About MoorAI
MoorAI is runtime guardrails for AI agents, apps and APIs, with an open-source (MIT) agent. Prompts, files and code stay on the machine by default. It reviews what developers send to AI coding agents, and what those agents read, run and reply, on the device, before anything is exposed. The same checks run in Agent SDK services, in any agent framework through a localhost sidecar, in front of remote MCP servers and on model API calls.
The problem
AI coding agents don’t just read what a developer types. They read files into their context (a stray .env, for example), call MCP tools with whatever arguments they were given, and reply with whatever the model generates. Reviewing prompts alone misses most of that.
The usual way to inspect this traffic is to send the prompts to someone else’s servers. MoorAI is built not to make that trade: secrets, personal data and source code are checked where they already are, on the developer’s machine.
How it works
- On-device checks. A small native host wraps the agent’s terminal, and a local detection engine checks prompts, file reads, tool calls and outputs against a 85-threat matrix in 17 categories, plus content rules and detector packs your organization defines. All of it runs on the device.
- Policy actions. On a device enrolled in a management console, MoorAI coaches, alerts, blocks, requires a justification, or ends the agent session, per policy.
- Content-free signals. The console never receives your prompts, code or files unless an administrator turns on a capture tier. From an enrolled device it receives which rule fired, the risk level and a keyed one-way hash (plus the login and hostname, which the console pseudonymises on arrival). The emails of the AI-tool accounts a device reports are pseudonymised the same way.
- Enforcement the agent can’t switch off. In CI and containers, MoorAI runs from Claude Code’s managed settings, which a repository’s own settings can’t disable, or inside an Agent SDK service’s process; a localhost sidecar and a local MCP gateway cover other agent loops and remote MCP servers. On a developer laptop the user can remove the hook; from an enrolled device, the console flags an agent running without it or with weakened settings. How, and the limits.
- No account required. Without an account the community edition coaches: it shows what it flagged and the safer way, never blocks, and sends nothing anywhere. Enrollment in a console, free self-hosted with no user limit, turns on enforcement.
The exact fields a console receives are listed on the trust page.
Open source, so you can check
The on-device agent is open source under the MIT license, including the whole detection and reporting path. You don’t have to take the “content stays on the device” claim on trust: read the code, run it, and watch what it sends.
Open core
MoorAI is open core. The agent is MIT. The management console is a separate product, source-available under the Elastic License 2.0: it adds a multi-tenant dashboard, SSO, fleet policy, and content-free compliance exports.
Security disclosures
When we find a security-relevant defect in MoorAI, we publish an advisory with a vendor-assigned identifier (MOORAI-YYYY-NNN). These are not CVE identifiers. To report a vulnerability, follow the disclosure policy or use the contact listed in security.txt.
Contact
Questions about MoorAI, pricing or a deployment? Send us a note through the contact page.