Prismor checks every AI coding agent tool call against policy before it runs

A tool call is the moment an agent commits: run this shell command, read this file, install this package. Endpoint tools sit at the kernel and the file system, so the command reaches them after the agent has already chosen it ^[4]. Prismor takes the call as its input and returns allow, warn or block before execution ^[1][2].

Rules ship in observe mode. Each call and each finding goes to a dashboard that runs locally against local databases, and the operator promotes individual rules to enforce, which blocks in real time ^[5]. PrismorSec's 0.8 millisecond overhead figure comes from 10,000 simulated agent sessions ^[6].

The rule quality is where the numbers are self-reported, because the project scores its own presets. dev-safe, meant for feature work on unfamiliar code, is rated 31 percent coverage and 9 percent friction ^[7]. regulated-airgap, which cuts off network and shell access, is rated 100 percent coverage and 90 percent friction ^[8]. Per point of friction that is about 3.4 points of coverage for dev-safe and about 1.1 for the airgap preset ^[1]. In the configuration most teams will actually run, 69 percent of whatever Prismor counts as coverage goes unchecked ^[2]. Help Net Security's write-up does not say what the coverage percentage measures ^[3].

Package installs get a numeric score built from package age, maintainer count, install scripts and known indicators of compromise, with 60 or above blocking the install and an indicator match always blocking ^[10]. The shipped rules cover mini-shai-hulud and the AntV hijacked-maintainer incident, both from May 2026 ^[11]. Indicator matching handles those two. A compromise nobody has documented yet has to be caught by the age and maintainer scoring.

Prompt injection splits the same way. A file telling the agent to "ignore previous instructions" trips a pattern rule. Reword the same instruction and it slips past ^[12]. The optional semantic guard runs a fast check and escalates anything it is unsure about to an LLM for a second look ^[13]. Attacker-written text then gets passed to a second model for judgement. PrismorSec tested that guard on more than 800 cases and says the catch rate improved by 30 percent with no increase in harmless text flagged ^[14]. The coverage scores, the friction scores, the 30 percent gain and the 0.8 millisecond overhead are all PrismorSec's own measurements ^[4].