Runtime security for your own agents

Your agent can act.
The gate decides if it should.

Chloros sits outside your AI agent and checks every action before it fires — so one bad instruction can't quietly send, spend, or delete.

Built for individuals running their own agents — not the enterprise.
Approach informed by OWASP agentic security guidance · Deterministic · fail-closed · external to the agent
The problem

Working was never the hard part.

Any coding agent gives you an action that runs. The moment it can act — send email, move money, touch files — a bad instruction stops being a wrong answer and becomes a real one, with no undo.

Why prompts don't hold

A rule in the prompt is a suggestion

"Ask before you do this" is just another input the model weighs. Under enough pressure to finish the task, finishing wins.

I watched an agent quote my own rule back to me — then do it anyway.
Why logs don't help

A log tells you after the money's gone

Most tools record what your agent did once it's already done. By then the send is sent and the row is deleted. You need a decision before the action, not a record after.

The failure path is where trust is earned or lost.
The gate — what Chloros is

Every action is checked before it fires.

The gate lives outside the agent, so injected content can't argue with it. Actions are judged by one question that actually maps to harm: can this be undone?

Allowed

Reversible actions flow

Reads, drafts, anything you can walk back — they run without interrupting you, and they're logged so you can review.

  • read a file
  • draft a reply
  • reversible API calls
Held for you

One-way doors wait

Irreversible actions stop for your explicit approval — with the blast radius shown, so the decision is glanceable, not a chore.

  • money leaving
  • external sends
  • production writes
Blocked

Clear dangers stop cold

Credential exfiltration, mass deletes, and known-bad actions are refused outright — no matter how the agent got talked into them.

  • leak API keys
  • rm -rf on prod
  • known-bad patterns
How it fits

Scanning is the lock. Chloros is what catches the intruder already inside.

Great free scanners now exist — from Snyk, NVIDIA, Cisco and others. Use them. But scanning only answers one question, and it isn't the one that saves you at runtime.

Before you install

Scanning

Checks a skill or package for hidden instructions and malicious code before it ever reaches your machine. Necessary, and increasingly free.

Answers: “is this safe to install?”

github.com/agent-skills/pdf-summarizer Scan it
DANGEROUS Do not install — 3 findingshidden instructions + credential access
CRITHidden instruction in SKILL.mdTells the agent to read your credentials and send them out — invisible to code-only scanners.
CRITCredential accessReads SSH private keys from the home directory.
HIGHObfuscated remote executionBase64-decodes a payload and pipes it into a shell.
While it runs

The Chloros gate

A clean skill can still take a dangerous action at runtime when an injection arrives through the data it reads. The gate stops that action as it happens — per action, every time.

Answers: “should this action fire, right now?”

Around the gate

A full suite of oversight — with the gate at its center.

Everything else exists to serve the gate: catch threats before they reach it, keep secrets away from the agent, and put you back in control when something slips.

Skill scanner

Catches hidden natural-language instructions buried in SKILL.md files that code-only scanners miss — before you install.

Encrypted vault

Secrets are referenced by name and kept out of the agent's context — so a leaked prompt can't leak a key the agent never saw.

Kill switch

Stop one agent or all of them, instantly — a global and per-agent hard stop for the moment something goes wrong.

Rewind

A time machine for agent activity — walk back what happened and recover from a bad run instead of living with it.

Data-leak tripwire

Watches for PII and secrets leaving through an agent's actions, with validated detection — not just pattern guesses.

Live operations

Watch every agent's actions flow through the gate in real time — allowed, held, or blocked — from one clear view.

Pricing

Start free. Scale when you do.

One agent free, forever. No credit card to begin.

Free
$0/mo
  • 1 agent
  • Scanner, approvals & kill switch
  • Phone + Telegram alerts
  • 7-day activity history
Get started
Team
$79.99/mo
  • Unlimited agents
  • Everything in Pro
  • Priority support
  • Signed audit export
Choose Team

Running agents across a team or company? Enterprise plans add volume deployment, SSO, custom policies, and a security review.

Let's talk
Why you can trust it

A security tool that oversells is worse than one that's honest.

Most security products promise everything and quietly do less. We'd rather tell you exactly where Chloros holds — and where it doesn't — so you can actually trust the parts that do.

Honest about what it isn't.

The scanner is a strong signal, not a guarantee — static analysis can't catch every novel technique. The gate protects the paths you wire it through, and an approval only helps if you actually look at it. We say all of this plainly, in the product and here.

What Chloros does do, it does deterministically: an irreversible action can't fire without passing the gate, no matter how the agent was talked into it. That part isn't a promise — it's how it's built. We'd rather be the layer you understand completely than the one that claims everything.

From the founder

I built Chloros because I kept watching AI agents get talked into doing things they were never supposed to do — a poisoned web page or a stray instruction, and suddenly an agent is sending money or deleting files it should never have touched.

The usual fix is to put a rule in the prompt and hope the model follows it. But a rule in the prompt is just a suggestion the model weighs against finishing its task — and under pressure, finishing usually wins. So I built the enforcement somewhere it can't be argued with: outside the agent, as a deterministic gate on the actions that can actually hurt you.

I'm a solo developer, and I'd rather be honest about what this does and doesn't do than oversell it. If you run your own agents, I'd genuinely love for you to try it — and to tell me where it falls short. That feedback is how it gets better.

Founder, Chloros · info@chloros.io

Start in a minute

Put a gate between your agent and the things it can't undo.

Free to try. No signup for the scanner. Built by a solo dev for the people running their own agents.

Try Chloros free See the gate again