MoorAI vs Google Cloud and Wiz
Last updated
Google Cloud and Wiz secure the agents you run in the cloud. MoorAI checks what agents do where they act. On the Gemini Enterprise Agent Platform, Agent Identity gives each agent a cryptographic identity based on the SPIFFE standard,[2] Agent Gateway is “the network entry and exit point for all agentic interactions” of agents running on Google Cloud,[3] and Model Armor screens prompts and responses for prompt injection, sensitive data and malicious URLs.[4] Wiz, “now a part of Google Cloud”,[1] maps AI workloads and attack paths across clouds, inventories AI frameworks, models and IDE extensions, and scans AI-generated code.[8][10] MoorAI checks each action an agent is about to take: the shell commands, file reads, file writes and MCP tool calls that Claude Code, Codex, Copilot CLI, Cursor and Gemini CLI make on the device. It runs the same checks inside the agents you build, through the Agent SDK, a localhost sidecar, a model proxy, an MCP gateway and an egress proxy.
Google prices Model Armor by the token. Bought on its own, Model Armor is free up to 2 million tokens a month and $0.10 per million tokens after that; Security Command Center Premium and Enterprise include it with a monthly token allocation.[6] The pages cited here do not list prices for Agent Gateway, Agent Identity, Wiz or Google Security Operations, so this page does not compare them.
Run both. They enforce in different places and overlap in only a few. MoorAI decides against a 79-threat matrix on the device and by default sends only category · risk · keyed one-way hash (plus the login and hostname, which the console pseudonymises on arrival). The agent is free and open source (MIT); the console is free for up to 200 users.
Three things this page does not state. (1) Prices other than Model Armor’s. The pages cited do not publish them. (2) That Google Cloud or Wiz cannot do something. A “—” mark means the cited Google or Wiz page does not describe it. (3) Roadmap as shipped. Where Google or Wiz describe a capability as in preview, in private preview or coming soon, this page says so. Every Google Cloud and Wiz statement comes from their own pages, numbered and listed at the end, read on 12 October 2026.
The core difference is where each one enforces: on the network path of agents in Google’s cloud, in the code an agent writes, or at the action an agent is about to take on the machine it runs on.
@moorai/agent-sdk in process, the moorai-serve sidecar, moorai-model-proxy, moorai-mcp-gateway for remote MCP servers, a stdio proxy for local ones, and moorai-egress-proxy. A cat .env, a curl that uploads a secret file or a call to a local stdio MCP server never crosses a network gateway; the hook sees it before it runs.tools/call and prompts/get requests and responses and tool execution errors, and lets tools/list, resources/* and notifications/* through without sanitization.[5] MoorAI checks MCP where the client runs: a stdio proxy for local servers and an HTTP gateway for remote ones, both checking tool-call arguments and results. It enforces an approved-server list with an approval lifecycle in the console, can remove a tool whose description or schema changed since an administrator approved its server, and reports a tool description that tells the model to read a credential file. MoorAI issues no agent identities and applies no IAM policy..env, the curl upload, the npm install of a typosquatted package and the MCP call carrying an API key are each checked before they run, and an enrolled device blocks, masks or asks for a signed justification per policy; an unenrolled one coaches. MoorAI also flags secrets and insecure code patterns in what the agent writes, but it does not scan dependencies for CVEs, IaC or container images.Who covers what
Read it by group. The first two groups are Google Cloud’s and Wiz’s ground, the last two are MoorAI’s. Google Cloud and Wiz marks cite the page that documents them; — means that page does not describe it.
Scroll sideways →
| MoorAI | Google Cloud + Wiz | |
|---|---|---|
| Agents and AI workloads in the cloud | ||
| A cryptographic identity for each agent, with user-delegated access | ✗ | ✓[2]Agent Runtime, Gemini Enterprise and Cloud Run |
| Access policy on agent-to-tool and agent-to-agent traffic, denied unless granted | ◐egress rules and declared workload profiles where MoorAI runs | ✓[3] |
| AI posture and attack-path analysis across cloud accounts | ✗ | ✓[10] |
| Inventory of AI services, frameworks and models across clouds | ◐read-only Amazon Bedrock inventory; no Google Cloud inventory | ✓[8][10] |
| Runtime threat detection across model, workload and cloud layers | ◐workloads that run its SDK, sidecar or proxies | ✓[9] |
| Security operations agents for threat hunting and detection engineering | ✗exports content-free OpenTelemetry spans to your collector | ✓[1]in preview |
| The code agents write | ||
| AI-generated code scanned for secrets, IaC misconfigurations, vulnerable dependencies and container malware before a commit or push | ◐secrets and insecure code patterns in what the agent writes; no CVE, IaC or container scanning | ✓[7] |
| Remediation skills in the AI IDE, fed by cloud context | ✗ | ✓[1][8] |
| What agents do on the device | ||
| Shell commands checked before they run in Claude Code, Codex, Copilot CLI, Cursor and Gemini CLI | ✓pre-tool hook; validated end to end on Claude Code | —[3][7] |
An agent reading a secret file such as .env |
✓by path and by content, before the read | —[7]Wiz scans for hardcoded secrets in code |
| Local stdio MCP servers on the developer’s machine | ✓ | —[3][5]Agent Gateway governs HTTP traffic; Model Armor covers Google's remote MCP servers |
| Remote MCP tool calls and results | ✓MCP gateway | ◐[3][5]agents and tools on Google Cloud, and Google's own remote MCP servers |
| Prompts screened for prompt injection | ✓ | ✓[1][4]Model Armor; Wiz inline hooks evaluate prompts |
| Inventory of AI on developer machines: MCP servers, editor extensions, local models, AI keys at rest | ✓AIBOM, CycloneDX and SPDX export | ◐[11]Wiz Sensor for Developer Workstations, in private preview |
| Linux developer machines | ◐agent hooks; no desktop app | —[11]the Wiz Sensor lists Windows and macOS |
| The agents you build and where content goes | ||
| Guardrails on the tool calls and model calls of agents you build | ✓Agent SDK, sidecar, model proxy, MCP gateway, egress proxy | ✓[3][4]Agent Gateway and Model Armor |
| The check runs next to the workload, with no prompt sent to a service to decide | ✓ | ✗[4]screened by the Model Armor service, in memory, in a region you choose |
| Enforcement keeps working with no network connection | ✓cached policy; air-gapped deployment documented | —[4] |
| Open source | ✓agent MIT; console source-available | ✗ |
Same job, different mechanism
Where both touch the same job, the table describes how rather than scoring.
Scroll sideways →
| MoorAI does it by… | Google Cloud and Wiz do it by… | |
|---|---|---|
| Deciding which tools an agent may call | Policy evaluated where the agent runs. An approved MCP-server list with a console approval lifecycle, a per-agent entitlement envelope, declared workload profiles and egress rules, evaluated by the hook, the Agent SDK, the sidecar and, for MCP, the gateway. | Policy at Agent Gateway. IAM Unified Access Policies link an agent’s identity to approved tools and endpoints in Agent Registry, and all connections are blocked unless a policy grants access. MCP requests can be authorized by tool, and semantic governance policies apply plain-language rules to tool invocations.[3] |
| Screening prompts and tool results | An on-device detection engine over prompts, files read into context, tool-call arguments and what comes back from tools, with an optional local model on the loopback interface for a second opinion. | The Model Armor service. Filters for prompt injection and jailbreak, Sensitive Data Protection, malicious URLs and responsible AI categories, in inspect-only or inspect-and-block mode; the calling service or policy enforcement point blocks.[4] |
| Securing what a coding agent does | Judging each action before it runs: the command, the file read, the file write, the package install (an offline typosquat check on the name) and the MCP call, in five coding agents. | Scanning the code it produces at file save, pre-commit and pre-push, for secrets, IaC misconfigurations, vulnerable dependencies and container malware, with warnings by default and an optional block mode.[7] Skills apply fixes from the Wiz Security Graph in the IDE.[8] |
| Inventorying AI | On each device that runs MoorAI: models, MCP servers, editor extensions, running local model servers and AI provider keys at rest, the keys reported only as keyed hashes. Exports as CycloneDX 1.6 or SPDX 2.3. | Across clouds and code. Wiz detects AI services, technologies and SDKs without agents,[10] and its AI-BOM inventories AI frameworks, models and IDE extensions, including Gemini Code Assist, GitHub Copilot and Cursor.[8] The Wiz Sensor for Developer Workstations inventories packages, secrets, IDE extensions, AI coding agents and MCP servers, in private preview.[11] Google says Security Command Center will discover unmanaged agents and MCP servers hosted on Cloud Run and GKE, coming soon in preview.[1] |
| Handling the content | Content-free signals. Content is checked on the device or next to the workload. The console receives a category, a risk level and a keyed one-way hash, and OpenTelemetry export carries the same metadata, never the prompt. | A stateless cloud service. Model Armor processes prompts and responses in memory and does not store their content unless platform logging is enabled; its regional endpoints keep processing inside a geography such as the US or EU.[4] |
| Price | The agent is free and open source (MIT). The console is free for up to 200 users; beyond that, contact us. | Model Armor by the token: free up to 2 million tokens a month on its own, then $0.10 per million tokens, or included in Security Command Center Premium and Enterprise with a monthly allocation.[6] Other prices are not on the pages cited. |
Where Google Cloud and Wiz are stronger. Everything about the agents and workloads in the cloud. Each agent on Agent Runtime, Gemini Enterprise or Cloud Run gets a SPIFFE identity with an X.509 certificate valid for 24 hours, which Google Cloud keeps current,[2] every connection through Agent Gateway is denied until an access policy grants it,[3] and Model Armor screens prompts and responses at the gateway and in Google’s own remote MCP servers.[3][5] Wiz connects infrastructure, identity, models, data and applications into AI attack paths across clouds,[10] and scans the code agents write for vulnerable dependencies, IaC misconfigurations and container malware, which MoorAI does not.[7] Google Security Operations adds agents for threat hunting and detection engineering, in preview.[1]
Where MoorAI is stronger. What an agent does on the device, before it does it. The shell command, the file read, the file write, the local MCP call and its result are checked where the agent runs, in five coding agents and in the agents you build, on Google Cloud or anywhere else. Nothing is sent anywhere to be checked, the console receives no content, enforcement keeps working air-gapped, and the code that guarantees that is MIT.
When to use which. Use Google Cloud’s agent platform controls for agents you deploy on Agent Runtime, Gemini Enterprise or Cloud Run: identity, gateway policy and Model Armor sit in their path. Use Wiz for AI posture, inventory across clouds and scanning the code agents write. Use MoorAI on developer machines running Claude Code, Codex, Copilot CLI, Cursor or Gemini CLI, and next to agents you run anywhere, including outside Google Cloud and without a network connection.
How they work together. On one developer machine, MoorAI’s hook judges each action of Gemini CLI or Claude Code before it runs. When that agent reaches an agent or tool on Google Cloud, Agent Gateway’s Client-to-Agent mode decides whether the client may reach it,[3] and when the code reaches a commit, Wiz’s plugin scans it.[7] An agent you build on Gemini can send its model calls through MoorAI’s model proxy, which parses Gemini API and Vertex AI publisher-model requests next to the agent, while Model Armor screens the same agent on Google’s side. Nothing in the three products’ documentation says they conflict. We have not run them together.
What MoorAI does not do here. It issues no agent identities and applies no IAM policy. It does no cloud posture or attack-path analysis and has no Google Cloud inventory; its cloud inventory reads Amazon Bedrock only and is tested against documented response shapes and a fake AWS CLI. It does not scan dependencies for CVEs, IaC or container images. It sees agents inside Google Cloud only where its SDK, sidecar or proxies are deployed next to them, and its model proxy’s Gemini route is tested against a fake Gemini upstream only. It sees only the devices and workloads where it is installed. MoorAI’s hook fails open if it crashes or times out: it is governance, not a sandbox.
Questions about MoorAI, Google Cloud and Wiz
Does MoorAI replace Google Cloud’s agent security or Wiz?
No. Google Cloud secures the agents you run on its agent platform: Agent Identity gives each agent a SPIFFE-based identity, Agent Gateway governs its traffic with access policies that deny by default, and Model Armor screens its prompts and responses. Wiz maps AI workloads and attack paths across clouds, inventories AI frameworks, models and IDE extensions, and scans AI-generated code. MoorAI checks what agents do where they act: the shell commands, file reads and MCP tool calls of coding agents on the device, and the tool calls and model calls of the agents you build. They enforce in different places, so run both.
Does Agent Gateway cover Claude Code, Cursor or Gemini CLI?
In part. Agent Gateway’s Client-to-Agent mode secures communication between clients such as Cursor, Claude Code and Gemini CLI and agents and tools running on Google Cloud, and controls which clients can reach them. Google’s Agent Gateway and Model Armor documentation does not describe checking the shell commands, file reads or local MCP servers such a client uses on the developer’s machine. MoorAI’s hook checks those before they run, on the device, in Claude Code, Codex, Copilot CLI, Cursor and Gemini CLI.
Do Wiz’s coding-agent hooks stop an action before it runs?
Wiz’s inline hooks evaluate prompts and scan AI-generated output, and its plugins scan at file save, pre-commit and pre-push for hardcoded secrets, IaC misconfigurations, vulnerable dependencies and malware in container layers. Findings are warnings by default, and block mode stops a commit or push. The Wiz and Google pages cited do not describe judging a shell command, file read or MCP tool call before it runs. MoorAI does that, and leaves dependency, IaC and container scanning to tools like Wiz.
Where is the content checked?
Model Armor is a Google Cloud service. It screens prompts and responses in memory and does not store their content unless platform logging is enabled, and its regional endpoints keep processing inside a chosen geography such as the US or EU. MoorAI checks content on the device or next to the workload, and by default its console receives only a category, a risk level and a keyed one-way hash. Its enforcement needs no network: a device whose console is unreachable keeps enforcing its cached policy, so MoorAI runs air-gapped.
What does each cost?
Bought on its own, Model Armor is free up to 2 million tokens a month and $0.10 per million tokens after that, and Security Command Center Premium and Enterprise include it with a monthly token allocation. The pages cited do not list prices for Agent Gateway, Agent Identity, Wiz or Google Security Operations. MoorAI’s agent is free and open source under MIT. Its console is free for up to 200 users; beyond that, contact us.
Sources
Every Google Cloud and Wiz statement on this page is from one of these pages, read on 12 October 2026. Launch stages are from the Gemini Enterprise Agent Platform release notes: Agent Gateway and Model Armor for Agent Gateway are generally available since 18 and 24 June 2026.[12]
- Next ’26: Redefining security for the AI era with Google Cloud and Wiz (Google Cloud blog, 22 April 2026)
- Agent Identity overview (Gemini Enterprise Agent Platform documentation)
- Agent Gateway overview (Gemini Enterprise Agent Platform documentation)
- Model Armor overview
- Integrate Model Armor with Google and Google Cloud MCP servers
- Security Command Center pricing, Model Armor pricing section
- Closing the Security Gap in the Age of Agentic Coding (Wiz blog, 21 April 2026)
- Wiz at Google Cloud Next: Machine-Speed AI Defense (Wiz blog, 22 April 2026)
- Wiz Launches AI Application Protection Platform (AI-APP) (Wiz blog, 23 March 2026)
- AI Security Posture Management (AI-SPM) (wiz.io)
- Introducing the Wiz Sensor for Developer Workstations (Wiz blog, 3 August 2026)
- Gemini Enterprise Agent Platform release notes
Quoted phrases are Google’s or Wiz’s. MoorAI statements are from the MoorAI README at v1.12.1. ◐ = partial: present but narrower than the other column. — = not described in the cited Google or Wiz documentation, which is not a claim that they lack it. MoorAI marks reflect shipped capability: hook enforcement is validated end to end on Claude Code; Codex, Copilot CLI, Gemini CLI and Cursor block through their own pre-tool hooks and are tested against each vendor’s documented hook payloads, not yet against the live agents. A device that is not enrolled in a console coaches only. The agent runs on macOS and Windows, with the hooks on Linux; the console is source-available under the Elastic License 2.0 and free up to 200 users. Google, Google Cloud, Gemini, Model Armor and Wiz are trademarks of their respective owners; this page is independent and is not affiliated with or endorsed by Google or Wiz. All three products change, so check specifics against current documentation.