Chloros sits outside your AI agent and checks every action before it fires — so one bad instruction can't quietly send, spend, or delete.
Any coding agent gives you an action that runs. The moment it can act — send email, move money, touch files — a bad instruction stops being a wrong answer and becomes a real one, with no undo.
"Ask before you do this" is just another input the model weighs. Under enough pressure to finish the task, finishing wins.
Most tools record what your agent did once it's already done. By then the send is sent and the row is deleted. You need a decision before the action, not a record after.
The gate lives outside the agent, so injected content can't argue with it. Actions are judged by one question that actually maps to harm: can this be undone?
Reads, drafts, anything you can walk back — they run without interrupting you, and they're logged so you can review.
Irreversible actions stop for your explicit approval — with the blast radius shown, so the decision is glanceable, not a chore.
Credential exfiltration, mass deletes, and known-bad actions are refused outright — no matter how the agent got talked into them.
Great free scanners now exist — from Snyk, NVIDIA, Cisco and others. Use them. But scanning only answers one question, and it isn't the one that saves you at runtime.
Checks a skill or package for hidden instructions and malicious code before it ever reaches your machine. Necessary, and increasingly free.
Answers: “is this safe to install?”
A clean skill can still take a dangerous action at runtime when an injection arrives through the data it reads. The gate stops that action as it happens — per action, every time.
Answers: “should this action fire, right now?”
Everything else exists to serve the gate: catch threats before they reach it, keep secrets away from the agent, and put you back in control when something slips.
Catches hidden natural-language instructions buried in SKILL.md files that code-only scanners miss — before you install.
Secrets are referenced by name and kept out of the agent's context — so a leaked prompt can't leak a key the agent never saw.
Stop one agent or all of them, instantly — a global and per-agent hard stop for the moment something goes wrong.
A time machine for agent activity — walk back what happened and recover from a bad run instead of living with it.
Watches for PII and secrets leaving through an agent's actions, with validated detection — not just pattern guesses.
Watch every agent's actions flow through the gate in real time — allowed, held, or blocked — from one clear view.
One agent free, forever. No credit card to begin.
Running agents across a team or company? Enterprise plans add volume deployment, SSO, custom policies, and a security review.
Let's talkThe scanner is a strong signal, not a guarantee — static analysis can't catch every novel technique. The gate protects the paths you wire it through. We say this plainly, in the product and here.
A security tool that oversells is worse than one that's clear about its edges. Chloros is built to be the layer you understand and trust — not the one that promises everything and quietly does less.
Free to try. No signup for the scanner. Built by a solo dev for the people running their own agents.
