Prisma AIRS Integrations
Process-driven implementation guides for embedding Prisma AIRS AI Runtime Security into third-party platforms
Prisma AIRS provides inline security for AI applications, scanning prompts, responses, and tool interactions in real time. It detects threats like prompt injection, sensitive data exposure, malicious URLs, and toxic content before they impact your AI workflows.
These guides cover the end-to-end process for integrating AIRS into each platform, from prerequisites and credential setup through configuration, verification, and production hardening. Each guide is self-contained: follow it start to finish and you'll have a working, validated integration.
Every integration requires an active Prisma AIRS license, a configured Security Profile in Strata Cloud Manager, and a generated API Key. The AIRS API Intercept guide walks through this setup in detail; complete it first if you haven't already.
Protect AI coding assistants by scanning prompts, tool calls, and responses before they execute. AIRS hooks intercept traffic at the assistant's lifecycle events, blocking prompt injection, data exfiltration, and malicious code before it reaches the model or your codebase.
Anthropic Claude Code
Three integration methods for Claude Code: shell hooks for lifecycle interception, an MCP server for bidirectional scanning, and a Claude Code skill for on-demand security checks. Hooks provide the broadest coverage: prompt, pre-tool, and post-tool scanning.
OpenAI Codex CLI
Hooks-based integration for OpenAI Codex CLI. Scans prompts, bash commands, MCP tool inputs/outputs, and post-stream final responses with fail-closed enforcement.
Cline, Cursor & Windsurf
Hooks-based integrations for VS Code and IDE-native AI coding assistants. Each uses the platform's hook system to intercept prompts and tool calls with AIRS scanning. Covers Cline (VS Code extension), Cursor (IDE), and Windsurf (IDE).
AI gateways and LLM proxies sit between your application and the model provider, making them the ideal enforcement point for AIRS scanning. Configure AIRS as a guardrail to scan all prompts and responses flowing through the gateway (no application code changes required).
LiteLLM Proxy
Native guardrails integration for LiteLLM Proxy. AIRS scans prompts pre-call or during-call, responses post-call, and MCP tool inputs pre-execution. Configuration-only: add a guardrail block to your config.yaml.
TrueFoundry AI Gateway
Middleware integration for TrueFoundry AI Gateway. AIRS scans prompts and responses with partial streaming support.
Enterprise API gateways already manage authentication, rate limiting, and routing for your APIs. Adding AIRS as a policy or plugin extends that governance to AI traffic, scanning LLM prompts and responses at the gateway layer before they reach downstream services.
Kong Gateway
Three integration options: a custom Lua plugin (v1) for LLM-only traffic with full AI Gateway multi-provider support, an MCP-aware v2 plugin that also inspects tool calls and buffered SSE streams, and a Kong Konnect SaaS request callout for prompt-only scanning.
Microsoft Azure API Management
Policy fragment for Azure API Management configured as an AI Gateway. Dual-layer security scanning of prompts and responses using APIM's send-request policy to call the AIRS API inline.
Google Apigee
API proxy and SharedFlow integration for Google Apigee. Scans prompts and responses for Vertex AI and other LLM backends using Apigee's service callout policies.
Shift-left AI security into your CI/CD pipelines and automation workflows. Scan AI model files for supply chain threats before deployment, or embed AIRS checks into workflow automation platforms to protect AI-powered business processes.
GitHub Actions
Pre-deployment model file scanning using Prisma AIRS Model Security in GitHub Actions workflows. Detects malicious models, backdoors, and supply chain risks at the CI layer before models reach production.
Jenkins Pipeline
Declarative pipeline integration for Jenkins. Scans AI model files using AIRS Model Security as a pipeline stage, gating deployment on scan results.
n8n Workflow Automation
Workflow node integration for n8n. Embed AIRS prompt and response scanning into AI-powered automation workflows using n8n's HTTP request nodes.
Coverage Matrix
Each integration supports different scanning phases depending on the platform's extensibility model. Use this matrix to compare coverage across integrations.
| Integration | Category | Prompt | Response | Streaming | Pre-tool | Post-tool |
|---|---|---|---|---|---|---|
| Claude Code (Hooks) | Coding Assistant | ✓ | — | — | ✓ | ✓ |
| Claude Code (MCP) | Coding Assistant | ✓ | ✓ | — | — | — |
| OpenAI Codex CLI | Coding Assistant | ✓ | ⚠ | — | ✓ | ✓ |
| Cline | Coding Assistant | ✓ | — | — | ✓ | ✓ |
| Cursor | Coding Assistant | ✓ | — | — | ✓ | ✓ |
| Windsurf | Coding Assistant | ✓ | — | — | ✓ | ⚠ |
| LiteLLM | AI Gateway | ✓ | ✓ | ⚠ | ✓ | — |
| TrueFoundry | AI Gateway | ✓ | ✓ | ⚠ | — | — |
| Kong (v1) | API Gateway | ✓ | ✓ | — | — | — |
| Kong (v2 — MCP) | API Gateway | ✓ | ✓ | ✓ | ✓ | ✓ |
| Azure APIM | API Gateway | ✓ | ✓ | — | — | — |
| Google Apigee | API Gateway | ✓ | ✓ | — | — | — |
| GitHub Actions | CI/CD | Model Security (pre-deployment file scanning) | ||||
| Jenkins | CI/CD | Model Security (pre-deployment file scanning) | ||||
| n8n | Automation | ✓ | ✓ | — | — | — |
- ✓ Full support
- ⚠ Partial or conditional support — see individual guide for details
- — Not supported by this integration
Key Concepts
Inline security that scans AI traffic in real time. AIRS detects prompt injection, data leakage, malicious code, malicious URLs, and policy violations. It operates on three content types:
- prompt — user input before it reaches the model
- response — model output before it reaches the user
- tool_event — tool/function call inputs and outputs (used by MCP-aware integrations)
The management interface for configuring Prisma AIRS. Used to:
- Activate your AIRS license
- Create deployment profiles (regional endpoint configuration)
- Create security profiles (detection rules and actions — block, allow, alert)
- Generate API keys for authenticating scan requests
AIRS API endpoints are region-specific. Use the endpoint matching your deployment profile region for lower latency and data residency compliance:
| Region | Endpoint |
|---|---|
| US | https://service.api.aisecurity.paloaltonetworks.com |
| EU (Germany) | https://service-de.api.aisecurity.paloaltonetworks.com |
| India | https://service-in.api.aisecurity.paloaltonetworks.com |
| Singapore | https://service-sg.api.aisecurity.paloaltonetworks.com |