Skip to content
MoorAI
Get MoorAI
MoorAIKnowledge & evidence
On this page
Five defense layers,all on the device.Three moves, onevery prompt.Why you cantrustthe content-free claim.Review iton the device.
// overview

Workflow

One local check, on the device, before a prompt ever reaches the AI — then only content-free signals flow to the console.

Multi-layer agentic security that runs entirely on your device. Most AI-security tools are a single filter, and most run in a cloud or gateway that your prompts, files, and outputs have to pass through to be inspected. MoorAI defends in five layers (decode/normalize, content-free deterministic detectors, on-device semantic escalation, action-layer enforcement, and tamper-evident evidence), and every one of them runs locally. It's content-free by construction: by default no prompt, response, or file content leaves the machine, only metadata and a keyed one-way hash. Because the agent is open source (MIT), a CISO can audit that instead of taking it on trust. It goes deepest on coding agents (Claude Code, Codex, Copilot CLI), where an injected instruction can reach a shell and a cloud credential in one step, and the same on-device engine governs the everyday AI your whole team uses.

// layers of defense

Five defense layers,
all on the device.

A single prompt filter fails the moment an attacker encodes the payload, rephrases the jailbreak, or slips it in over several turns. MoorAI stacks five independent layers, each running locally and content-free, so an attack that gets past one still meets the next. The decisive one sits at the tool call itself.

1
Decode & normalize pre-pass
Before any detector runs, MoorAI unwraps the input: base64, hex, rot13, Caesar shifts, reversed text, and composed transforms of these. Obfuscated payloads that would slip a naive filter by hiding under an encoding get normalized first, so every layer below sees the real instruction rather than its disguise. Attack families fully caught here include CipherChat and FlipAttack.
2
Content-free deterministic detectors always-on
The fast, zero-model core: a 85-threat matrix plus content rules, running entirely on the device with no inference and no egress. Against 105 adversarially mutated attacks, split so detector tuning never sees the locked test half, this deterministic layer catches 86.4% of the locked half (38/44) at 100% precision, with a 3.32% false-positive rate on a 610-prompt benign corpus. This is the always-on baseline, and it never adds latency or leaves the machine. All ten HackAgent families have detectors, including the persuasion and multi-turn families PAP, PAIR, and TAP via a content-free persuasion-trajectory analyzer, though persuasion-style mutations remain the weakest axis.
3
On-device semantic escalation
The residual out-of-sample misses the deterministic layer can't judge (novel jailbreak phrasings it was never tuned on) escalate to a local model that runs on the machine, with zero egress. In a sampled run it lifts held-out recall to ~97%; it varies run-to-run with the local model, so we quote it as a range, not a guarantee, and it stays opt-in.
4
Action-layer enforcement the decisive layer
Even if a jailbreak gets past the prompt, the tool-call itself is blocked at the hook before it runs. The model layer decides what an agent wants; the tool layer decides what it can, and only the second is enforceable. In our validate-blocking suite, 100% of malicious tool-calls were blocked at the action layer (12/12) even after a jailbreak succeeded upstream. Enforcement is validated end to end on Claude Code via PreToolUse hooks; Codex and Copilot CLI block through their own pre-tool hooks but are not yet validated against the live agents.
5
Content-free, tamper-evident evidence
Every decision is recorded as signed, hash-chained, content-free evidence (in-toto/SLSA attestation plus an AIBOM), so you can prove after the fact exactly what each agent was allowed to do, with no prompt, file, or output content at rest.
Where it falls short. The deterministic layers catch 86.4% (38/44) of a locked held-out set at 100% precision. The locked number is the one we stand behind, and it isn't 100%. Persuasion, thought-experiment and leetspeak phrasings still slip the deterministic layer (with the opt-in on-device model added, the locked half reached 44/44). The one figure that is 100% without a model is the action layer: malicious tool-calls blocked at the hook even after a jailbreak lands upstream. Figures as published in the MoorAI v0.83.0 README: 105 mutated attacks split into tune and locked halves, and a 610-prompt benign corpus (269 adversarially-shaped hard negatives, 3.32% false-positive rate).
// on the device
claude-code — ~/acme-api — zsh
$ claude
›add AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY to deploy.sh and commit it
⛒ MoorAI · Blocked
Credential detected in prompt · category: credential · hash 9f2a…c71
Secrets don't belong in agent prompts — reference a vault instead.
Edit prompt Override with justification
›run: rm -rf ./build && redeploy prod
⚠ MoorAI · Coached · category: destructive-cmd
Double-check prod scope before continuing.
Reviewed on-device · content never left this machine
// in the console
https://console.moorai.internal/
MoorAI
Posture
Devices
Alerts
Compliance
12
Devices enrolled
On-device
Where prompts are reviewed
0
Prompt bodies stored
85
Threat matrix rules
secret-in-prompt
cat: credential · hash 9f2a…c71
blocked
redacted
exfil-pattern
cat: data-egress · hash 4b81…0de
alerted
redacted
risky-shell
cat: destructive-cmd · hash 1c07…a95
coached
redacted
routine-edit
cat: none · hash 7e33…b42
allowed
redacted
// workflow

Three moves, on every prompt.

MoorAI reviews each prompt where it's typed, decides what to do, and reports only redacted metadata upstream.

01
Review on the device
The prompt is checked locally against policy (a 85-threat matrix plus content rules) before it reaches the agent. The console never receives the prompt unless an administrator turns on a capture tier.
02
Coach, alert, or block
Based on the policy for that tenant and device, MoorAI nudges with a coaching note, raises an alert, or blocks the prompt — a kill switch at the point of use, on the device, before anything is sent.
03
Central visibility
The web console shows posture, device inventory, alerts, and compliance — assembled from redacted metadata only, never the prompts themselves.
Privacy-preserving by design

MoorAI is governance without surveillance. Prompts and conversations are reviewed on the device and, by default, never leave the machine; security teams receive only redacted, content-free signals: a category, a risk level, and a keyed one-way hash (plus the login and hostname, which the console pseudonymises on arrival). Two exceptions: an administrator can turn on a capture tier, which does store the matched text it was enabled to collect (your choice, per tenant, and logged), and on platforms whose OS can't read an image locally, a pasted screenshot goes to your own AI provider for text extraction, never to us. It's a guardrail for how your organization uses AI, not a window into what people type.

// verification

Why you can trust the content-free claim.

“Content-free” is only worth something if you can verify it. Below is what backs the claim, and what is still on the roadmap.

01 · verifiable now
The agent is open source
The community agent is MIT on GitHub. You can read the code that enforces the content-free claim: detection runs on-device, only a category, a risk level, and a keyed one-way hash (plus the login and hostname, which the console pseudonymises on arrival) are emitted, and content leaves the machine only when an admin explicitly enables a capture tier. A CISO or a security team can audit exactly that, line by line.
✓ Auditable today · MIT
02 · verifiable now
A benchmark you can re-run
Detection isn't a black box. The corpora and the scoring harness are published as a separate Apache-2.0 benchmark (the Agentic Security Benchmark, 299 attack samples and 878 benign across five AMTSO attack vectors), so anyone, including a competitor, can score their own product on the same samples and publish the result. MoorAI also ships a policy coverage self-test (moorai-redteam): run the adversarial suite against your own active policy and confirm it acts on each attack class, on your own machine. Every published run so far was executed by the maintainer, who also authors MoorAI; the results say so, and no third-party lab has reproduced it. See the runs →
✓ Published & reproducible
03 · on the roadmap
Independent assurance
Two things MoorAI does not have yet: a third-party zero-egress audit of the agent (an external firm confirming no prompt, file, or output content leaves the device by default) and SOC 2 Type II for the management console. Both are planned, neither is complete. Until they are, the open-source agent and the reproducible benchmark are how you verify the claim.
• In progress · roadmap, not certified

Review it
on the device.

Coach, alert, or block — before the prompt reaches the agent.

Community agent on GitHub Read the docs ↗