MoorAI for Agents: tech specs
Everything the free agent does on the device, what runs where and what is tested. The short version is on the MoorAI for Agents page.
More: All capabilities · On-device AI DLP · Shadow-AI detection · Agent inventory · Rules-file security · MCP security · Who it’s for · Security for AI · How it works
A check inside every coding agent
Claude Code, Codex, Copilot CLI, Gemini CLI, Cursor and Factory Droid each get MoorAI in their own pre-tool hook, so every shell command, file read and MCP tool call passes the check before it runs. Enforcement is validated end to end on Claude Code.
The AI everyone else uses
A guarded home for agent CLIs
The macOS and Windows app runs Claude Code, Codex or Copilot CLI in its own terminal. It reviews each prompt before it reaches the agent, with Send redacted or Send anyway, and scans files you drop, paste or pick, reading images with on-device OCR.
AI on the web
MoorAI Browser Guard, for Chrome and Edge, checks what you type into ChatGPT, Claude, Microsoft Copilot, Gemini, Perplexity, Le Chat, DeepSeek and Grok before it is sent. Coach warns and lets you proceed; Block stops a high-severity send.
Secrets and PII stay off the model
Secrets, keys and personal data are caught before they reach a model: in prompts, in files an agent reads into its context or writes, in MCP tool calls and in pasted images. On-device AI DLP
AI tools nobody approved
AI desktop apps and AI browser and editor extensions found on the device, matched against a catalogue, and moorai-shadow compares what it finds with your allow-list. Shadow-AI detection
Models running on the machine
Which local model servers are running (Ollama, LM Studio, llama.cpp llama-server, vLLM) and whether they listen beyond loopback, plus a count of local models whose name says their safety training was removed.
AI provider keys on disk
Anthropic, OpenAI, Hugging Face, Perplexity and Google keys in shell startup files, AI CLI config folders and project .env files. Each is reported as a provider, a location class and a keyed hash; the key never leaves the device.
Downloaded files, model files and the task
A document from a download or a chat app, a model file nobody approved and a tool call the person never asked for are each judged by facts the agent cannot talk its way past: where the file came from, its hash and the words of the request.
A downloaded file taints the session
Reading a file with the macOS quarantine mark or download record, a Windows Zone.Identifier, or in the download folder taints the session for 30 minutes, with no content analysis. Uploads, memory-file writes, MCP or skill installs, running an outside file, git push and sending messages then notify (the default), ask or block, each at its own level. Removing an origin mark always alerts. Origin taint
Outside files as a summary only
Off until an admin turns it on. A file from outside reaches the agent only as a structured summary written by a separate model with no tools, scanned again before the agent sees it. The reader runs under its own OS account on Linux; on macOS the admin pins a same-user reader by executable and Team ID. Quarantined reader
Only approved model files load
An admin lists the SHA-256 of each approved model file. An agent’s llama-server, vllm serve, ollama run or Python load of any other file is reported, held or blocked, and the download and store scans mark it not approved. Alerts carry a 12-character hash prefix, never a path or model name. Model pinning
MCP calls held to the request
The hook checks each high-impact MCP call against the person’s request: its target must be named there, and for a task an admin lists, only the listed tools and argument values pass. It reports by default; policy can ask or block. The device keeps keyed hashes of the request’s words, never the prompt. Task-bound tool calls
When malware uses the AI already on the device
An implant can live off the AI: drive the user’s AI coding CLI from a process it injected into, call a local model server directly, or steal AI provider keys and call the provider from its own process. Four detectors answer those moves on an enrolled device. Their alerts carry class names, program names without paths, ports, provider names and counts, never a path, a command line or a key.
An AI CLI started by the wrong program
A Windows system host, an Office app, a script host or an image in a temp folder that starts Claude Code, Codex or another AI CLI raises a High alert, or by policy blocks every tool call of that session. A terminal or IDE is normal only when its name and install path both match.
Keys nobody issued
Opt-in by signed policy: never-issued keys in provider key shapes go into new files that key harvesters sweep and no tool loads. An existing file is never touched. A decoy in a command or a model-proxy request is denied as Critical.
Local models anyone on the machine can call
Once a day, listening sockets are matched to local model runtimes (Ollama, LM Studio, llama.cpp, vLLM and others). A server counts as behind MoorAI only when it listens on loopback alone and a connection from the check is refused; any other is reported.
Programs calling AI APIs on their own
The same daily check names the process behind each connection to an AI provider API. A tool counts as known only when its executable is in the product’s install location or, on macOS, carries the vendor’s code signature; node and python are judged by the program they run.
The console shows exposed model servers, unknown AI callers and decoy counts per device in Inventory, and decoy use counts as Critical in alerts and the SIEM feed.
Coach first, enforce when enrolled
Scroll sideways →
| State | What MoorAI does |
|---|---|
| Not enrolled | Coaches: the same detection and built-in defaults, showing what it caught and the safer way. It never blocks, never asks for sign-off, never ends a session and posts nothing anywhere. |
| Enrolled in a console | Enforces per policy: block, a signed justification, or ending the agent session. The console is the MoorAI Management Server, free self-hosted with no user limit. |
| When MoorAI can’t decide | The administrator chooses fail open or fail closed per surface, in the signed policy or the root-owned machine config. The console shows each device’s effective mode, flagged when it fails open against a closed policy. |
| Context tree | On Claude Code, the signed policy keeps each session’s context tree on the device (the default), also sends its content-free leaves to the console (a policy with a signature envelope only), or turns it off. Kept or sent, every record carries the tree’s root, so a console that holds the leaves can verify each record against them; off, records carry none. |
| Managed rollout | Jamf Pro (macOS) and Microsoft Intune (Windows) packages in the repository write the device config and register the hooks. |
The console shows the fleet: every agent, MCP server, model and device, built from content-free signals (a category, a risk level and a keyed one-way hash), which model, MCP server and tool each agent used, and, where use is measured, what it is granted but did not use. The console →
What runs where, and what is tested
Scroll sideways →
| Platform | What ships | Tested |
|---|---|---|
| macOS (Apple silicon) | Desktop app (DMG or Homebrew cask) and the agent hooks | The DMG is signed and notarized in CI. |
| Windows (x64) | Desktop app installer from GitHub Releases and the agent hooks | CI runs the hook, gateway and egress suites on Windows. No live PowerShell run yet, and the Intune install script has not run on a live device. |
| Linux (amd64 and arm64) | The agent (CLI, hooks and engine): a .deb for Debian and Ubuntu or a tarball, with SHA256SUMS, on every GitHub release; needs Node.js 18 or newer. No desktop app | Before each release, CI installs the .deb on Ubuntu 20.04 on amd64 and arm64 and runs the installed hook. |
| Coding agents | Claude Code; Codex CLI, Copilot CLI, Gemini CLI, Cursor and Factory Droid | Claude Code is validated end to end. The other five are built against each vendor’s documented hook payloads, not yet tested against the live agents. |
Prompts, files and retrieved input coming in; tool calls and skills both ways; AI output going out — each control mapped to its MITRE ATLAS technique.
- PreToolUse hook in the agent
- MCP stdio gateway / proxy
- Companion browser extension
- Local-model escalation (Ollama)
The open knowledge base of real-world adversarial tactics and techniques used against AI systems — ATT&CK, for AI. Each control above links to the ATLAS technique it counters.
Everything in MoorAI for Agents
The standalone agent, open source (MIT), for macOS, Windows and Linux. No account: it coaches on every risky action. Enroll in the Management Server to enforce — block, sign-off, session kill. Free forever. MoorAI for Agents stays free and open source regardless. Pricing →
- Every agent action checked before it runs — hooks for Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and Factory Droid
- On-device detection — 85-threat matrix plus content rules, all local
- Coaching on every risky action — what it flagged and the safer way, shown to you and, where the agent host supports it, to the agent
- Flags secrets read into agent context; the MCP guard inspects MCP tool-call arguments
- Browser Guard for AI on the web, static model-file scanning and model files pinned by hash
- Origin taint after reading a downloaded file, an optional quarantined reader, and task-bound MCP calls
- Output screening on the AI's replies
- Local policy, sends nothing anywhere — no account, no server, no console required
- Free forever — not a trial; the same engine enforces once the device is enrolled
Guard the AI people use,
on their own machines.
MoorAI for Agents is free and open source (MIT). It coaches with no account; enrolled in the Management Server, it enforces.