CLI Reference

September 9, 2026 · View on GitHub

Every capability in the toolkit is reachable through the single prismor command. This page is the map: it lists every command, what it does, and links to the dedicated deep-dive doc for that capability.

prismor <command> [options...]
prismor <domain> <action> [options...]
prismor --help               # the same map, in your terminal
prismor <command> --help     # help for one command

There are two shapes:

Top-level commands — prismor status, prismor audit, prismor check …
Domains that take an action — prismor cloak add …, prismor canary plant …

prismor is a deprecated drop-in alias for prismor; it forwards everything unchanged and prints a migration notice. Use prismor.

Quick start

Command	What it does	Deep dive
`prismor setup`	Interactive onboarding wizard: pick mode, choose which rules block, select agents, enable cloaking, choose install scope, set the unlock password.	Onboarding
`prismor status`	One-shot health check: workspace, hooks, mode, cloak, latest session, next action.	Dashboard & sessions
`prismor audit`	Full security-posture audit across every subsystem. `--fix` auto-remediates.	Prismor
`prismor --help`	The full command map.	—

The command map

prismor
│
├─ Onboarding & lifecycle
│   ├─ setup                  Interactive onboarding wizard (TUI)
│   ├─ install-hooks          Wire Prismor hooks into an agent/IDE
│   ├─ uninstall-hooks        Remove hooks
│   ├─ update                 Self-update check / upgrade
│   └─ status [--all]         Health check (this workspace / all workspaces)
│
├─ Runtime protection (policy engine)
│   ├─ check                  Pre-check a command or path against policy
│   ├─ allow <rule>           Make an exception to a rule that blocked you
│   ├─ unlock / lock          Open/close the agent self-edit window (password)
│   ├─ semantic-check         Hybrid LLM prompt-injection guard
│   ├─ sandbox <action>       status · check · run — Docker command sandbox
│   ├─ eval-server            HTTP evaluation endpoint for non-Python adapters
│   ├─ proxy                  LLM policy proxy — screens model traffic and proposed tool calls
│   ├─ proxy                  LLM proxy — screens model traffic and proposed tool calls
│   ├─ inference-hook <action> serve · test · secret — Claude Inference Hooks AI security server
│   ├─ egress <action>        show · report · test · allow · deny · mode — network egress policy
│   ├─ mirror <action>        on · off · status · passthrough — governed built-ins over MCP
│   ├─ mode <action>          list · explain · apply · show — whole-posture templates
│   └─ policy <action>        init · validate · show · edit · test
│
├─ Visibility (audit & forensics)
│   ├─ audit                  Full posture audit (--fix to remediate)
│   ├─ scan                   Scan MCP servers & skills for risk
│   ├─ deps                   Check project deps vs. threat feed
│   ├─ analyze / ingest       Run the engine over a JSONL session
│   ├─ ingest --discover      Reconstruct past agent activity from on-disk transcripts
│   ├─ sessions / session     List / show stored sessions
│   ├─ trail <action>         verify · show · checkpoint — signed audit trail
│   ├─ attest [verify|coverage]  Signed evidence bundle + framework coverage
│   ├─ discover [section]     Sweep host for ungoverned agents, MCP servers, keys (--fix to govern them)
│   ├─ status --all           Terminal overview of all workspaces
│   └─ dashboard              Local web dashboard (127.0.0.1:7070, opens browser)
│
├─ Secret prevention
│   ├─ cloak <action>         install · add · list · remove · status · pattern
│   └─ sweep                  Find & vault leaked secrets on disk
│
├─ Identity & scoping
│   ├─ iam <action>           Named agent identities / permission profiles
│   ├─ agents <action>        Named agent instances — list · show · set (kill-switch, mode, IAM)
│   ├─ scope <action>         Session-scoped, task-specific rules
│   └─ canary <action>        Plant & manage honeytoken tripwires
│
├─ Adaptive defense
│   └─ learn                  Mine session history for new rules
│
├─ Enterprise / org
│   ├─ enroll <token>         Enroll this machine against your org's control plane
│   ├─ enroll-status          Show enrollment + applied policy version
│   ├─ workspace <action>     Show/set whether this workspace is org-managed or personal
│   ├─ exempt <action>        Request an admin exemption for this repo
│   └─ logout                 Un-enroll (remove device identity + cached policy)
│
└─ Supply chain
    └─ supplychain <action>   npm/pip/pnpm/uv/cargo/go install gate · harden

Onboarding & lifecycle

Command	Key flags	Description
`prismor setup [DIR]`	`--non-interactive`, `--mode`, `--enforce-rules`, `--recommended`, `--agents`, `--cloak/--no-cloak`, `--judge <claude\|codex\|api>`, `--judge-model`	Interactive wizard (or scripted with flags / `PRISMOR_MODE`, `PRISMOR_CLOAK`, `PRISMOR_JUDGE`, `PRISMOR_JUDGE_MODEL` env vars). Picks mode, chooses which rules block, selects agents, enables cloaking, picks which login judges uncertain events (see Semantic Guard), and optionally sets an unlock password. See Choosing what blocks.
`prismor install-hooks`	`--agent <name\|all>` (required), `--mode <observe\|enforce>`, `--scope <project\|user>`	Writes hook config for the chosen agent so Prismor sees tool calls. Without hooks, nothing is monitored.
`prismor uninstall-hooks`	`--agent <name\|all>`, `--scope`	Removes Prismor hooks for an agent. For `claude`/`all`, this also removes cloaking hooks (`prismor cloak install`) — secrets are no longer protected at the tool boundary until you reinstall with `prismor cloak install`.
`prismor status`	`--workspace`, `--all`, `--days N`	Health check: hooks, mode, cloak state, latest session, and the single next action. Run this first every session. `--all` shows every registered workspace.
`prismor update`	`--check`	Check for (or install) a newer prismor release.
`prismor info`	`--workspace`	Deprecated alias of `status`.

Agent → config matrix and per-agent details: AGENT_INTEGRATIONS.md. Modes (observe vs enforce): Prismor.

Choosing what blocks

observe reports everything and blocks nothing, so setup leaves every rule on.

enforce asks which rules should block, and starts with none of them selected — including the safety floor, which is marked recommended rather than assumed. Nothing blocks until you choose it. Press a on that screen to take the recommended set.

The choice is written to .prismor/policy.yaml as settings.selection: explicit plus one entry per rule, so what blocks is legible in the file rather than implied by the defaults. Scripted installs say the same thing with --recommended or --enforce-rules id1,id2; --mode enforce with neither installs with nothing blocking and tells you so.

Two things the selection does not reach:

Prismor's self-protection rules always block. They are what stops the agent editing the choices above, so offering them as a checkbox would make every other checkbox decorative.
Org-managed workspaces keep the full safety floor. selection: explicit is honored only for a locally-authored policy on an unmanaged machine, and is ignored if it arrives in a signed org bundle.

Governance modes

Picking six policy axes rule by rule is how a policy ends up subtly wrong. A mode is a named posture that sets all six at once — enforcement fallback, egress allowlist, tool access, tag rules, sandbox ring, and step-up gates — and compiles them into the same .prismor/policy.yaml and .prismor/agents.yaml the engine already reads. There is no separate mode enforcement path.

prismor mode list                    # the three, with coverage and friction
prismor mode explain dev-safe        # the trade — including what it does NOT stop
prismor mode apply dev-safe          # compile it (--dry-run to preview first)
prismor mode apply dev-safe --observe # same posture, nothing blocks
prismor mode show                    # active mode, and whether it has drifted

What each mode covers

Coverage and rule counts are computed from the live ruleset by prismor mode list, not hardcoded here — they move as rules are added. Friction is likewise measured, not estimated: tests/test_modes.py runs a benign corpus of ordinary developer commands through each compiled mode and pins the declared friction_index to the share it interrupts. The figures below are from an 80-rule policy.

	`dev-safe`	`trusted-workspace`	`regulated-airgap`
Rules blocking	25/80	27/80	80/80
Coverage	31%	34%	100%
Friction	9%	9%	90%
Intended for	daily development	trusted internal repos	regulated / PII

Prismor's self-protection rules always enforce in every mode — a mode cannot be used as cover for disabling Prismor.

Axis by axis

Axis	`dev-safe`	`trusted-workspace`	`regulated-airgap`
`settings.default_mode`	observe	observe	enforce
Rule selector	floor + 3	floor + 7	all
Egress default	deny	deny	deny
Egress allowlist	JS, Python, Rust, Go, JVM, GitHub, container registries, test binaries, docs, LLM APIs	+ cloud provider APIs	empty
Private / loopback	allowed	allowed	blocked
Tools denied	—	—	Bash, WebFetch, WebSearch
Tools gated (HITL)	—	—	Write, Edit
Commands denied	`sudo` `su` `chmod +s`	`sudo` `chmod +s` `su`	— (no shell at all)
Commands auto-approved	read-only inspection + non-mutating `git`	same	—
Commands gated	npm/pip/cargo install	npm/pip/cargo/gem install	—
Tag rules	1 (block)	2 (block)	3 (block)
Untrusted-content sources	web + MCP ingest	web + MCP ingest	web + MCP ingest
Data boundary	enforce	enforce	enforce
Sandbox ring	enforce, net allowlist, RO root	observe, bridge, RW root	enforce, net none, RO root, noexec tmpfs

The three extras in dev-safe are the supply-chain rules: dependency-confusion, pkg-install-from-url, pkg-suspicious-name. trusted-workspace adds the secret rules on top: secret-access, credential-aggregation, credential-staging, claude-credential-access.

Two things worth knowing before you adopt one.

A rule listed in enforce_extra that declares action: warn becomes a hard block, because contract.VERDICT_RANK reads "enforce + a verdict we do not understand" as stop. That is why installing from a private index URL is denied rather than prompted under both safe modes — deliberate, and stated in each mode's residual risk.

untrusted_content means externally sourced: a web fetch, a search result, an MCP tool result, or a file read from outside the workspace root. Reading a file in your own repository is not untrusted ingest, and a mode that turns tag enforcement on must say so explicitly — compile_mode refuses a mode that enables tool_tags without declaring tool_tags.inference_enabled. Inheriting the default there tags every workspace read as untrusted, which turns untrusted_content then critical_action -> block into "read anything, then do anything" and denies every call after the session's first read.

Modes that need a container runtime

dev-safe enforces its sandbox, and cli.py blocks a shell call outright when an enforcing sandbox has no runtime behind it — it does not silently run unsandboxed. On a host without Docker that means every command fails, so mode apply preflights and refuses rather than letting you find out one command at a time:

$ prismor mode apply dev-safe
prismor mode: mode 'dev-safe' enforces a Docker sandbox and this host cannot
reach one (docker CLI not found). Every shell command would be blocked, not just
sandboxed. Options: start or install Docker; apply with --observe …

trusted-workspace sets sandbox.mode: observe, so a missing runtime degrades to a warning and the mode works anywhere. regulated-airgap enforces a sandbox but denies the Bash tool, so no shell event ever reaches the sandbox gate and it too runs on a host without Docker.

mode show re-checks at read time, which is what catches a runtime that disappeared after the mode was applied.

Known limitation: the sandbox gate is wired for the Claude adapter only. On other agents the sandbox axis is not applied, even though mode explain still describes it.

Previewing a posture

--observe compiles any mode with nothing enforcing — same rules, same findings, no verdict blocks:

prismor mode apply dev-safe --observe

This answers "what would this posture stop?", which is the question worth asking before adopting one. mode show reports a preview build as such and never claims it is the enforcing article. Tool deny/ask lists are skipped in a preview build, because agents.yaml has no observe tier and writing them would enforce the one axis the flag promises not to.

mode explain always prints a residual risk paragraph. dev-safe allows api.github.com, so an injected agent can still paste a .env into a public issue comment; regulated-airgap is tight enough that the realistic failure is somebody running uninstall-hooks to get through the afternoon. A mode that claimed no downside would be the one not to trust.

Applying a mode overwrites .prismor/policy.yaml (keeping a .bak), and refuses outright if that file was not generated by a mode — pass --force once you have looked at what you are replacing. Hand-editing afterwards is fine; mode show then reports drift rather than claiming a posture the file no longer has.

Making exceptions

When a rule blocks something it should not, the block prints the command that fixes it:

prismor allow secret-exfiltration --pattern 'curl -F f=@.env'   # just this case
prismor allow secret-exfiltration --observe                     # keep the rule, stop it blocking
prismor allow secret-exfiltration --off --yes                    # off in this workspace
prismor allow --list                                             # what you have added
prismor allow --undo allow-secret-exfiltration                   # remove one

Add --expires 30m to make an exception temporary — it lapses instead of quietly becoming permanent policy.

These are for the human at the keyboard. An agent that runs them is blocked, along with every other route to Prismor's own config: the policy file, the dashboard's write API, and the unlock credential. To hand the agent that ability for a few minutes, run prismor unlock and enter your password (prismor unlock --set-password if you have not set one). Inside the window the agent can adjust policy; it still cannot touch the self-protection rules or the password itself, and the window closes on its own.

An unhooked agent — one running through a framework Prismor does not see — is outside all of this, the same as every other Prismor control.

Runtime protection

Command	Key flags	Description
`prismor check "<value>"`	`--type <command\|read\|write>`, `--explain`, `--from-log`, `--suggest-allowlist`	Dry-run a command or file path against the active policy. Returns ALLOW / WARN / BLOCK + reason without executing. Exit `2`=block, `1`=warn, `0`=clean.
`prismor semantic-check [TEXT]`	`--mode <hybrid\|heuristic\|api>`, `--provider <claude\|codex\|api>`, `--json`, `--cli-path`	Run the semantic prompt-injection guard on text or stdin. See Semantic Guard.
`prismor allow <rule>`	`--pattern`, `--expires`, `--observe`, `--off`, `--yes`, `--reason`, `--list`, `--undo`, `--workspace`	Make an exception to a rule that blocked you, narrowest first. With no `--pattern` it uses the text of the most recent block for that rule. `--observe` keeps the rule but stops it blocking; `--off` disables it for the workspace (needs `--yes`). Refuses self-protection rules, refuses to turn a floor rule off, and refuses everything where an org's signed policy governs. See Making exceptions.
`prismor unlock`	`--for`, `--status`, `--set-password`, `--system-password`, `--forget`, `--workspace`	Open a short window (default 3 minutes) in which the agent may edit Prismor's own policy. Asks for your unlock password; needs a terminal. `--system-password` verifies against your operating-system account instead of storing a Prismor one.
`prismor lock`	—	Close the self-edit window early.
`prismor policy init`	`--workspace`	Scaffold `.prismor/policy.yaml`.
`prismor policy show`	`--workspace`	Print active rules after merging defaults + project overrides.
`prismor policy export`	`--json`, `--output PATH`, `--workspace`	Print the effective merged policy as stable, sorted JSON — patterns already resolved and disabled rules dropped — for non-Python consumers and for committing/diffing.
`prismor policy edit`	`--workspace`	Interactive TUI to toggle rules on/off.
`prismor policy validate <file>`	—	Static-validate a policy YAML file.
`prismor policy test`	`--file`	Run declarative policy tests (falls back to the bundled OWASP LLM starter pack).
`prismor sandbox <status\|check\|run>`	`--workspace`	Docker-backed command sandbox: show config, check the backend, or run one command isolated. See Docker sandbox.
`prismor egress show`	`--workspace`	Effective network egress policy, its mode, and which layer (default / project / org) set it. See Network Isolation.
`prismor egress report`	`--last N`, `--fail-on-block`, `--workspace`	Every destination recorded sessions actually contacted, with the verdict the current policy gives it. The on-ramp before flipping to enforce; `--fail-on-block` gates CI.
`prismor egress test <target>...`	`--agent <name>`, `--workspace`	Dry-run a URL, host, or whole shell command against the policy. Exit `1` if anything would be blocked.
`prismor egress allow <host>...`	`--reason`, `--workspace`	Add hosts, wildcards, IPs, or CIDRs to `settings.egress.allow` (`egress deny` / `egress rm` for the others).
`prismor egress mode <observe\|enforce>`	`--workspace`	Flip enforcement (`egress default <allow\|deny>` sets the no-match verdict; `egress enable` / `disable` toggle screening).
`prismor mirror on`	`--mode <enforce\|observe>`, `--agent <claude\|codex\|opencode\|claude-desktop>`, `--allow-tools`, `--workspace`	Serve `Bash`/`Read`/`Write`/`Edit`/`Glob`/`Grep`/`WebFetch` through Prismor instead of Claude Code's own: registers the `prismor-tools` MCP server and denies the native tools in `.claude/settings.json` (backups as `*.pre-mirror.bak`, nothing else touched). Also trusts the server for this project and carries your existing tool permissions onto the mirrored names — without those the agent boots with no tools at all. `--allow-tools` pre-allows the whole roster for headless runs. Verifies the server starts before denying anything. Takes effect on the next session. `--agent codex` and `--agent claude-desktop` wire those hosts machine-wide instead; the desktop app has no deny-list, so there the mirror adds governed tools without removing the app's own. Claude Code keeps its native `WebFetch` (already hook-screened, and it summarises the page); OpenCode's is disabled, since it has no hooks at all. See MCP Gateway.
`prismor mirror off`	`--workspace`	Undo exactly what `on` did — the agent uses its native tools again from the next session.
`prismor mirror status`	`--workspace`	Where the mirror is configured, whether it is governing / passing through / paused, its tool roster, live gateway processes.
`prismor mirror passthrough <on\|off>`	`--workspace`	Runtime switch, no restart: `on` runs mirrored built-ins ungoverned (logged, not blocked or redacted). `prismor pause` does the same for hooks + gateway together, with auto-resume.
`prismor egress migrate`	`--workspace`	Convert a legacy warn-only `settings.egress_allowlist` into an enforceable `settings.egress`.
`prismor tags list`	`--last N`, `--workspace`	Tools seen in recent sessions + resolved tags + which tier resolved them (explicit / `_meta` / default / inference). See Tool Tags.
`prismor tags set <tool> <tag>...`	`--workspace`	Tag a tool or glob in `.prismor/policy.yaml` (`tags rm` removes).
`prismor tags rules [add\|rm]`	`--workspace`	List, add, or remove tag-rule expressions, e.g. `"untrusted_content then critical_action -> block"`. Adds are parse-checked with caret diagnostics.
`prismor tags edit`	`--workspace`	Interactive wizard: tag tools, author rules, flip mode.
`prismor tags lint [file]`	`--workspace`	Validate every rule expression in a policy file. Exit `1` on errors.
`prismor tags test`	`--session <id>`, `--last N`, `--rule "<expr>"`, `--fail-on-hit`	Dry-run tag rules against recorded session logs: prints WOULD BLOCK / WOULD WARN per call, touches no enforcement state. `--rule` adds what-if candidates.

eval-server

Command	Key flags	Description
`prismor eval-server`	`--port` (default 7071), `--host` (default 127.0.0.1), `--workspace`	HTTP evaluation endpoint (`POST /v1/evaluate`) so non-Python adapters (Vercel AI SDK, anything HTTP) get the same policy pipeline. See Frameworks overview and Vercel AI SDK.

proxy

Command	Key flags	Description
`prismor proxy`	`--port` (default 7080), `--host` (default 127.0.0.1), `--mode observe\|enforce`, `--workspace`, `--config`, `--session-id`, `--agent-name`	Policy proxy for model traffic. Point an agent at it with `ANTHROPIC_BASE_URL` / `OPENAI_BASE_URL`; the outbound prompt is screened and cloak-masked, and every `tool_use` in the response is evaluated as the tool call it is. See the LLM proxy.

proxy

Command	Key flags	Description
`prismor proxy`	`--port` (default 7080), `--host` (default 127.0.0.1), `--mode <observe\|enforce>`, `--workspace`, `--config`, `--session-id`, `--agent-name`	The LLM lane: sits in front of Anthropic, OpenAI-compatible and Google Gen AI endpoints so an agent Prismor cannot hook is still governed. Point the client at it with `ANTHROPIC_BASE_URL`, `OPENAI_BASE_URL`, or `genai.Client(http_options=types.HttpOptions(base_url=...))` — nothing else about the agent changes. The outbound prompt is screened and cloak-masked; every proposed tool call (`tool_use` / `tool_calls` / `functionCall`) is reshaped into the event a `Bash` hook produces and run through the same policy; streamed tool calls are held until they can be judged. See LLM proxy.

inference-hook

Command	Key flags	Description
`prismor inference-hook serve`	`--host`, `--port` (7072), `--signing-secret`, `--previous-signing-secret`, `--fail-open`, `--mode enforce	shadow`,` --allow-unsigned`,` --api-key`,` --config`,` --workspace`,` -v`
`prismor inference-hook test`	`--url`, `--secret`, `--sample clean	pci
`prismor inference-hook secret`	—	Print a fresh `whsec_` secret for local end-to-end runs.

prismor inference-hook-server remains as an alias for serve.

Full policy model, rule schema, and the default rule list: Prismor.

Visibility

Command	Key flags	Description
`prismor audit`	`--fix`, `--json`, `--workspace`	Posture audit across hooks, policy, cloak, permissions, feed, network, supply chain. `--fix` applies safe remediations.
`prismor scan`	`--agent`, `--json`	Scan installed MCP servers and skills for dangerous patterns. See Skill Scanner.
`prismor deps`	`--json`, `--workspace`	Cross-reference project dependencies against the signed IOC feed + lockfile integrity. See Supply Chain.
`prismor analyze [FILE]`	`--input`, `--json`, `--sarif`	Run the engine over a JSONL session (or the most recent one). SARIF output feeds GitHub Code Scanning.
`prismor ingest --input <file>`	`--session-id`, `--agent`	Analyze a single pre-normalized JSONL session and store it in the local DB.
`prismor ingest --discover`	`--agent`, `--since`, `--max-events`, `--no-persist`, `--strict`, `--semantic`, `--json`	Sweep this machine for agent transcripts, replay them through the live policy engine, and report what the current policy would have blocked vs warned. Backfills the dashboard with history from before install. `--strict` exits non-zero if a non-empty transcript yields no events; `--semantic` re-enables the semantic guard (off during sweeps so it can't fire an LLM call per event across all history). See Transcript Ingest.
`prismor ingest --discover --coverage`	`--json`	Show sessions that ran with no live Prismor record — activity that executed ungoverned.
`prismor ingest --discover --show <rule>`	—	List the individual tool calls behind one rule id.
`prismor ingest --discover --export-corpus <dir>`	—	Write redacted, labelled rule fixtures (positives + negatives) from real usage.
`prismor sessions`	`--findings-only`, `--global`, `--limit`, `--json`	List stored sessions, optionally only flagged ones, optionally across all workspaces.
`prismor session <id>`	`--json`	Drill into one session's tool-call trace + findings.
`prismor trail verify`	`--pubkey`, `--json`	Verify the signed audit trail end-to-end: recompute hashes, prev-hash linkage, seq gaps, Ed25519 signatures. Exit non-zero on anything but a clean chain. See Signed Audit Trail.
`prismor trail show`	`--last N`	Render recent audit-trail records (verdict, agent, tool, input).
`prismor trail checkpoint`	`--out FILE`	Export a signed chain-head checkpoint for anchoring outside the machine.
`prismor attest`	`--out FILE`, `--workspace`	Build a signed evidence bundle: posture findings, agent inventory, and the trail anchor in one Ed25519-signed file. See Attestation Bundle.
`prismor attest verify <bundle>`	`--pubkey`, `--json`	Re-verify a bundle's content hash and signature. `--pubkey` pins an out-of-band signer key. Exit non-zero on failure.
`prismor attest coverage`	`--json`, `--workspace`	Show which compliance-framework controls the active policy covers (OWASP LLM/Agentic, NIST AI RMF, EU AI Act).
`prismor discover [all\|agents\|mcp\|keys]`	`--fix`, `--yes`, `--fix-mode`, `--json`, `--report`, `--no-file-scan`, `--fail-on-shadow`, `--workspace`	Sweep this host for the AI surface running outside Prismor's coverage (shadow AI): agents without hooks, MCP servers not routed through the gateway, and provider keys not registered with Cloak. Ends with a coverage score. Pass a section to limit the report; `--fail-on-shadow` exits 1 for CI; `--report` sends the inventory to your organization console for the fleet-wide Shadow AI view (enrolled devices only, and a no-op otherwise). `--fix` governs what it found — hooks the unmanaged agents, moves MCP servers behind the gateway (any config declaring `mcpServers`/`servers`, not just the workspace's), imports dotenv keys into Cloak — printing the plan and asking first (`--yes` to skip the prompt, `--fix-mode enforce` to install in enforce). Without `--fix` it is read-only; credential-shaped values in MCP URLs and argv are redacted before they reach output. On an enrolled device each reported finding also carries whether it is fixable and the command that fixes it, so the console can show what is actionable today. See Host discovery.
`prismor status --all`	`--days N`	Terminal overview of every registered workspace. See Dashboard.
`prismor dashboard`	`--port`, `--host`, `--no-open`	Local web dashboard at `http://127.0.0.1:7070` (opens a browser tab). See Dashboard.
`prismor serve`	`--port`, `--host`, `--no-open`	Deprecated alias of `dashboard --no-open` (headless server only).

Secret prevention

Command	Key flags	Description
`prismor cloak install`	`--scope`, `--no-userprompt-guard`, `--no-secret-guard`, `--sweep-on-stop`	Install cloaking hooks so real secrets stay out of model context.
`prismor cloak add <name>`	`--from-file`	Register a secret under a placeholder. Value read from stdin / hidden prompt — never argv.
`prismor cloak add --env-file .env`	—	Import every `KEY=VALUE` entry from a dotenv file as `@@SECRET:KEY@@`.
`prismor cloak list`	—	List registered placeholder names (never values).
`prismor cloak remove <name>`	—	Delete a registered secret.
`prismor cloak status`	`--scope`	Show whether cloaking hooks are installed + secret count.
`prismor cloak run -- <command>`	—	Run a command with `@@SECRET:name@@` placeholders resolved locally and stdout/stderr scrubbed. Use this for Codex, whose hooks are block-only.
`prismor cloak pattern <list\|add\|remove>`	—	Manage the secret-detection regexes.
`prismor sweep`	`--redact`, `--clean`, `--restore`, `--show-vault`, `--purge`	Find secrets already leaked into AI tool configs and vault/redact them.

Design, setup, best practices, and threat model: Sweep & Cloak.

Identity & scoping

Command	Key flags	Description
`prismor iam init`	`--scope <global\|project>`	Scaffold an `iam.yaml` of agent identities.
`prismor iam list`	—	List defined identities; marks the active `PRISMOR_AGENT_ID`.
`prismor iam show <agent>`	—	Show one identity's permission profile.
`prismor iam check <agent> --value "<v>"`	`--type <command\|read\|write\|network>`	Test whether an identity may perform an action.
`prismor scope show [id\|latest]`	—	Show session-scoped rules (all, or one session; `latest` or a unique id prefix).
`prismor scope list`	—	List sessions with active scoped rules.
`prismor scope edit <id\|latest>`	—	Edit a session's scoped rules in `$EDITOR` (freezes auto-widening for that session).
`prismor scope clear <id>`	—	Remove a session's scoped rules.
`prismor agents list`	—	List every named agent instance seen (the adapter's `name=`), with framework + control state.
`prismor agents show <name>`	—	Show one named agent's control settings (enabled, mode, IAM profile, last seen).
`prismor agents set <name>`	`--enabled/--disabled`, `--mode <observe\|enforce>`, `--iam-profile <p>`	Per-agent runtime control: kill-switch, mode override, forced IAM profile. Config lives in `agents.yaml`.
`prismor canary plant <path>`	`--type <aws\|ssh\|env\|generic>`, `--webhook`, `--force`	Plant a honeytoken credential tripwire.
`prismor canary list`	—	List planted canaries (markers redacted).
`prismor canary status`	—	Summary of canaries by type.
`prismor canary remove <id\|path>`	—	Remove a canary.

Deep dives: IAM · Scoped Agent · Canary.

Adaptive defense

Command	Key flags	Description
`prismor learn`	`--min-support`, `--fp-threshold`, `--json`	Mine session history for repeated blocked / near-miss patterns and propose new rules.
`prismor learn --candidates`	—	List pending candidate rules.
`prismor learn --apply <id>`	—	Accept a candidate into project policy.
`prismor learn --reject <id>`	—	Reject a candidate.

Deep dive: Learning.

Enterprise / org

Command	Key flags	Description
`prismor enroll <token>`	`--label`, `--api-base`	Exchange a single-use org token (minted in the dashboard) for this machine's device identity; pulls the signed org policy.
`prismor enroll-status`	—	Show enrollment state, device label, and the applied policy version.
`prismor workspace [managed\|personal\|auto]`	—	With no argument, shows whether this workspace is org-managed (org policy + telemetry) or personal (local-only). Pass `managed`/`personal`/`auto` to set it. Org-claimed repos can't be downgraded, and `personal` is ignored entirely when the org policy sets `allow_personal_workspaces: false`.
`prismor exempt request`	`--reason`	Ask an org admin to relax specific non-floor rules for this repo; served back in the signed policy.
`prismor logout`	—	Un-enroll: removes the device identity and cached remote policy. Local protection stays on.

Deep dive: Connecting to the platform · Policy layers & exemptions.

Supply chain

Command	Description
`prismor supplychain npm install <pkg>`	Score `<pkg>` (age, maintainers, install scripts, IOC match) and block if dangerous before npm runs.
`prismor supplychain pip install <pkg>`	Same gate for PyPI.
`prismor supplychain <pnpm\|yarn\|uv\|cargo\|go> …`	Same gate per ecosystem. Non-install commands pass through transparently.
`prismor supplychain harden [--dry-run] [PATH]`	Write hardening settings (`ignore-scripts`, `save-exact`, pinned fetch) into package-manager configs.

Scoring table, IOC feed, ecosystem support: Supply Chain.

Environment variables

Variable	Used by	Effect
`PRISMOR_MODE`	`setup --non-interactive`	Default enforcement mode (`observe` / `enforce`).
`PRISMOR_CLOAK`	`setup --non-interactive`	Enable cloaking (`1`/`true`/`yes`/`on`).
`PRISMOR_WORKSPACE`	all commands	Override the resolved workspace path.
`PRISMOR_AGENT_ID`	`iam`	Active agent identity for IAM enforcement. See IAM.
`PRISMOR_SWEEP_PASS`	`sweep`	Vault passphrase for non-interactive runs.
`EDITOR`	`scope edit`	Editor for scoped-rule editing.