# Arnav Gupta launched Prismor to govern AI agent tool calls > Source: > Published: 2026-08-03 01:12:10+00:00 [Arnav Gupta (@_ar9av)](https://x.com/_ar9av?ref=runtimewire) launched [Prismor](https://www.prismor.dev/?ref=runtimewire) on [July 6](https://launcharchive.ai/launches/prismor-open-source-control-plane-for-ai-agents--x_2074154305712791893?ref=runtimewire) as an open-source control plane that sits between AI agents and the tools, files and services they can reach. The bet is that enterprises need a security checkpoint at the moment an agent attempts an action, rather than another dashboard explaining what happened afterward. [Arnav Gupta on X](https://x.com/_ar9av/status/2084052318409093354?ref=runtimewire) The public launch came roughly nine months after Prismor's first package release appeared on PyPI in October 2025, suggesting Gupta had been building the underlying runtime well before introducing the current enterprise pitch. Gupta's own [portfolio](https://ar9av.in/?ref=runtimewire) describes him as a BITS Pilani graduate, a Founders Inc. fellow and an ML engineer who has built a long list of software side projects. Those include HotLap Daily, a browser racing game for which his site claims more than 100,000 monthly active users. Prismor is a different kind of founder bet: a security product aimed at the gap created when coding assistants stop suggesting code and start running commands. "The agent ran as a nameless process," Gupta wrote in the [launch language archived by Launch Archive](https://launcharchive.ai/launches/prismor-open-source-control-plane-for-ai-agents--x_2074154305712791893?ref=runtimewire) and later reposted on Prismor's LinkedIn page. His complaint was concrete. Teams could see an agent complete a task without knowing which tool it called, which arguments it supplied or what prompted the action. ### The tool call becomes the security boundary Prismor's [open-source repository](https://github.com/PrismorSec/prismor?ref=runtimewire) describes a local runtime that intercepts agent actions before execution. A policy engine can allow, warn about or block shell commands, file access, network requests and tool calls. Separate modules cover secret cloaking, package-install checks, prompt-injection detection, MCP server controls and signed audit records. That placement is the core of Gupta's thesis. Prompt instructions can ask a model to behave safely, while logs can reconstruct an incident after the fact. Prismor instead evaluates the proposed action at the point where generated reasoning becomes a command, API call or file operation. The distinction matters most for agents with broad permissions. A coding agent may need to inspect environment files, install packages, call GitHub or execute a test suite to be useful. Those same capabilities create paths for credential leakage, destructive commands and poisoned dependencies. Prismor aims to preserve the useful access while enforcing a separately defined policy around it. The [PyPI package](https://pypi.org/project/prismor/?ref=runtimewire) says Prismor stores events in a local SQLite database and can hash-chain and sign its audit history so edits or deletions can be detected. It lists 56 configurable rules covering risks such as destructive commands, secret exfiltration, privilege escalation, remote execution and prompt injection. Prismor also claims support for Claude Code, Cursor and Windsurf, while its [documentation](https://www.prismor.dev/docs?ref=runtimewire) describes adapters for LangChain and LangGraph, CrewAI, OpenAI Agents SDK, browser-use and other agent frameworks. Prismor does not switch every control into blocking mode on installation. The repository says its default posture is observation, with individual rules moved into enforcement through policy configuration. That is a sensible onboarding choice because a new security layer can break ordinary development work if its rules are too aggressive. It also places responsibility on operators to turn telemetry into an enforceable policy rather than treating installation as complete protection. ### Gupta is entering a contested control layer Prismor is arriving as agent security becomes part of the products it is designed to sit around. [Anthropic](https://www.anthropic.com/engineering/how-we-contain-claude?ref=runtimewire) has built filesystem and network isolation into Claude Code and described routing tool calls through policy-enforcing proxies. [Galileo](https://galileo.ai/blog/securing-the-agentic-future-cisco-ai-defense-integrates-with-agent-control?ref=runtimewire) released its own open-source Agent Control project on March 11th, promoting centrally managed runtime policies and integrations with companies including Cisco, CrewAI and Glean. Gupta's opening is the independent layer across agent vendors. Prismor's materials emphasize local execution, self-hosting and policies that can follow teams using several coding agents and framework-based applications. That could appeal to enterprises unwilling to make each model or agent provider its security authority. It also means Prismor must keep pace with a widening collection of hooks, SDKs and execution models, each of which can create a route around incomplete interception. Prismor's [LinkedIn page](https://www.linkedin.com/company/prismor-dev?ref=runtimewire) lists San Francisco as its headquarters, a 2026 founding year and a team size of two to 10 people. The small footprint makes open source a distribution strategy as much as a product choice: developers can inspect the runtime, install it locally and bring Prismor into an organization before a centralized procurement decision. The business model follows that path. Prismor's [pricing page](https://www.prismor.dev/pricing?ref=runtimewire) lists the local runtime at $0 and a Starter platform at $100 per month after August 1st. The paid layer adds a live dashboard, contextual security rules, skill scanning and retained session history, while the open-source runtime continues enforcing local policy. That split gives Gupta a clear route into companies if Prismor becomes part of developers' daily agent setup. The difficult work comes after installation: proving that its controls can recognize dangerous actions without slowing routine ones, maintaining coverage as agent interfaces change, and giving security teams evidence they can trust. Prismor's early releases establish the architecture. Enterprise adoption will depend on how well Gupta turns that architecture into a dependable checkpoint across real agent workloads.