Every AI agent action, decided on the device before it runs.
On laptops, for coding agents, desktop AI and local models (Ollama, LM Studio, llama.cpp).
On AI servers, for production agents.
Governed from one place.
Put the guard and the record outside the agent.
Open-source endpoint agent · macOS, Windows and Linux
Coaches standalone. Enroll in a Management Server to enforce.
Sample decisions shown. Your policy determines each outcome.
Published results, an open benchmark, and controls mapped to their evidence.
Damn Vulnerable MCP challenges blocked outright. All 10 with IP exposure set to block.
See the results OWASP Agentic Top 10ASI01–ASI10 mapped1 direct, 9 partial, with the gaps and the risks outside the endpoint marked.
See the mapping Threat coverage93 threat rulesMapped to OWASP, MITRE ATLAS, MITRE ATT&CK v20 and STRIDE.
Explore the rule-base Open benchmark results77.9% attack recall233 of 299 attacks flagged. 4.9% false-positive rate on 878 benign samples.
MoorAI v1.47.0 · 1177 samples · public corpusSee results & methodology Compliance & framework mappingsEvidence for your auditSOC 2 · ISO/IEC 27001 · ISO/IEC 42001 · ISO/IEC 27090 · NIST AI RMF · NIST CSF · EU AI Act
Also mapped to CSA AICM, OWASP LLM / Agentic / MCP, MITRE ATLAS and Forrester AEGIS. Mappings and evidence, not certifications.Explore frameworks & evidenceLocal model servers are part of the attack surface. MoorAI finds them, pins them and guards the traffic to them.
A daily scan finds local model servers any process can reach, or bound beyond loopback, and raises a content-free alert.
Detection details ProvenanceModels pinned by hashApprove each model file by sha256. An agent loading an unpinned model is reported, held for sign-off or denied.
Model pinning RuntimeOllama behind the proxyThe model proxy checks what an agent sends to a local Ollama and what comes back, on a loopback-only route.
Model proxy PrivacySecond opinion stays localWhen a scan is ambiguous, an optional local model reviews it on 127.0.0.1. The text never leaves the machine.
What leaves the deviceLocal protection. Shared policy. A clearer view of your AI.
Check AI agent actions before they run, with detection on the device.
Free · open source · MIT license
Inspect model interactions and tool calls before your application acts.
Per-server offering · contact MoorAI
Set policy, require approval, and investigate risk across your AI fleet.
Free self-hosted · hosted option available
In the a16z CISO Survey of October 2026, internal AI agent security gained 28 points as a top-five initiative for 2027, the biggest gain of any initiative. That is what MoorAI does: it decides every agent action on the device before it runs, on laptops and on AI servers.
Budget is moving from EDR/XDR, SIEM, PAM and exposure management toward AI. MoorAI works beside those tools: EDR sees processes, MoorAI decides each action the agent takes, and its content-free alerts go to the SIEM you already run.
| Initiative | Change (points) | MoorAI |
|---|---|---|
| Internal AI agent security | +28 | Core |
| AI SOC | +26 | Supports |
| AI offensive security | +24 | Not claimed |
| AI code security | +23 | Supports |
| AI vulnerability remediation | +22 | Not claimed |
| AI usage and governance | +17 | Core |
| AI GRC and vendor risk | +5 | Supports |
| AI-native endpoint prevention | +5 | Core |
| Cloud security | −7 | Not claimed |
| Access management | −13 | Not claimed |
| EDR / XDR | −17 | Not claimed |
| Privileged access management | −18 | Not claimed |
| SIEM / security data | −18 | Not claimed |
| Exposure and vulnerability management | −21 | Not claimed |
The Management Server distributes policy. Endpoint agents and server integrations apply checks where the action happens, then report signals back to the fleet.
Configured outcomes include allow, block, human sign-off and ending a session. Support depends on the integration.
Bring enrolled agents, devices and services into one view. Investigate security signals without collecting prompts or source code by default.
| SECURITY SIGNAL | SURFACE | DECISION |
|---|---|---|
| Credential access | Endpoint | BLOCK |
| Privileged MCP action | AI server | SIGN-OFF |
| Project test command | Endpoint | ALLOW |
| Model output review | AI server | ALLOW |
Showing 4 example events
DESIGN PREVIEW / Sample events and decorative activity chart. Not live telemetry or a product screenshot.
Detection runs locally. Fleet reporting is content-free by default, with explicit exceptions for administrator-enabled capture tiers and optional external checks.
Explore the trust model ↗Without enrollment, the endpoint agent coaches. Enroll the device in a Management Server to apply enforcement policy.
No. Hook support and integration behavior vary. The repository documents validation and limitations for each supported agent.
Read integration details ↗No. MoorAI's mappings support evaluation against frameworks; they do not represent certification.
Review the evidence ↗Prompts, responses, source code, file content and matched secrets stay local under the default reporting model.
Security categories, risk levels and keyed hashes support investigation. Login and hostname are pseudonymised on arrival.
Capture tiers, image OCR fallback and model second opinions can change what leaves the device. Review configuration before enabling them.
Resellers, MSSPs, distributors, integrators and technology partners bring MoorAI to their customers, beside the EDR and SIEM they already sell.
Start on a device. Extend protection to servers. Govern the fleet.