Prismor: Open-Source AI Agent Runtime Control Plane

Post Views: 26

Prismor functions as a free, open-source security layer designed for AI coding agents.

How Prismor Works

Prismor operates as an intermediary between AI coding agents such as Claude Code, Codex, or Cursor and the actions these agents aim to execute. The system evaluates each tool call against predefined policies before the action is initiated, assigning one of three outcomes: allow, warn, or block.

AI coding agents perform tasks like executing shell commands, accessing files, managing credentials, and interacting with external APIs, often executing complex sequences with minimal human oversight. This process exposes users to risks such as compromised files, malicious web pages redirecting agent workflows, unintended exposure of sensitive files like .env during debugging, and installation of tainted packages.

Dual-Phase Approach

Prismor employs a dual-phase approach, beginning in observe mode by default. During this phase, it logs all tool calls and associated findings into a locally hosted dashboard that accesses a database. Users can then transition specific rules to enforcement mode, which halts actions in real time.

Performance benchmarks indicate a latency of 0.8 milliseconds per tool call across 10,000 simulated agent sessions.

Security Postures

Prismor requires users to select one of three predefined security postures. Each posture is evaluated internally, with the dev-safe configuration prioritizing feature development on unfamiliar code, achieving 31% coverage and 9% friction. The regulated-airgap posture, which restricts network and shell access, provides 100% coverage but introduces 90% friction. This trade-off highlights the balance between comprehensive protection and operational efficiency.

Integration with Package Managers

Prismor integrates with package managers like npm and pip, assessing installations based on factors including package age, maintainer activity, install scripts, and indicators of compromise. A score of 60 or higher triggers a block, while matches against known indicators of compromise automatically prevent installation.

Semantic Guard

Prismor includes an optional semantic guard. This component first performs a quick analysis for clear threats, then forwards ambiguous cases to a large language model for secondary evaluation. Testing on over 800 scenarios demonstrated a 30% improvement in threat detection without increasing false positives.

Availability

Prismor is available at no cost through GitHub. The tool aims to mitigate risks associated with AI agent workflows by enforcing policies before actions are executed, complementing traditional security measures that respond after the fact.

The default ruleset addresses two attacks documented in May 2026: mini-shai-hulud and the AntV hijacked-maintainer incident. Basic pattern-matching rules identify straightforward prompt injections, such as directives instructing agents to disregard prior instructions. However, these rules face challenges when attackers rephrase malicious intent.