Skip to content
MoorAI
// overview

Workflow

One local check, on the device, before a prompt ever reaches the AI — then only content-free signals flow to the console.

Multi-layer agentic security that runs entirely on your device. Most AI-security tools are a single filter — and most run in a cloud or gateway your prompts, files, and outputs have to pass through to be inspected. MoorAI is different on both counts: it defends in five layers — decode/normalize, content-free deterministic detectors, on-device semantic escalation, action-layer enforcement, and tamper-evident evidence — and every one of them runs locally. It's content-free by construction: no prompt, response, or file content ever leaves the machine — only metadata and a keyed one-way hash. And because the agent is open source (MIT), a CISO can audit that, not just trust it. Built for the AI-Agents era: it goes deepest on coding agents — Claude Code, Codex, Copilot CLI, where an injected instruction can reach a shell and a cloud credential in one step — and the same on-device engine governs the everyday AI your whole team uses.

// layers of defense

Not one filter.
Five layers, all on the device.

A single prompt filter fails the moment an attacker encodes the payload, rephrases the jailbreak, or slips it in over several turns. MoorAI is defense-in-depth: five independent layers, each running locally and content-free, so getting past one still runs into the next — and the decisive one sits at the tool call itself.

1
Decode & normalize pre-pass
Before any detector runs, MoorAI unwraps the input — base64, hex, rot13, Caesar shifts, reversed text, and composed transforms of these. Obfuscated payloads that would slip a naive filter by hiding under an encoding get normalized first, so every layer below sees the real instruction rather than its disguise. Attack families fully caught here include CipherChat and FlipAttack.
2
Content-free deterministic detectors always-on
The fast, zero-model core: a 67-threat matrix plus content rules, running entirely on the device with no inference and no egress. Against 105 adversarially mutated attacks, split so detector tuning never sees the locked test half, this deterministic layer catches 86.4% of the locked half (38/44) at 100% precision, with a 3.32% false-positive rate on a 610-prompt benign corpus — the always-on baseline that never adds latency or leaves the machine. All ten HackAgent families have detectors, including the persuasion and multi-turn families PAP, PAIR, and TAP via a content-free persuasion-trajectory analyzer — though persuasion-style mutations remain the weakest axis.
3
On-device semantic escalation
The residual out-of-sample misses the deterministic layer can't judge — novel jailbreak phrasings it was never tuned on — escalate to a local model that runs on the machine, with zero egress. In a sampled run it lifts held-out recall to ~97%; it varies run-to-run with the local model, so we quote it as a range, not a guarantee, and it stays opt-in.
4
Action-layer enforcement the decisive layer
Even if a jailbreak gets past the prompt, the tool-call itself is blocked at the hook before it runs. The model layer decides what an agent wants; the tool layer decides what it can — and only the second is enforceable. In our validate-blocking suite, 100% of malicious tool-calls were blocked at the action layer (12/12) even after a jailbreak succeeded upstream. Full enforcement on Claude Code via PreToolUse hooks; Codex and Copilot CLI are detection-only.
5
Content-free, tamper-evident evidence
Every decision is recorded as signed, hash-chained, content-free evidence — in-toto/SLSA attestation plus an AIBOM — so you can prove after the fact exactly what each agent was allowed to do, with no prompt, file, or output content at rest.
Honest about the edges. The deterministic layers catch 86.4% (38/44) of a locked held-out set at 100% precision — the locked number is the one we stand behind, and it isn't 100%. Persuasion, thought-experiment and leetspeak phrasings still slip the deterministic layer (with the opt-in on-device model added, the locked half reached 44/44). The one figure that is 100% without a model is the action layer: malicious tool-calls blocked at the hook even after a jailbreak lands upstream. Figures as published in the MoorAI v0.83.0 README: 105 mutated attacks split into tune and locked halves, and a 610-prompt benign corpus (269 adversarially-shaped hard negatives, 3.32% false-positive rate).
// on the device
claude-code — ~/acme-api — zsh
$ claude
›add AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY to deploy.sh and commit it
⛒ MoorAI · Blocked
Credential detected in prompt · category: credential · hash 9f2a…c71
Secrets don't belong in agent prompts — reference a vault instead.
Edit prompt Override with justification
›run: rm -rf ./build && redeploy prod
⚠ MoorAI · Coached · category: destructive-cmd
Double-check prod scope before continuing.
Reviewed on-device · content never left this machine
// in the console
https://console.moorai.internal/
MoorAI
Posture
Devices
Alerts
Compliance
12
Devices enrolled
On-device
Where prompts are reviewed
0
Prompt bodies stored
67
Threat matrix rules
secret-in-prompt
cat: credential · hash 9f2a…c71
blocked
redacted
exfil-pattern
cat: data-egress · hash 4b81…0de
alerted
redacted
risky-shell
cat: destructive-cmd · hash 1c07…a95
coached
redacted
routine-edit
cat: none · hash 7e33…b42
allowed
redacted
// workflow

Three moves, on every prompt.

MoorAI reviews each prompt where it's typed, decides what to do, and reports only redacted metadata upstream.

01
Review on the device
The prompt is checked locally against policy — a 67-threat matrix plus content rules — before it reaches the agent. Content never leaves the machine.
02
Coach, alert, or block
Based on the policy for that tenant and device, MoorAI nudges with a coaching note, raises an alert, or blocks the prompt — a kill switch at the point of use, on the device, before anything is sent.
03
Central visibility
The web console shows posture, device inventory, alerts, and compliance — assembled from redacted metadata only, never the prompts themselves.
Privacy-preserving by design

MoorAI is governance without surveillance. Prompts and conversations are reviewed on the device and, by default, never leave the machine; security teams receive only redacted, content-free signals — a category, a risk level, and a keyed one-way hash. Two exceptions, stated rather than buried: an administrator can turn on a capture tier, which does store the matched text it was enabled to collect — that's your choice, per tenant, and it's logged — and on platforms whose OS can't read an image locally, a pasted screenshot goes to your own AI provider for text extraction, never to us. It's a guardrail for how your organization uses AI, not a window into what people type.

// trust, not marketing

Why you can trust the content-free claim.

“Content-free” is only worth something if you can verify it. Anyone can print the words on a page. Here's what actually backs the claim — and, honestly, what's still on the roadmap.

01 · verifiable now
The agent is open source
The community agent is MIT on GitHub. You don't have to trust the content-free claim — you can read the code that enforces it: detection runs on-device, only a category, a risk level, and a keyed one-way hash are emitted, and content leaves the machine only when an admin explicitly enables a capture tier. A CISO or a security team can audit exactly that, line by line.
✓ Auditable today · MIT
02 · verifiable now
A benchmark you can re-run
Detection isn't a black box. The corpora and the scoring harness are published as a separate Apache-2.0 benchmark — the Agentic Security Benchmark, 286 attack samples and 875 benign across five AMTSO attack vectors — so anyone, including a competitor, can score their own product on the same samples and publish the result. MoorAI also ships a policy coverage self-test (moorai-redteam): run the adversarial suite against your own active policy and confirm it acts on each attack class, on your own machine. Every published run so far was executed by the maintainer, who also authors MoorAI — that is stated in the results rather than glossed over, and no third-party lab has reproduced it. See the runs →
✓ Published & reproducible
03 · on the roadmap
Independent assurance
Two things we're honest about not having yet: a third-party zero-egress audit of the agent — an external firm confirming no prompt, file, or output content leaves the device by default — and SOC 2 Type II for the management console. Both are planned, neither is complete. Until they are, the open-source agent and the reproducible benchmark are how you verify the claim.
• In progress · roadmap, not certified
// built with

Small footprint.
On the device.

A local agent that reviews prompts where they're written, and a separate console for the fleet.

On-device
Rust
Tauri native host
Webview detection core
67-threat matrix
PreToolUse hooks
MCP interception
Entropy gate
OCR (on-device on macOS)
Redacted metadata
AIBOM export
SIEM streaming
Multi-tenant console
SSO
macOS
Windows
MIT

Review it
on the device.

Coach, alert, or block — before the prompt reaches the agent.

Get started free Community agent on GitHub Read the docs ↗