Capabilities

Every prompt is checked locally against policy (a 85-threat matrix plus content rules) before it reaches the agent. The console never receives the prompt unless an administrator turns on a capture tier.

Choose the response per policy, per tenant, per device. Nudge with a coaching note, raise an alert, or block the prompt outright.

Instead of a hard block, MoorAI can show an inline coaching note that points the employee toward responsible AI use at the moment of the prompt, not after the fact.

A web console shows posture, device inventory, alerts, and compliance — built from redacted metadata only, never prompt content.

The console never receives your prompts, code or files unless an administrator turns on a capture tier. It receives which rule fired, the risk level and a keyed one-way hash (plus the login and hostname, which the console pseudonymises on arrival). Governance without surveillance.

Works ahead of the AI agents your team already uses — Claude, Codex, and GitHub Copilot — as a thin local layer.

This guardrail covers what an agent reads, as well as what a person types. MoorAI hooks the agent's file-reading tools, so an agent pulling in a .env full of live keys is caught before that content lands in the model's context. Enforcement on Claude Code runs through its PreToolUse hook and is validated end to end. Codex, Copilot CLI, Gemini CLI and Cursor get the same deny through their own pre-tool hooks; those adapters are tested against each vendor's documented payloads and not yet against the live agents.

Inspects the arguments of every mcp__* tool call for secrets and PII before the call runs, and blocks per policy. The MCP surface is where agents quietly hand data to third-party servers — this is the check on that path.

Limits what an agent is allowed to do, whatever it's told. Your approved-MCP-server list is enforced at call time (a call into a server that isn't on the list is blocked), and tool-call arguments are inspected before they run. This is the direct control for OWASP LLM06: Excessive Agency, so shadow MCP and over-reach are stopped at the call rather than found in a later review.

Checks a risky action against what the user actually asked for. An upload to a host the prompt never named, a destructive command or credential read on paths it never named, or an MCP write to a service it never named is reported as outside the stated task (threat #64). From each prompt a person writes, the hook keeps only device-keyed hashes of the sites, paths, service names and three labels it mentions, never the prompt. Reports by default; policy can make it ask, and a device with no account coaches. It is lexical, not semantic, so an upload to a host the user named passes. It runs on Claude Code, Codex, Cursor, Gemini CLI and Copilot CLI, whose adapters forward the prompt; the four non-Claude adapters are tested against payloads in each agent’s documented shape, not yet against the live agents.

Reviews what the agent says back as well as what goes in. The secret detectors run on the output stage, and the claude -p CLI guard masks flagged secret spans before they're printed, so a key the agent echoes out of a config file doesn't land in a terminal log or a pasted transcript.

Reports the rules files an agent runs under (CLAUDE.md, AGENTS.md, GEMINI.md, and the Copilot, Cursor, Windsurf and Cline rules) when a substantial share of one shows up in what the agent writes, in a shell upload, a WebFetch or MCP arguments, or is uploaded by path, as in curl -d "$(cat CLAUDE.md)". Each file is fingerprinted on the device as keyed hashes of 7-word shingles; no text is stored. Editing the rules file itself and quoting a line or two stay silent. Report-only (threat #52). A paraphrase or translation is not matched.

Most malicious agent skills carry no code, only instructions, so they hide the instruction from the person who installs the file. Skill Analysis names each technique with its own label: padding (60 or more blank lines with content after them), an HTML comment holding a shell command, a beacon line, a URL to call or an order to the agent, concealment wording (“do not tell the user” near an exfiltration, persistence, secrets, execution or destruction action), text addressed to a reviewer or scanner telling it to pass the file, and an order to write the skill into the agent’s memory or rules files. Every rule also reads a view of the text with zero-width characters next to letters removed, Unicode tag characters decoded and blank runs collapsed, and the phrasing rules read look-alike letters folded to Latin. Findings are labels, never the matched text (threats #40, #3 and #22). They are phrasing and layout rules, so a reworded instruction can still pass.

A skill that writes itself into CLAUDE.md, AGENTS.md, a rules folder or the agent’s memory steers every later session. MoorAI watches those files with no policy at all: a write raises a content-free alert, with no prompt, and an admin can make it ask or block. It reads the direct writes and the indirect ones: cp, mv, install, rsync, curl -o, wget, dd, git checkout and git restore, patch, tee, sed -i, heredocs and an MCP filesystem server’s write, edit and move tools. A command it cannot parse is held, never passed as clean. A write whose target is known only at run time (a variable, a glob, a download named by the server, an abbreviated or unknown option, a work tree or config set from the environment) raises its own alert, write-target-unknown, or is held for a decision where protected paths are declared. Part of threat #84, weakening oversight.

In MoorAI for AI Servers, the model proxy checks every inline file, document and image a request carries with MetaDefender Cloud or VirusTotal before the request goes upstream (Anthropic, OpenAI Chat and Responses, Gemini, Ollama), and moorai-serve offers the same check at /v1/file-scan. Hash mode sends only the file’s SHA-256; upload mode is an explicit opt-in. A malicious file blocks the request or alerts, by policy; an unknown one follows its own setting: allow, ask or block. What is scanned is what is sent: a file field is read under every key case Ollama’s parser accepts (Images, IMAGES), and in enforce mode a request that repeats a JSON key or gives one field two case variants is refused rather than guessed at. Scanning is off until an admin turns it on, and keys come only from the server’s admin binding, key file or environment.

A document from a browser download or a messaging app can carry an injection no detector recognises, so MoorAI judges it by where it came from. A file counts as outside when it carries the macOS quarantine mark or download record, a Windows Zone.Identifier for the Internet or an untrusted zone, or sits in the download folder. When the agent reads one (a Read, cat, textutil or pandoc, an MCP filesystem read), unpacks an outside archive or runs an outside file, the session is tainted for 30 minutes, with no content analysis. In that window six actions take the admin’s level, each set on its own: an upload or other outbound transfer, a write to a memory or instruction file, adding an MCP server or installing a skill or plugin, running an outside file, git push, and sending a message. Notify is the default; ask and block are policy settings. Removing an origin mark (xattr -d com.apple.quarantine, Unblock-File) raises an alert every time. Alerts name the source kind, the app and a keyed host hash, never a path or a host (threat #3). On Linux, the download folder is the signal.

Off until an admin sets fileQuarantine. Then a file from outside reaches the agent only as a structured summary: a separate model with no tools, local unless the admin allows otherwise, reads it and returns the document type, a short summary, key facts and any text aimed at an AI, framed as untrusted data. A Read is pointed at the summary; other reads are refused with the summary in the reason. Every detector runs over the summary, and one that carries an injection is withheld. Under "ask" the person can still approve the raw file. The reader runs under its own OS account on Linux; on macOS the admin pins a same-user reader by executable path and code-signing Team ID. MoorAI checks which process accepted the connection before it sends anything. Each read raises one content-free alert with its outcome (threat #3). Origin taint stays on, since a summary is still model-written text.

The admin lists the SHA-256 of each approved model file (modelPins) and picks report, ask or block (modelPinMode), in the signed policy or the root-owned machine config, never a user file. An agent’s llama-server -m and the other llama.cpp tools, vllm serve, ollama run and ollama create, and Python loads of a local path in the command’s own code (torch.load, pickle, joblib, np.load, load_model, from_pretrained) are checked before they run; an Ollama blob is checked against its own hash, never its name. The download scan and the store scan mark every unpinned file not-approved, and a pin never overrides a static finding. A file too large to hash in time is asked or denied by mode, never allowed silently. Alerts carry the load kind, format, a size class and the first 12 hex of the hash, never a path or a model name (threat #76). A pin proves which file runs; task-bound tool calls check what it then does.

Two deterministic checks of a tool call against the person’s request, with no model guarding a model. Object check: for a high-impact call (an MCP write, a money, identity, bulk-data, destructive or delegation function, a function whose name carries a write verb, or any tool the policy’s intentArgs names), the call’s target must be named in the request. Under “cut the apple”, cut(target: "apple") passes and cut(target: "hand") is object-not-in-task; it reports by default, and policy can ask or block. Task allowlists: when a session’s task matches an entry, by keywords or a task id the service sets, only the tools and argument values it lists pass (exact values, globs, numbers or ranges), an unlisted argument is denied, and anything else is held at the entry’s deny or ask. An entry that cannot be read denies what it would have covered and raises an alert. Runs in the model proxy, moorai-serve, the Agent SDK and the endpoint hook on MCP calls. The task itself is never stored, only keyed hashes of its words, and alerts carry no argument (threat #64). It matches words, not meaning.

MoorAI fingerprints your local secret values (.env, cloud credentials) on the device as keyed one-way hashes and blocks an outbound command or tool call that carries one, verbatim or encoded: base64 or base64url, padded or not and alone or inside a larger blob, hex, percent-encoded, JSON-escaped, reversed or wrapped across lines. A secret the agent reads during the session, a provider token in a file, a command’s output or an MCP result, or a KEY=value line of a credential file, joins the check for the session-risk window (30 minutes by default). When MoorAI cannot be sure it saw every secret, the call is an unverified match that secretEgress.unverified decides: ask by default, or block or report; on a host with no one to approve, ask becomes deny. Only the hash prefix, the encoding and the source kind leave the device. Encryption, compression and custom encodings are not covered.

Anyone holding a bucket or a signed URL reads back what lands there, so a bucket the agent picked itself is an exfiltration drop. MoorAI flags curl, wget or Invoke-WebRequest sending a body, -T or a non-GET method to a public object-storage endpoint (Amazon S3, Azure Blob, Google Cloud Storage, Alibaba OSS, Cloudflare R2, Tencent COS, Huawei OBS, DigitalOcean Spaces, Backblaze B2 or Wasabi), matched by the provider’s own endpoint naming rather than the bucket name, or to a pre-signed URL on any host (X-Amz-Signature, OSSAccessKeyId, an Azure SAS sig=, X-Goog-Signature). Uploading to your own bucket is ordinary work, so it reports by default; a policy can ask or block (threatPolicy["86"]), and that setting applies to every bucket, your own included. A download, signed or not, is not an upload. Uploads through scp or rsync, or through the providers’ own CLIs (aws s3 cp, gsutil cp, az storage blob upload, rclone), are outside this rule (threat #86; ATT&CK T1567.002, partial).

An agent started from a shell runs with its own permissions and none of the parent’s approvals, and a scheduled one keeps running after the session ends. MoorAI flags a shell command in which the agent starts another AI agent in its non-interactive form (claude -p, codex exec, gemini -p, aider --message, cursor-agent -p, opencode run, goose run, also through npx or uvx), installs an agent CLI (a global npm install, pip, pipx, uv, brew, winget, or a vendor install script that is run), or schedules one through cron, launchd, systemd, at or a Windows scheduled task. It reads the command the way the shell runs it, so a name in a commit message, a README or a fetched page is not a launch, and --help and --version never are. The agent’s own sub-agent feature is tracked separately. It reports by default; a policy can ask or block (threatPolicy["88"]).

What comes back into the agent is untrusted input. On Claude Code, MoorAI scans command output, MCP responses, sub-agent reports and fetched pages as inbound content, for indirect prompt injection and secrets spilling into context, within a 64 KB window. The tool has already run, so a finding reports and tells the model to treat the output as data; it cannot un-run the call. On 1,041 benign outputs (corpus samples, real command output and node_modules files) it alerts on 148 and blocks none; 45 of 87 attacks alert, measured in-sample. It adds one hook process per Bash, MCP or sub-agent call, about 82 ms at p50. PowerShell output is scanned the same way as Bash output, and the other agents’ adapters forward only web results.

For secrets, personal data and regulated data, a policy can mask: MoorAI replaces the matched span with a placeholder such as [MOORAI:secret:…], derived from a keyed hash so no part of the value survives, re-scans the rewritten call and lets it proceed. It rewrites Claude Code tool inputs (a command, file content, MCP arguments, a sub-agent prompt) and tool results, and never auto-approves a call. Where it cannot rewrite — a Read, the other agents’ adapters, a device with no account — the policy’s fallback applies. Masking is built from Claude Code’s hooks reference and has not yet been observed in a live session.

moorai-doctor checks, read-only, whether MoorAI is actually protecting a machine: its hook registration in Claude Code, Codex, Cursor, Gemini and Copilot, Claude Code managed settings that can switch hooks off, enrollment, which policy is enforced and whether its signature verifies, and a live self-test of the real hook. moorai-explain answers “why did MoorAI flag this?” for any string: each finding, the policy action, the final decision and the safer alternative, locally. Step by step in the quick start.

Around 14 provider-anchored detector families — GitHub, GitLab, Slack, Stripe, AWS, Google, OpenAI/Anthropic, npm, PyPI, SendGrid, Twilio, Azure, GCP service-account keys, database connection strings — plus Shannon-entropy scoring for the keys no pattern knows about.

False-positive blocks are the fastest way to kill a guardrail's credibility. The entropy gate ships with a benign-shape allowlist (UUIDs, git SHAs, base64 and data-URIs, ISO timestamps, obvious placeholders), so high-entropy strings that clearly aren't credentials don't stop anyone's work. Measured: 3.32% of benign developer prompts flagged (20 of 602), at 86.4% recall on a locked held-out attack set. The full accuracy table.

Ship your own patterns — internal project codenames, customer-ID formats, contract numbers — as data from the policy server. Packs are compiled and ReDoS-guarded on-device, so a bad pattern can't hang the endpoint. No agent rebuild, no redeploy.

A screenshot of a credentials page is still a credentials page. Text is extracted using your operating system's built-in recognition: on macOS that's the system Vision engine, so the image never leaves the machine and no model is bundled. This runs in the MoorAI desktop app. Where the OS provides no text recognition, the app can send the image to Anthropic’s API with an Anthropic API key already on the device, never to MoorAI. Either way the extracted text runs through the same PII and secret policy as typed text, closing the copy-paste-a-screenshot workaround.

A poisoned document in a vector store is read back into a later user’s context with no tool call, so MoorAI scans documents before they are embedded. There are three ways in: scanBeforeEmbed(chunks) and guardEmbed(embedFn) in the Agent SDK for an app that runs its own ingestion, POST /v1/index-scan on the local sidecar for any framework, and the MCP proxy and gateway, which scan the document arguments of vector-store write tools before the server sees them. The write tools were read from each server’s source: Chroma’s add and update documents, Qdrant’s qdrant-store, Pinecone’s upsert-records, Weaviate’s insert and upsert, mem0 and OpenMemory’s add and update memory, Milvus’s insert, the OpenSearch memory tools, Redis’s set_vector_in_hash, LanceDB’s ingest_docs, and the MCP memory server’s create_entities, create_relations and add_observations. Run against the real Chroma and Qdrant MCP servers under a blocking policy, a poisoned document was refused and never stored. It reports by default and blocks when policy says so. An HTML comment carrying a system: directive is the kind of delayed hijack this catches. An app that embeds without calling MoorAI, or an in-process vector library with no MCP or API hook, is not covered.

An exportable, content-free inventory of every AI provider, model (cloud and local), agent CLI, MCP server — with its capability scope and risk level — and shadow-AI app across the fleet. HTML, JSON, or CSV, with a CycloneDX-loose components[] shape for GRC, audits, and third-party risk reviews.

An append-only governance trail (who changed which policy and when) alongside usage-by-category, prompt outcomes, and policy state, date-windowed and exportable. Records and evidence to support your AI Act obligations; MoorAI does not certify compliance, and this is not legal advice.

Fleet trust score, posture distribution, shadow-AI exposure, a worst-first list of device scores, and rule-derived recommendations. Print to PDF for the board pack, or schedule it monthly or quarterly by email.

Which data classes — PII, PHI, secrets, source, regulated — moved via which agent, on which device, over any window you pick. Exports as HTML, JSON, or CSV, and stays content-free: the classes and counts, never the records themselves.

Push alert events to your SIEM in real time as generic JSON, Splunk HEC, or CEF, still content-free. The connector is SSRF-guarded (https only, private, loopback and cloud-metadata hosts refused) and the token is encrypted at rest.

A native Windows agent ships alongside macOS, with an NSIS installer built in CI and its own native CI check. The installer carries the in-app auto-updater’s signature and no Authenticode code-signing signature. Opt-in process isolation on both: a Windows Job Object (kill-on-close so no agent process is orphaned, clipboard read/write denial to shut a silent exfil channel, USER-handle denial, and an active-process cap) and a Seatbelt sandbox on macOS.

Runs on macOS, Windows and Linux with no account required and coaches: it shows what it flagged and the safer way. Enrolled in a MoorAI console (free self-hosted, no user limit), it enforces your policy. Open source under MIT — the signed installers are built in the open by CI.

Built in Rust with a Tauri native host and a webview detection core — a small, local footprint on the machine it protects.

A separate management server, source-available under the Elastic License 2.0, adds a multi-tenant console, SSO, and compliance reporting across a whole fleet of devices.

Governance and data-loss protection for AI agents that keeps content on-device — the difference from cloud DLP is that nothing has to leave the machine.

Keep AI use professional. On-device content rules flag not-safe-for-work material — explicit, harassment, hate, violence — in both prompts and AI responses, in English and Hebrew. Sexual, violent and profane content is reported and coached by default, and never blocked unless an org sets that category to require a justification or to block; harassment, hate and the other categories run once an org turns them on.

Allow or deny which agent CLIs and MCP servers each policy permits; the MCP allow-list is enforced at call time, not merely reported. Set a default action per data class (PII, secrets, source, regulated) and require a logged justification to proceed — per tenant, per device.

Scores each MCP server from 0 to 100 the first time it is seen and again when its version changes: a name typosquatting a popular server, an unpinned version, install scripts in the copy npx already installed, poisoned tool descriptions. Scoring is offline; a registry lookup and the published verdicts of SkillTriage, MoorAI’s free scanner, are opt-in in the MCP proxy. A server below “good” raises a content-free alert (score, band and reason codes), and an org can refuse servers below a minimum score on enrolled devices. The score also appears in the AIBOM and the shadow-AI inventory. It rates where a server comes from, not what it does at runtime; tool listings and results are scanned separately.

A composite device trust score rolls up alert history, shadow-AI exposure, and endpoint posture. Beside it sits a per-device AI-asset inventory — models and providers, agent CLIs, local runtimes like Ollama and LM Studio — read from config metadata only, never tokens or credential vaults. Each MCP server is scored by capability scope: network, filesystem, credential access, derived from its launch config and env var keys, never their values.