On-device AI-DR
AI detection and response that runs on the machine where the agent runs, in or beside the agent process, rather than in a cloud service or network gateway the traffic is routed through. It can decide before a local action executes and sees actions that never cross a network — shell commands, file reads, local tool calls — at the cost of needing software on every endpoint.
How MoorAI handles it: MoorAI's hooks, Agent SDK integration and sidecar evaluate on the device: secrets, PII and source code are never sent anywhere to be checked, and enforcement needs no network.
See also on-device · AI detection and response · PreToolUse hook
Related terms
-
On-device
MoorAI terms
Detection and enforcement run in the process that is about to take the action, on the developer's machine, rather than in a cloud service the traffic is…
-
AI detection and response
Defence & response
A security category for detecting, investigating and responding to threats in how AI is used — agents, model calls, MCP tools, AI applications — modelled…
-
PreToolUse hook
Agents & architecture
A callback the agent host invokes after the model has requested a tool call but before the call executes, handing over the tool name and arguments and…
Defence & response
The vocabulary of running controls for agents: knowing what AI is present, cutting what it may do down to what it uses, catching misuse, and reconstructing an incident afterwards. Where MoorAI implements a term, a separate line under the definition says how; the definition itself stays vendor-neutral. To check one agent's configuration against these ideas, use the free permission right-sizer.