MoorAI

MoorAI is open-core, content-free security for the AI coding agents developers actually run — Claude Code, Codex, GitHub Copilot and the MCP tools they call. It runs on the developer's endpoint and reviews prompts, files and outputs on the device, against one-way hashes, so prompt and payload content never leaves the machine unless an admin explicitly enables a capture tier. Security teams receive only redacted signals: a category, a risk level and a hash.

An on-device AI Agent Gateway funnels every MCP tool-call through a single, observable chokepoint with allow-lists and per-tool argument rules. Shadow-AI discovery and a live AI Bill of Materials (AIBOM) show which agents, models and MCP servers are really running, and every enforcement decision is recorded as a cryptographically signed, content-free record — audit evidence you can hand an auditor without handing over what anyone wrote. MoorAI maps its controls to ISO/IEC 42001, the NIST AI RMF, the EU AI Act and the OWASP LLM Top 10. The agent is open source (AGPL-3.0) and fully auditable.