Prismor is an open-source runtime control plane that intercepts AI agent tool calls before they execute and enforces policy against the OWASP Agentic AI threat model.
Source: https://github.com/PrismorSec/prismor
Prismor sits inside the agent's execution loop and checks every tool call against your policy before it runs. It covers 14 coding agents (Claude Code, Cursor, Windsurf, Codex, Copilot CLI, Gemini CLI, and more) and 14 framework adapters (LangChain, OpenAI Agents SDK, CrewAI, Pydantic AI, AutoGen, Google ADK, Vercel AI). Every call normalizes to one canonical event and runs through a single evaluator, prismor.runtime.evaluate_tool_call(), at about 0.8ms per call.
The runtime ships with 56 policy rules and a signed, hash-chained audit trail. It starts in observe mode so you can watch what your agents do for a week, then switch on enforcement once you know which tool-call patterns are real.
Most agentic incidents follow one shape. You give an agent a shell, a package manager, and credentials. It reads a web page, follows an instruction buried in that page, and runs a command you never approved. Nobody wrote malware. The agent did what it was told, by someone who wasn't you. That is the threat model OWASP catalogued, and it maps to concrete controls below.
OWASP's Agentic AI: Threats and Mitigations enumerates threats T1 through T15, often cited as the agentic "top 10." Prismor's compliance crosswalk (prismor/runtime/checklists/crosswalk.v1.yaml) maps each policy rule to these control IDs. The table names the actual rules.
| OWASP Agentic threat | Prismor mechanism | Rule / subsystem | Coverage |
|---|---|---|---|
| T1 Memory Poisoning | Scans CLAUDE.md / AGENTS.md at session start; on a hidden run, fetch, or exfil directive it injects a counter-instruction marking that content untrusted |
memory-embedded-directive |
Detect + neutralize |
| T2 Tool Misuse | Blocks rm -rf, piped-curl installs, and destructive shell before the process spawns |
destructive-command, remote-execution |
Block |
| T3 Privilege Compromise | Blocks privilege escalation, container escape, security-control tampering, and agent-config edits | privilege-escalation, container-escape, disable-security-controls, agent-config-tampering |
Block |
| T4 Resource Overload | Catches runaway loops and fork-bomb style exhaustion | dos-resource-exhaustion |
Block |
| T6 Intent Breaking / Goal Manipulation | Deterministic injection rules plus the hybrid Semantic Guard for paraphrased attacks the regex layer misses | prompt-injection, prompt-injection-hidden, model-manipulation |
Block |
| T8 Repudiation / Untraceability | Every tool call lands in an Ed25519-signed, hash-chained record you re-verify with prismor attest verify |
subsystem:audit-trail |
Prove |
| T10 Overwhelming Human-in-the-Loop | Routes dangerous calls to a human for approval; mines session history to stop firing on the safe ones | subsystem:step-up-approval |
Reduce noise |
| T11 Unexpected RCE / Code Attacks | Remote-exec and destructive-command rules plus shell-content inspection that catches quoted, obfuscated, and homoglyph-hidden commands, with Docker sandbox rings underneath | remote-execution, destructive-command |
Block |
| Supply Chain / Dependency Attacks (ASI04) | Scores every package before install and blocks known-bad sources; IOC database ships with real incidents like the LiteLLM and postmark-mcp attacks | prismor supplychain, pkg-install-from-url, dependency-confusion, package-registry-poisoning |
Block |
| Sensitive Information Disclosure | Swaps secrets for @@SECRET:name@@ placeholders before they reach the model and catches leaks on the way out |
secret cloaking, secret-exfiltration, bulk-pii-exfiltration |
Block |
No rule set catches everything, so a network-egress control sits underneath the policy engine. Allowlist the destinations your agent should reach, block the rest, and a tool call that slips past every content rule still cannot ship data to an address you never trusted. It holds regardless of what the agent believes it is doing.
Prismor also maps to the OWASP Top 10 for LLM Applications. The two catalogs overlap on injection and supply chain.
| OWASP LLM risk | Prismor rules |
|---|---|
| LLM01 Prompt Injection | prompt-injection, prompt-injection-hidden, Semantic Guard |
| LLM02 Sensitive Information Disclosure | secret cloaking, secret-exfiltration, pii-exposure, credential-in-header |
| LLM03 Supply Chain | pkg-install-from-url, dependency-confusion, package-registry-poisoning |
| LLM05 Improper Output Handling | model-manipulation |
| LLM06 Excessive Agency | destructive-command, remote-execution, agent-config-tampering |
| LLM10 Unbounded Consumption | dos-resource-exhaustion |
prismor attest coverage reports which framework controls your active policy covers, then packs posture, agent inventory, and the audit anchor into one Ed25519-signed bundle. A control counts as covered only while a mapped rule is active, so the report tracks real posture rather than a static claim. Frameworks in the crosswalk: OWASP Top 10 for LLM Applications, OWASP Agentic AI Threats and Mitigations, NIST AI RMF, EU AI Act, SOC 2, ISO/IEC 42001.
pip install prismor
prismor initprismor init sets up the hooks for your coding agent and drops you into observe mode. Watch the dashboard, learn your real traffic, then flip the dangerous rules to enforce. The full rule set, the crosswalk, and the coverage report live in the repo: https://github.com/PrismorSec/prismor
OWASP Agentic AI Top 10 AI agent security agent runtime control plane LLM security agent policy enforcement tool call interception prompt injection defense AI agent governance Claude Code Cursor LangChain OpenAI Agents SDK CrewAI MCP OWASP LLM Top 10 NIST AI RMF EU AI Act SOC 2 ISO 42001 how to secure AI coding agents enterprise AI agent access control agent audit trail supply chain security for AI agents secret cloaking python memory poisoning defense excessive agency