Governance surfaces

Prismor can sit in front of an agent several ways. They are not interchangeable, and picking the wrong one is the difference between complete coverage and a control the model can walk around.

All of them reach the same verdict on the same action — they share one policy engine through the decision contract. What differs is where they can intercept and what they can do there:

Run prismor surfaces to see which of these are switched on for each agent detected on this machine, and which are possible but off.

The rest of this page is about the two that govern a coding agent on a developer's machine, where the choice is a real decision. For the others: adapters ship with each framework (see docs/frameworks-overview.md), the eval-server is documented in the decision contract, the LLM proxy in the LLM proxy page, and the inference-hook channel in docs/inference-hook.md.

One note on the LLM proxy, because it is the only surface that does not need the agent's cooperation: every other row requires something to be hooked, wired, or imported. The proxy requires only that model traffic pass through a URL you control, which makes it the fallback for an agent that supports none of the others — and the reason to reach for it last when the agent does, since a hook sees tool calls the model never routes through an API.

Hooks vs the MCP mirror

Hooks (PreToolUse / PostToolUse). The agent calls Prismor before each tool call and obeys the verdict. The agent keeps its own tools; nothing is replaced; everything it can do is screened, including tools Prismor has no mirror for. Installed by prismor setup or prismor install-hooks.

The MCP mirror (prismor mirror on). Prismor serves look-alike built-ins (Bash, Read, Write, Edit, Glob, Grep, WebFetch) over MCP and the agent's own are switched off. The tool then runs inside Prismor, which buys the one thing a hook structurally cannot do: the output can be repaired instead of merely refused, so a hardcoded credential in ordinary source is redacted before the model sees it rather than the whole file being blocked.

Which to use

Hooks, wherever the agent has them. They cover the agent's entire tool surface, they do not depend on the host offering a way to disable its built-ins, and there is nothing in the model's tool list to go wrong. prismor setup installs hooks, and the agent screen marks each agent's available surfaces.

The mirror when there are no hooks. For agents with no hook protocol, MCP is the only interposition point that exists — without it Prismor cannot see the agent at all.

Both, only deliberately. Hooks plus the mirror is supported and is what gives you result-side redaction on a hook-capable agent, at the cost of more moving parts: two layers screen the same call, and they only stay consistent when both run the same Prismor build (prismor mirror status warns when they do not). Prefer hooks alone unless you specifically want redaction.

Mirroring is bypassable wherever the host cannot switch its built-ins off — the model simply calls the real Bash instead. Those agents are marked "no" below, and Prismor does not offer a mirror for them rather than implying a control that is not there.

Coverage

"Mirror scope" is where the switch applies, and it follows what the host supports, not a Prismor preference. Claude Code keeps MCP servers and tool permissions per project, so prismor mirror on governs one project. Codex reads its MCP servers and feature flags only from the user-level config, so mirroring it is machine-wide — the command says so before it changes anything.

Choosing at setup time

prismor setup installs hooks. On the agent screen each agent shows the surfaces available to it, and for agents where Prismor can wire the mirror, m toggles it on for that agent:

  > *  Claude Code       detected    hooks   (m: add MCP mirror)
    *  Codex             detected    hooks
    o  OpenHands         not found   hooks

  No hook protocol - govern these with prismor mirror on:
    OpenCode, Amp, Kilocode

The mirror is off by default and stays off unless you ask for it: it replaces the agent's own tools, which is not something a wizard should do to someone silently. Choosing hooks only is the recommended setup and needs no action. The confirm screen names both, so you can see what is about to be installed before anything is written.

Wired hosts today are Claude Code (per project), Codex (machine-wide) and OpenCode (per project). Other agents in the table can be mirrored by hand with prismor mcp-gateway --mirror; the one-command setup lands per host as each is verified against a real session, because a half-wired host leaves the agent with no tools at all.

prismor setup --non-interactive never installs the mirror -- there is no screen to opt in on, so it stays hooks-only. Use prismor mirror on for that case.

Practical notes

• Hooks are what prismor setup installs. The mirror is a separate, explicit step: prismor mirror on, and prismor mirror off to undo exactly what it did.
• Turning the mirror on renames the tools to mcp__prismor-tools__<Tool>. Prismor records them under their native names so existing rules, allowlists and console filters keep matching, but anything outside Prismor that keys on the literal tool name (a host-side permission rule, for instance) needs the new name. prismor mirror on migrates the ones it owns.
• prismor pause covers both surfaces. It suspends enforcement for hooks and the gateway together, and auto-resumes after 24h.
• Secret masking is not enforcement and keeps running while paused, on both surfaces.

See MCP Gateway for the mirror's mechanics and the exact per-host setup it performs.