MoorAI vs AIR
Last updated
AIR is a context firewall for an organization’s whole agent fleet, across endpoints, cloud and SaaS. MoorAI runs on the developer’s machine, inside the coding agent and in front of its MCP servers, and only a category, a risk level and a keyed one-way hash leave the device.
AIR (AIR Security, air.security) describes its product as “The Context Firewall for AI Agents” (air.security). It sits between agents and the outside world and filters what enters an agent’s context: skills, plugins, MCP servers and sub-agents, plus websites and internal data. The platform has four modules. AIR Control finds every agent, sanctioned or shadow, and holds it to policy on configuration, identity and permissions. AIR Filter vets add-ons before they are installed and again after they change. AIR Defend detects and blocks agent actions at runtime. AIR Marketplace is a single source of pre-vetted external add-ons and certified internal ones. Its coverage list spans endpoint agents (Claude, Cursor, Copilot, Windsurf), SaaS agents (Slack, Salesforce, ServiceNow, Notion) and cloud agents (Amazon Bedrock, Vertex AI, Azure AI Foundry).
MoorAI covers one surface: the AI coding agents developers run (Claude Code, Cursor, Copilot, Codex CLI). It enforces through a PreToolUse hook inside the agent, an MCP stdio gateway, and a companion browser extension that guards eight chat apps on the same device. It checks prompts, files and context, retrieved input, tool and MCP calls, skills and rules files, and AI output against a 67-threat rule base, all on the device. The agent is open source (MIT), so the content-free claim can be checked in the code.
The two products overlap on add-on vetting, shadow-agent discovery and runtime blocking. AIR reaches much further, into SaaS and cloud agents and into each agent’s identity and permissions. AIR has not published where its analysis runs or what data leaves the endpoint, so the tables mark those rows unconfirmed rather than absent.
Where MoorAI is different
These rows follow from where MoorAI runs: inside the coding agent, on the machine where the action happens, with content inspected locally. AIR’s public material describes what it filters, not the mechanism on the endpoint, so most of its cells here are “—”. That means undocumented, not missing.
Scroll sideways →
| MoorAI | AIR | |
|---|---|---|
| Content inspected on the device; only category · risk · keyed one-way hash leave it | ✓content-free signals | —where analysis runs and what leaves the endpoint is not published |
| PreToolUse hook inside the coding agent — decides before the tool runs | ✓in-agent hook | —sits between agents and the outside world; endpoint mechanism not published |
| MCP stdio gateway on the device | ✓stdio proxy | —MCP transports covered not published |
| Browser extension guarding 8 GenAI chat apps on the device | ✓companion extension | —lists ChatGPT among SaaS agents; browser extension not documented |
| 67-threat rule base, with opportunistic local-model escalation (Ollama) | ✓rules first, local model on ambiguity | —names 8 threat classes; detection method not published |
| Coach / alert / block policy modes, with kill-on-critical | ✓ | ◐shows block-or-dismiss alerts and a blocked request with a safer alternative; kill-on-critical not documented |
| Entitlement envelope — declared tools, paths and MCP servers; alert or block on drift | ✓ | ◐holds agents to policy on config, identity and permissions; declared-envelope drift not documented |
| Lethal-trifecta detection | ✓ | —data exfiltration listed; trifecta framing not documented |
| Rules-file integrity checks (CLAUDE.md, .cursorrules) | ✓ | —vets skills, plugins, MCPs, sub-agents; rules files not named |
| Slopsquat rules | ✓ | — |
| Personal vs corporate account detection | ✓ | —named as a customer concern at launch; feature not documented |
| AIBOM export | ✓ | — |
| Tamper-evident audit log, SIEM streaming and compliance mapping | ✓ | —integrations not published |
| Self-hosted console option | ✓Elastic License 2.0 | — |
| Free hosted tier up to 200 users | ✓ | —pricing not published; demo-led, sold through cloud marketplaces |
| Open source agent (MIT) — the content-free claim is auditable | ✓MIT | ✗commercial platform; no public source |
Where the two overlap
Both products treat skills, plugins and MCP servers as a supply chain, check them before install and again when they change, and block risky agent actions at runtime. MoorAI does this on the developer’s machine; AIR does it across the fleet.
Scroll sideways →
| MoorAI | AIR | |
|---|---|---|
| Discovers AI agents on the endpoint, including shadow agents | ✓ | ✓ |
| Inventories the MCP servers and add-ons agents use | ✓ | ✓ |
| Vets skills and MCP servers before install | ✓moorai scan, static, never executes the skill | ✓AIR Filter |
| Re-checks an add-on after it changes (rug-pull drift) | ✓ | ✓vets after updates and while running |
| Only approved add-ons reach the agent (allow-list with approval) | ✓MCP allow-list + approval gating | ✓blocks unapproved tools; vetted marketplace |
| Blocks risky agent actions at runtime | ✓ | ✓AIR Defend |
| Inspects web and retrieved content before it reaches the agent | ✓ | ✓ |
| Prompt-injection detection | ✓ | ✓ |
| Data-exfiltration detection | ✓ | ✓ |
| Covers Claude Code, Cursor and Copilot on the endpoint | ◐full enforcement on Claude Code; Codex and Copilot CLI detection-only | ✓listed as endpoint agents; per-agent depth not published |
Where AIR covers ground MoorAI does not
AIR covers far more of the agent estate. MoorAI stops at the developer’s machine. AIR follows agents into SaaS applications and cloud AI platforms and puts them in one inventory, and it governs each agent’s identity and permissions as well as its actions. If agents in Slack, Salesforce or Bedrock are part of the requirement, MoorAI does not cover them.
Scroll sideways →
| MoorAI | AIR | |
|---|---|---|
| SaaS agents — Slack, Salesforce, ServiceNow, Notion, Zapier, Workday | ✗ | ✓ |
| Cloud-hosted agents — Amazon Bedrock, Vertex AI, Azure AI Foundry, SageMaker | ✗ | ✓ |
| One agent inventory across endpoint, SaaS and cloud | ✗endpoint only | ✓ |
| Audits each agent’s configuration, identity and permissions against policy | ◐declared entitlement envelope; does not map an agent's credentials or permissions | ✓AIR Control |
| Curated marketplace of pre-vetted external and certified internal add-ons | ✗ | ✓AIR Marketplace |
| Covers a wider set of endpoint agents (Windsurf, Gemini, Amazon Q, Perplexity, OpenClaw) | ◐shadow-agent discovery; enforcement is Claude Code first | ✓ |
Why so many rows are unconfirmed. AIR came out of stealth in September 2026, and its public material covers what the platform does more than how it does it. Deployment method, MCP transports, data handling, integrations and pricing are not published. The “—” marks record that gap. They do not say AIR lacks the capability. The single ✗ in AIR’s column is for open source, since the platform is commercial and has no public source.
Where MoorAI is stronger. Depth on the coding agent, and a design you can read. MoorAI sits inside the agent’s own tool path, so it decides before a Bash command, file read or MCP call runs. It checks the same supply chain AIR targets (a static pre-install scan that never runs the skill, an MCP allow-list with approval gating, rug-pull drift, rules-file integrity and slopsquat rules), and it does that on the device, sending only a category, a risk and a keyed one-way hash. The agent is MIT-licensed, and the console is free hosted up to 200 users or self-hosted under the Elastic License 2.0.
Where AIR is stronger. Reach and context. AIR puts endpoint, SaaS and cloud agents in one view and holds each agent to policy on its configuration, identity and permissions as well as its actions. MoorAI does not map credentials or permissions, is not a sandbox, and does not cover SaaS or hosted agents. AIR also runs a vetted add-on marketplace and publishes supply-chain research on hijackable MCP servers and skills. Full MoorAI enforcement is on Claude Code only today; Codex and Copilot CLI are detection-only, and Claude Desktop is covered through the MCP proxy.
Running both. The products meet on the developer laptop and diverge from there. AIR suits an organization that wants one policy for agents wherever they run, including Slack and cloud AI platforms. MoorAI suits the developer fleet, where coding agents have terminal and filesystem access, where decisions should happen in-process before a tool runs, and where the audit trail should hold no prompt content. It rolls out through Intune or Jamf on macOS and Windows; Linux support is second-class.
AIR capabilities are mapped from AIR Security’s own website, add-on scanner and launch posts (air.security, September 2026); quoted phrases are theirs. ◐ = partial: present but narrower than the other column. — = unconfirmed, not necessarily absent: AIR’s published material does not clearly document the capability. MoorAI marks reflect shipped capability. AIR is a trademark of its respective owner; this page is not affiliated with or endorsed by AIR Security, and both products change often, so check specifics against current documentation.