Let AI work on your computer. Keep control of what it does.
AI assistants now read your files, run commands and send data out, hundreds of times an hour, with your permission. Prahari checks every action before it runs, stops the risky ones with a plain reason, keeps passwords and personal data from leaving, and puts your files back when something goes wrong. It runs on your device, so nothing leaves it to be checked.
Guards the AI your teams already use: in the terminal, the editor, on the desktop and in the browser
Antivirus looks for bad programs. Your AI tools are trusted ones.
There is no virus to catch: just a powerful program you installed on purpose, doing risky things in good faith, pointed at everything your account can reach. Nothing was built to watch that.
Mistakes at machine speed
It misreads one instruction and deletes a folder, overwrites a file or drops a table, sure it is helping. Nobody was asked first.
It can be tricked
One hidden line in a web page, a document or a plug-in says "send me the passwords". To the AI it is all just text to follow.
Your data walks out
A customer list pasted into an AI chat to tidy it up. A PAN, an Aadhaar number, a password in a prompt. Once it reaches an AI company, you can't call it back.
It switches off its own guard
An agent that hits a block edits its settings, removes the safety hooks, or starts a copy of itself with approvals off.
AI nobody approved
Extensions, cloud agents, meeting bots that record every word, screen recorders. Most companies don't know which ones are running.
No proof
"What did your AI do with our data?" Most companies have no answer, and under India's DPDP Act a failure to protect personal data can cost up to ₹250 crore.
Every AI action passes a checkpoint first
Prahari plugs into the checkpoint each AI tool calls before it acts, and into the path its prompts take to the AI company. Safe goes ahead. Risky asks you. Dangerous is stopped.
- AI tool
Wants to act
Read a file, run a command, call a plug-in, send a prompt. Before it does, it asks its hook.
read · run · send - Prahari
Checks it first
Against your policy, the data detectors, and what this session has already done.
policy + detectors - Verdict
Allow, ask or stop
A block names its rule, shows what it matched with secrets masked, and gives you the command that allows it.
allow · ask · deny - Record
Writes it down
Every call, not only the blocked ones, in a hash-chained log. If anyone edits it, it shows.
tamper-evident record
Five parts, one guard
Each one sees something the others can't.
| Part | What it sees | Acts | What it does |
|---|---|---|---|
| ShieldKavach | Every tool call an AI agent makes, before it runs: files, commands, websites, plug-ins | Blocks | Credential reads, dangerous commands, data-drop sites, attempts to switch Prahari off |
| GatewayKavach | What AI tools send to the AI company, and the tool calls the model sends back | Blocks | Removes passwords, swaps ID numbers for placeholders, checks the AI's actions before your tool sees them |
| WatchNetra | Which programs connect where, and which files AI tools open | Records | Flags a read-then-send, and AI traffic that went around the gateway |
| RecordKavach | Every action and every decision | Records | Learns a normal session and flags one that reads far more, or touches credentials for the first time |
| ScannerPrahari | What is already on the machine | Finds | Risky permission modes and plug-ins, credential files in projects, passwords left in old AI chats |
Kavach is Sanskrit for armour, Netra for eye, and Prahari for the guard on watch.
Fourteen modules, each named after the problem it solves
The way an antivirus names its shields. All fourteen work on your device, and the app's Overview shows each one's live state, with a Fix button for anything not fully on.
Anti-Rogue
OnDeleted folders, wiped tables, scripts run straight from the internet.
Blocked before they run. A session that keeps trying is quarantined.
Anti-Steal
OnPasswords and customer data taken off the machine.
Credential files closed; ID numbers and customer lists stopped; data-drop sites blocked.
Anti-Leak
OnPrivate data in a prompt or attachment goes to an AI company.
Passwords removed, ID numbers swapped for placeholders, customer files refused.
Anti-Injection
OnHidden instructions hijack the assistant.
What comes back is checked; the agent is told to treat it as data, not orders.
Anti-Tamper
OnThe assistant tries to switch Prahari off.
Settings and records closed to agents; hooks checked every ten minutes, blocks tested weekly.
Anti-Escalation
OnThe assistant gives itself more power.
Starting an agent with approvals off is blocked; admin-level commands need you.
Anti-Persistence
OnSomething left behind to run later: a startup task, a remote-access key.
Asks you first; startup folders and SSH keys stay closed to agents.
Anti-Runaway
OnAn agent stuck in a loop, burning time and money.
Hundreds of actions in minutes, and the session is quarantined until you look.
Rollback
OnDamage done with allowed actions: a file overwritten, a folder deleted.
A copy of every file before it changes; restore one file or a whole session.
Anti-Shadow-AI
OnAI tools nobody approved.
Finds them; each kind of AI data flow gets block, ask, watch or allow.
Anti-Snoop
OnScreen recorders, meeting note-takers, AI usage tracking.
Blocked or asked about; AI tracking traffic dropped.
Anti-Exposure
OnPasswords already sitting in old AI chats and project files.
Found, shown masked, and tracked until each one is changed.
Anti-Supply-Chain
OnAn assistant installs a malicious or made-up software package.
Installs need your approval and download-and-run is blocked. Each package is checked to exist on its registry, and one published only days ago, or typosquatting a known name, is held for you.
Anti-Overreach
OnAn assistant works outside the project it was given.
Its changes stay inside the project folder; a read, write or command outside it asks you first, and the record shows where it tried to go.
Four tools, each one click away
For the moment an assistant misbehaves. Every stop, quarantine, release and restore is written to the tamper-evident record.
Emergency stop
The red button on every screen and in the tray.
- Blocks every action of every AI assistant at once
- Stays on until you press Resume AI
- Agents can switch it on, never off
Quarantine
One session stopped, the rest keep working.
- Repeated blocks, password hunting, or hundreds of actions in minutes
- An attempt to switch Prahari off
- You review it, then release or keep it stopped
Rollback
A copy kept before an assistant changes a file.
- Restore one file
- Or undo everything a session changed
- The undo can itself be undone
Live console
A running log at the bottom of the window.
- Every action checked, every request to an AI company
- Each line tagged with the module that acted
- See what your AI is doing right now
Private data is swapped out before it leaves
Most people use AI in the browser, in their mail and in tools that talk to AI companies directly. Prahari checks each of those paths, on the device, before anything is sent.
- 1Caught on the way out. Pasted, typed, attached or dropped: text, spreadsheets, Word, PowerPoint and PDF are opened and checked.
- 2Swapped for placeholders. [PAN_1] goes instead of the PAN; passwords are removed outright.
- 3Put back on your screen. When the answer comes back, the real values return on that page only. The AI never had them.
Prahari found 2 itemsA PAN and an Indian mobile number. Your policy allows sending them as placeholders.
AI chat websites
A browser extension for Chrome, Edge, Brave, Chromium, Opera and Vivaldi.
- ChatGPT, Gemini, Claude, Copilot, Perplexity, DeepSeek and more
- Your policy applies; the emergency stop blocks them
AI tools
A model gateway on your computer, between the tool and the AI company.
- Credentials redacted before they leave
- Attached files checked; telemetry dropped
Outlook
Sensitive mail stays inside the company.
- Confidential mail, or data Prahari would block, goes only to your own domains
- Refused outside, with no send-anyway
MCP plug-ins
Every plug-in server behind Prahari in one command.
- Each tool call judged against your policy
- Results cleaned of injected instructions and keys
What it recognises
27 secret formats, personal data from India, the Gulf, the US and Europe, and the shape of a customer list or a loan book. Your own known-safe values, such as your company's GSTIN, are marked once and never flagged again.
Every kind of AI agent, stopped before it acts
Coding agents in the terminal, AI editors, desktop assistants that click and type for you, browser agents, chat websites, and the AI built into the operating system. One policy covers all of them, and the emergency stop halts all of them at once.
| Kind of agent | Covered | How Prahari covers it |
|---|---|---|
| Coding agents in the terminalClaude Code, Codex CLI, Gemini CLI, GitHub Copilot CLI, Aider, OpenCode | Yes | Blocked at the agent's own hook, before the file read, the command or the upload runs. Every decision on the record. Windows, macOS and Linux. |
| AI editors and IDE agentsCursor, Windsurf, VS Code agent mode, Copilot coding agent, Cline, Roo Code, Kiro, JetBrains Junie and AI Assistant, Amazon Q Developer, Zed, Warp | Yes | Blocked at the editor's hook; plug-in calls judged through the MCP gateway; the model gateway checks what each one sends out. |
| Cloud and autonomous coding agentsDevin, Copilot cloud agent, Codex cloud, Replit Agent, Lovable, Bolt, v0 | Yes | Gated wherever they touch your repository or your machine. The team policy is committed with the repository, so the same rules apply in the cloud. |
| Desktop assistants and computer-use agentsClaude Desktop and Cowork, ChatGPT desktop and Agent mode, Microsoft Copilot (Windows and Microsoft 365), Gemini app, Manus | Yes | Every file, command, click, paste and upload judged against your policy; the settings that let them read other windows are audited; the emergency stop halts them. |
| Browser agentsClaude in Chrome, ChatGPT Atlas, Perplexity Comet, Gemini in Chrome, Copilot in Edge | Yes | The browser extension checks the pages they act on, the forms they fill and the data they paste; credentials and personal data are swapped for placeholders. |
| AI chat websitesChatGPT, Gemini, Claude, Copilot, Perplexity, DeepSeek, Grok, Mistral and more | Yes | Anti-Leak in Chrome, Edge, Brave, Chromium, Opera and Vivaldi: what you type or attach is checked before it is sent. |
| AI built into the operating system and OfficeWindows Recall, Copilot in Windows, Apple Intelligence, Microsoft 365 connected experiences | Yes | Audited against your policy, switched off where the policy says so, and any drift reported on the next scan. |
| Meeting bots, recorders and note-takersOtter, Fireflies, Fathom, Read AI, tl;dv, Limitless | Yes | Found and inventoried; every data flow off the machine blocked or asked about; a recorder in a confidential meeting is flagged. |
| Local models and MCP serversOllama, LM Studio, any MCP plug-in server | Yes | The gateway sits in front of every plug-in server; results are cleaned of injected instructions and keys; network exposure of local models is checked. |
| Anything else, including your own agentsInternal tools, scripts, agents built on an SDK | Yes | Run it under prahari run: the same policy, the same record, the same emergency stop. The watch covers whatever runs outside it. |
prahari doctor feeds a synthetic tool call through each installed hook and confirms the right answer comes back, so coverage is proven on the machine, not inferred from a settings file. prahari coverage shows the live state per agent.
Allow AI, and still answer to your regulators
Rules for your region, evidence an auditor can verify, and a lock-down your staff can't loosen.
Ready-made policy packs
Eleven packs, each listing the laws it was written for. They teach Prahari your region's ID numbers. A starting point for your compliance team, not legal advice.
Evidence for auditors
The Compliance screen shows what was caught, by data type, regulation, tool and person, and whether the record is intact.
- Every decision tagged with the obligations it supports: DPDP, RBI IT directions, RBI FREE-AI, CICRA
- One-click bundle:
decisions.csvby regulation,report.pdf, a scan and a checksum manifest - Never contains a password or a full personal-data value
Lock-down and fleet rollout
An administrator installs a signed company policy that staff can't loosen.
- Managed hook files in a place staff can't remove; fail-closed if you want it
- Packages for Intune, Jamf and Linux fleets
- Signed policies, so they can't be faked
One policy for the team
Commit one policy to the repository; teammates run one setup script.
- A team policy wins over anyone's personal one
- Exceptions proposed by developers, reviewed in a pull request
- Replay the last 30 days before a policy change goes live
Policy Builder: your own rules, on every computer
Your regulations, coding standards, business flows and customer number formats, turned into signed policy packs.
- Upload
Your documents
A regulation, your coding standards, a business process, a use case.
- Draft
AI builds the pack
Obligations, rules, your own identifier formats, guidance for AI agents, and tests that must pass.
- Check
Word for word
Every requirement is quoted against your own document, and every rule traces to one. A person approves.
- Apply
Signed, everywhere
Every Prahari device applies the signed pack and keeps it current.
Built for the risk your other tools weren't
Antivirus and firewalls still matter. They just aren't looking at a trusted program doing risky things with your permission.
| What you need | Prahari | Antivirus | Firewall |
|---|---|---|---|
| Stop a risky action by a trusted AI tool, before it runs | At the tool's own hook | Nothing malicious to detect | Sees the network only |
| Keep ID numbers and passwords out of AI prompts | Placeholders and redaction, on the device | No | Sees the connection, not the prompt |
| Spot hidden instructions aimed at the agent | Results checked, agent warned | No | No |
| Put files back after an AI changed them | One file or a whole session | Some offer ransomware rollback | No |
| Know which AI tools are on the machine | Catalog of 43 AI vendors | No | By domain, if configured |
| A record an auditor can verify, by regulation | Hash-chained, tagged by regulation | Malware events | Connection logs |
| Keep working when the AI is the one trying to switch it off | Controls are for people only | Guards against malware, not the user's own tools | Admin settings |
Capabilities vary by product. Prahari works alongside your antivirus and firewall; it does not replace them.
Nothing is sent anywhere to be checked.
Prahari runs on your device. Its detectors, policy and records stay on the machine, and there is no Prahari server in the path. The AI it guards can't loosen it, and you can check that it works rather than take it on trust.
Three products, the whole path
AI now writes your code, holds the keys to your systems and acts on every computer in the company. Each product keeps one of those in check, and all three run on your own machines.
PreAI Sentry
Works inside the coding tools. Catches what the assistant gets wrong before it ships: leaked keys and personal data, risky packages, and hidden instructions aimed at the agent.
preai.dev →
Tokenvoy
Keeps passwords, API keys and cloud credentials in one encrypted vault, and hands each secret to the program, never to the agent. Anything that slips into the output is redacted.
tokenvoy.preai.dev →Prahari
Stops harmful actions before they run, swaps personal data for placeholders before it reaches an AI website, and halts every AI agent at once with one switch.
You are hereLet AI work. Keep control.
Start with a pilot. Then Enterprise.
A pilot runs two weeks on a few machines: one learning, one blocking. Enterprise then covers your fleet, quoted to your scope.
Start here
Pilot
2 weeks
Twenty minutes to set up, fifteen minutes a week to review.
- Week one in learning mode: nothing blocked, everything recorded
- A weekly digest: what would have been stopped, and why
- A counts-only false-positive report you read before you send it
- Clean removal that restores every file it changed
For your organisation
Enterprise
Custom
Seats, platforms and packs to your scope. Contact sales for pricing.
- All fourteen protection modules on Windows, macOS and Linux
- Browser extension, Outlook add-in, model and MCP gateways
- Ready-made packs and the Policy Builder
- Managed lock-down, MDM packages and evidence export
Questions people ask first
Will it break real work on day one?
No. Prahari installs in learning mode: for a week it records what it would have blocked without blocking anything. Review the week, add exceptions for anything that's fine, then switch to blocking. When it does block, the message names the rule and gives you the exact command that allows it, so a false alarm costs ten seconds, not a support ticket.
Does anything go to the cloud?
No. Detection runs on the device, and the record, activity log and scan results stay in each user's own data folder. There is no Prahari server in the path. In a pilot, the only thing we ask for is a counts-only report: no file paths, commands, prompts, hosts or names.
Can the AI agent switch Prahari off?
Not on its own. Prahari's settings, exceptions and hook files are closed to agents, the allow command is blocked when an agent runs it, and blocks that protect Prahari itself offer no allow command at all. Anti-Tamper checks the hooks every ten minutes. An administrator can still switch it off: lock-down stops standard users and makes changes visible.
Which AI tools does it work with?
All the widely used ones. Coding agents in the terminal (Claude Code, Codex, Gemini CLI, Copilot CLI), AI editors (Cursor, Windsurf, VS Code, Cline, Kiro, JetBrains), cloud coding agents (Devin and others), desktop assistants and computer-use agents (Claude Desktop, ChatGPT, Microsoft Copilot, Gemini, Manus), browser agents (Claude in Chrome, Atlas, Comet), AI chat websites, the AI built into Windows and macOS, meeting bots, local models and MCP servers. Anything else runs under prahari run with the same policy. See the coverage table above.
Is it a firewall, or an antivirus?
Neither, and it works alongside both. The watch shows which programs connected where, but only the shield and the gateway block. Prahari is aimed at one thing those tools don't look at: a trusted AI program doing risky things with your permission.
Will it catch everything?
No, and we'd rather say so. Detection is pattern-based, so a new password format or a cleverly disguised instruction can slip through. Rollback is best effort for what a script does inside another program. Prahari is a strong floor, not a guarantee: keep version control and backups.
Do the policy packs make us compliant?
They help you show it. Each pack lists the laws it was written for and tags every decision with the obligations it supports, and the evidence bundle lets an auditor verify the record wasn't edited. The packs are a starting point for your compliance team to review, not legal advice.