on PrismorSec/prismor

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file prismor-1.47.0-py3-none-any.whl.

File metadata

  • Download URL: prismor-1.47.0-py3-none-any.whl
  • Upload date:
  • Size: 1.1 MB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for prismor-1.47.0-py3-none-any.whl
Algorithm Hash digest
SHA256 e6d717e21812688a56b2b81323ab29abb803dd538926899f3bb5f2ebd75f18a3
MD5 00f3bea99421cd085bd4b152060f946c
BLAKE2b-256 9e7a440c491c07ac13a3ba02c6fcf8c8461c81562eb63d2e7612f893f66a8945

See more details on using hashes here.

Provenance

The following attestation bundles were made for prismor-1.47.0-py3-none-any.whl:

Publisher: release.yml on PrismorSec/prismor

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

1.50.0

2 files

1.49.3

2 files

1.49.2

2 files

1.49.1

2 files

1.49.0

2 files

1.48.0

2 files

1.47.2

2 files

1.47.1

2 files

This release

1.47.0 This release

2 files

1.46.0

2 files

1.45.3

2 files

1.45.2

2 files

1.45.1

2 files

1.45.0

2 files

1.44.0

2 files

1.43.0

2 files

1.42.2

2 files

1.42.1

2 files

1.42.0

2 files

1.41.0

2 files

1.40.1

2 files

1.40.0

2 files

1.39.0

2 files

1.38.1

2 files

1.38.0

2 files

1.37.0

2 files

1.36.0

2 files

1.35.0

2 files

1.34.2

2 files

1.34.1

2 files

1.34.0

2 files

1.33.0

2 files

1.32.1

2 files

1.32.0

2 files

1.31.0

2 files

1.30.3

2 files

1.30.2

2 files

1.30.1

2 files

1.30.0

2 files

1.29.0

2 files

1.28.0

2 files

1.27.0

2 files

1.26.5

2 files

1.26.4

2 files

1.26.3

2 files

1.26.2

2 files

1.26.1

2 files

1.26.0

2 files

1.25.1

2 files

1.25.0

2 files

1.24.1

2 files

1.18.3

2 files

1.18.2

2 files

1.18.1

2 files

1.18.0

2 files

1.17.15

2 files

1.17.14

2 files

1.17.13

2 files

1.17.12

2 files

1.17.11

2 files

1.17.10

2 files

1.17.9

2 files

1.17.8

2 files

1.17.7

2 files

1.17.6

2 files

1.17.5

2 files

1.17.4

2 files

1.17.3

2 files

1.17.2

2 files

1.17.1

2 files

1.17.0

2 files

1.16.0

2 files

1.15.1

2 files

1.15.0

2 files

1.14.2

2 files

1.14.1

2 files

1.13.0

2 files

1.3.0

2 files

1.2.3

2 files

1.2.2

2 files

1.2.1

2 files

1.2.0

2 files

1.1.7

2 files

1.1.6

2 files

1.1.5

2 files

1.1.4

2 files

1.1.3

2 files

1.1.2

2 files

1.1.1

2 files

1.0.5

2 files

0.1.2

2 files

0.1.1

2 files

0.1.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page