That’s not a hypothetical. When Claude Code opens a repository, it runs git status before you type anything. When your agent decides a dependency is missing, it installs it. The tool-approval prompt you’re trusting? It fires after the hook, not before. GitSpawn, disclosed last month, demonstrated this gap with eight vulnerabilities across seven agents — four of which remain unpatched today.
Prismor (formerly Immunity Agent) shipped this week to close that gap. It’s a self-hosted, open-source runtime control plane that sits between your AI coding agent and every tool call it makes, checks each call against a policy before it executes, and either allows it, warns you, or blocks it outright. Claude Code, Codex, Cursor, and Windsurf are all supported from day one.
The Problem Is the Tool Call, Not the Agent #
Researchers from Manifold Security found that a malicious .git/config entry can run attacker-supplied commands the moment Claude Code executes git status — before the workspace-trust prompt, before any approval screen, before you know you cloned a hostile repository. That’s one of eight GitSpawn findings. Four are still open.
Supply chain is worse. The first half of 2026 produced 37 campaigns and 497 indexed malicious packages across npm and PyPI — 4.5 times the volume of the entire prior year. GitGuardian’s 2026 data found that AI-assisted commits leak secrets at 3.2%, more than double the 1.5% baseline for human-only commits. There are 24,008 secrets sitting in public MCP configuration files on GitHub right now. Your agent doesn’t know which packages are poisoned. It installs what it thinks you need.
Prismor’s answer: intercept every tool call before it runs, score it, and block the dangerous ones before they land.
Install It in Two Commands #
Prismor is on PyPI. Installation is a single pip command followed by an interactive setup wizard that takes about five minutes:
pip install prismor
prismor setup
The setup wizard asks you to pick an enforcement mode, choose which detection rules apply, select which agents to hook, and enable secret cloaking — which strips credentials from tool-call payloads before the agent sends them. At the end, Prismor wires itself into whichever agents it detects on your machine automatically. Alternatively:
curl -sSL https://prismor.dev/install | sh
prismor setup
Three Postures, Not a Wall of Settings #
Instead of asking you to configure six policy axes from scratch, Prismor’s setup offers three named governance modes. Each compiles into a policy.yaml you can edit manually if needed.
| Posture | Coverage | Friction | Best For |
|---|---|---|---|
| dev-safe | 31% | 9% | Unfamiliar codebases |
| trusted-workspace | 34% | 25% | Personal repos |
| regulated-airgap | 100% | 90% | CI/CD, regulated envs |
dev-safe is the one most developers should start with. It blocks secret exfiltration, secrets in payloads, destructive commands, and supply chain attacks at 9% friction. An injected agent cannot reach unlisted hosts to exfiltrate your data. This is the five-minute install for any developer who runs Claude Code or Cursor against unfamiliar codebases.
regulated-airgap cuts off network and shell access entirely — 100% coverage. Use this for CI/CD pipelines in regulated environments, not everyday development.
Supply Chain and MCP Protection #
Prismor wraps npm and pip. When an agent tries to install a package, Prismor scores it on four axes: package age, maintainer count, install scripts, and known indicators of compromise. A score at or above 60 blocks the install. A known IOC match always blocks, regardless of score.
For MCP specifically, Prismor includes an MCP Gateway — a single connector that fronts every MCP server you use. Each tool call is policy-evaluated before forwarding, and each server response is injection-scanned before the model sees it. A poisoned tool result never becomes part of the model’s context.
The whole thing adds 0.8 milliseconds per tool call across 10,000 simulated agent sessions. You won’t notice it.
Install dev-safe Today #
There’s a common assumption that tool-approval prompts are enough — that reviewing what the agent proposes to do is sufficient security. That assumption is wrong. Prompts appear after hooks fire. Some actions execute before any confirmation screen. The ecosystem moves faster than trust models can keep up.
Prismor is Apache-2.0, self-hosted, and keeps all session data on your machine. No cloud dependency, no per-seat pricing, no vendor lock-in. The GitHub repository has the source code and full policy reference. The quickstart gets you from zero to a hooked agent in five minutes.
If you’re running any AI coding agent today, dev-safe is the floor. Start there.