Prismor
formerly Immunity Agent
Runtime security for AI coding agents. Policy enforcement, secret prevention, supply-chain blocking, and session auditing — all running locally on your machine.
What it does
AI coding agents execute shell commands, read files, call APIs, and install packages autonomously. Prismor sits between the agent and the operating system to:
- Block dangerous actions before they run — destructive commands, privilege escalation, reverse shells, secret exfiltration
- Intercept package installs and score them for supply-chain risk before they touch your disk
- Prevent secrets from reaching the model — register a secret under a placeholder name; Prismor resolves it locally through supported hooks or
prismor cloak run - Log every tool call to a local SQLite store for session review and auditing
- Keep a tamper-evident audit trail where every action is hash-chained and Ed25519-signed, so
prismor trail verifycatches edited, deleted, or rewritten history - Find shadow AI on the host with
prismor discover, flagging any agent installed on the machine that runs without Prismor hooks - Hand auditors a signed evidence bundle with
prismor attest, packaging posture, agent inventory, host discovery, framework-control coverage (OWASP LLM/Agentic, NIST AI RMF, EU AI Act), and the trail anchor into one file anyone re-verifies withprismor attest verify
Supports Claude Code, Cursor, Windsurf, and more.
Install
pip install prismor
Requires Python ≥ 3.8 and PyYAML (installed automatically).
Quick start
Install Prismor hooks into your project (enforces policy on every agent tool call):
prismor install-hooks --agent claude --workspace . --mode observe
Start in observe mode to log would-be blocks without interrupting the agent. Switch to enforce when ready:
prismor install-hooks --agent claude --workspace . --mode enforce
Wrap your package manager to score installs before they run:
prismor supplychain npm install express
prismor supplychain pip install requests
prismor supplychain cargo add serde
Check a command against policy before running it:
prismor check "rm -rf /"
# BLOCK destructive_command CRITICAL
Audit your workspace security posture:
prismor audit
Scan AI tool configs for leaked secrets:
prismor sweep
Launch the self-hosted dashboard (reads from local SQLite, no cloud):
prismor dashboard # opens http://127.0.0.1:7070 in your browser
Detection coverage
Prismor ships with 56 rules covering the OWASP Top 10 for LLM Applications:
| Category | Severity | What it catches |
|---|---|---|
| Destructive command | CRITICAL | rm -rf /, mkfs, dd to disk |
| Secret exfiltration | CRITICAL | cat .env | curl, piping credentials outbound |
| RCE canary | CRITICAL | Reverse shells, bash -i /dev/tcp |
| Privilege escalation | CRITICAL | chmod +s, sudoers edits, useradd |
| Remote execution | HIGH | curl | bash, wget | sh |
| Secret access | HIGH | Reads of .env, .aws/credentials, .ssh/id_rsa |
| Path traversal | HIGH | ../../etc/passwd, /proc/self/environ |
| DB modification | HIGH | DROP TABLE, DELETE FROM in shell commands |
| Prompt injection | HIGH | ignore instructions, reveal system prompt |
| Risky write | MEDIUM | Edits to Dockerfile, CI workflows, package.json |
Rules are defined in YAML and fully customizable per-project.
Supply chain enforcement
The prismor CLI wraps your package manager and evaluates every install against live threat intelligence before it runs. Packages are scored on age, maintainer count, install scripts, and known IOCs. Ships with IOC coverage for recent attacks including the AntV hijacked-maintainer attack (May 2026) and the mini-shai-hulud campaign (May 2026).
prismor supplychain npm install @tanstack/react-router
BLOCK score 100 @tanstack/react-router
42 @tanstack/* packages compromised via CI/CD cache poisoning
Verdicts: < 30 allow · 30–59 warn · ≥ 60 block. IOC matches always block.
Secret cloaking
Register a secret under a placeholder name:
prismor cloak add stripe_key
# prompts for the value — never stored in shell history
prismor cloak add --env-file .env
# imports each KEY=VALUE entry as @@SECRET:KEY@@
Reference it in agent instructions:
Run: curl https://api.stripe.com -H "Authorization: Bearer @@SECRET:stripe_key@@"
Claude/Hermes cloaking can substitute the real value at execution time and scrub echoed values before they return to the model. Codex hooks are block-only, so Prismor blocks literal placeholder execution there; use the Prismor-owned runner instead:
prismor cloak run -- curl https://api.stripe.com -H "Authorization: Bearer @@SECRET:stripe_key@@"
Modes
| Mode | Behaviour |
|---|---|
observe |
Logs all findings, never blocks. Good for the first 24–48 h on a new workspace. |
enforce |
Blocks dangerous actions in real time before the agent executes them. |
Links
- Repository: https://github.com/PrismorSec/prismor
- Docs: https://docs.prismor.dev
- Dashboard: https://prismor.dev
1 maintainer
Metadata
1 maintainer
Release files for prismor 1.55.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| prismor-1.55.0.tar.gz | 1.2 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| prismor-1.55.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 2.6 MB
Release files / prismor-1.55.0.tar.gz
| Download URL | prismor-1.55.0.tar.gz |
|---|---|
| Size | 1.2 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f28ca00b3dd6022989e7fa1489aeb7a25b2c60d794d0421d721c2a5afa55d33f
|
|
BLAKE2b-256 checksum How to use checksums |
1379ddf063a2311d6df0544d4fa7710e1cda68f11191b6506b20afcf7cb9e6a4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 27, 2026.
Transparency logRelease files / prismor-1.55.0-py3-none-any.whl
| Download URL | prismor-1.55.0-py3-none-any.whl |
|---|---|
| Size | 1.4 MB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
dadb712683ec168d7f4da80de1ee153d9f0ace521b31436c157e522843993f3d
|
|
BLAKE2b-256 checksum How to use checksums |
eb9845643ddfa4305c4a93c691ac9f501fe226a6b7091cadba36a8adeb80006d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 27, 2026.
Transparency log
