Chloros sits outside your AI agent and checks every action before it fires — so one bad instruction can't quietly send, spend, or delete.
Any coding agent gives you an action that runs. The moment it can act — send email, move money, touch files — a bad instruction stops being a wrong answer and becomes a real one, with no undo.
"Ask before you do this" is just another input the model weighs. Under enough pressure to finish the task, finishing wins.
Most tools record what your agent did once it's already done. By then the send is sent and the row is deleted. You need a decision before the action, not a record after.
The gate lives outside the agent, so injected content can't argue with it. Actions are judged by one question that actually maps to harm: can this be undone?
Reads, drafts, anything you can walk back — they run without interrupting you, and they're logged so you can review.
Irreversible actions stop for your explicit approval — with the blast radius shown, so the decision is glanceable, not a chore.
Credential exfiltration, mass deletes, and known-bad actions are refused outright — no matter how the agent got talked into them.
Great free scanners now exist — from Snyk, NVIDIA, Cisco and others. Use them. But scanning only answers one question, and it isn't the one that saves you at runtime.
Checks a skill or package for hidden instructions and malicious code before it ever reaches your machine. Necessary, and increasingly free.
Answers: “is this safe to install?”
A clean skill can still take a dangerous action at runtime when an injection arrives through the data it reads. The gate stops that action as it happens — per action, every time.
Answers: “should this action fire, right now?”
Everything else exists to serve the gate: catch threats before they reach it, keep secrets away from the agent, and put you back in control when something slips.
Catches hidden natural-language instructions buried in SKILL.md files that code-only scanners miss — before you install.
Secrets are referenced by name and kept out of the agent's context — so a leaked prompt can't leak a key the agent never saw.
Stop one agent or all of them, instantly — a global and per-agent hard stop for the moment something goes wrong.
A time machine for agent activity — walk back what happened and recover from a bad run instead of living with it.
Watches for PII and secrets leaving through an agent's actions, with validated detection — not just pattern guesses.
Watch every agent's actions flow through the gate in real time — allowed, held, or blocked — from one clear view.
One agent free, forever. No credit card to begin.
Running agents across a team or company? Enterprise plans add volume deployment, SSO, custom policies, and a security review.
Let's talkMost security products promise everything and quietly do less. We'd rather tell you exactly where Chloros holds — and where it doesn't — so you can actually trust the parts that do.
The scanner is a strong signal, not a guarantee — static analysis can't catch every novel technique. The gate protects the paths you wire it through, and an approval only helps if you actually look at it. We say all of this plainly, in the product and here.
What Chloros does do, it does deterministically: an irreversible action can't fire without passing the gate, no matter how the agent was talked into it. That part isn't a promise — it's how it's built. We'd rather be the layer you understand completely than the one that claims everything.
I built Chloros because I kept watching AI agents get talked into doing things they were never supposed to do — a poisoned web page or a stray instruction, and suddenly an agent is sending money or deleting files it should never have touched.
The usual fix is to put a rule in the prompt and hope the model follows it. But a rule in the prompt is just a suggestion the model weighs against finishing its task — and under pressure, finishing usually wins. So I built the enforcement somewhere it can't be argued with: outside the agent, as a deterministic gate on the actions that can actually hurt you.
I'm a solo developer, and I'd rather be honest about what this does and doesn't do than oversell it. If you run your own agents, I'd genuinely love for you to try it — and to tell me where it falls short. That feedback is how it gets better.
— Founder, Chloros · info@chloros.io
Free to try. No signup for the scanner. Built by a solo dev for the people running their own agents.