Harden

Harden's Agentic Integrity Foundation (AIF) is a free, local security tool for AI coding agents. It runs on your own device, judges every action a coding agent is about to take, and stops the dangerous ones before they execute. The product installs with a single local command — curl -fsSL https://aif.harden.run/install.sh | sh followed by aif configure — and needs no account to get started. Supported tool calls are checked locally before they run, so the agent's request and session context are evaluated on your machine rather than in the cloud. Harden describes itself as an AI safety products company building guardrails for the dark software factory, and AIF is its coding-agent endpoint security product, aimed at individual developers who use coding agents and at organizations that later need shared controls and enterprise deployment. Coding agents can reach the same systems developers can. MCP gateways can hide raw credentials, but they do not block tool access. Sandboxing protects the local machine, but it cannot stop an agent from managing a database or a VM. Harden also argues that base models, just like developers, are incentivized to solve tasks in the minimum possible time and cost, so they end up taking shortcuts or executing bad actions even when they have been told to follow laws and rules. The site points to the myriad cybersecurity breaches reported by frontier labs and press reports about Openclaw and Hermes as evidence of this risk. Harden's stated position is that, just as traditional cybersecurity operates separately from product development due to conflicting incentives, autonomous agent security and control will evolve outside of the frontier LLM providers. Analyzing every supported tool call before it executes is the gap AIF is built to fill. Harden can allow an action, ask for approval, make it safe, block it, or record it. In the protection activity view these outcomes appear as Block, Ask, Redact (made safe), Allow, and Log only. In the published example activity, 34,222 tool calls were checked before execution across 7 sessions: AIF allowed 33,382 calls, logged 256, and changed or stopped 584, with 415 blocked for review, 169 made safe for inspection, and 33,382 allowed to proceed. The monitor is built as a block-and-steer system, meaning that when a dangerous command is stopped Harden can offer a safe retry. In the example on the site, a routine command — kubectl rollout status deployment/payments-api -n production — was allowed and recorded locally, while kubectl delete namespace production was blocked with the message "production is protected", followed by a safe retry: kubectl rollout restart deployment/payments-api -n staging. Harden works with the agents you already use. One local setup finds supported coding agents on your machine and checks their tool calls before they act, using native hooks for supported coding agents and an MCP proxy fallback for other tools, with a local decision history kept on your device. The currently listed agents are Claude Code, Codex, Antigravity CLI, Cursor, Kiro, Hermes, and OpenClaw. The activity table on the site shows each of these connected to a different project workspace — harden-platform, agent-workspace, payments-agent, web-client, service-api, harden-docs, and release-tools — each with its own set of checked, blocked, made-safe and logged calls. Version details are published too: Claude Code 2.1.241, Codex 0.146.1, Antigravity CLI Latest CLI, Cursor 2026.08.11-e8db854, Kiro 2.19.1, Hermes 0.19.0, and OpenClaw 2026.7.1-2, with compatibility rechecked on every AIF or supported-agent release. Harden is presented as a local monitor tested against frontier models. It is evaluated as a pre-execution monitor across four agent-security benchmarks and reports beating the GPT monitor baseline on each: SLEIGHT at 15.8% versus 14.3%, AgentHazard at 83.7% versus 81.4%, SABER at 48% versus 44.7%, and LinuxArena at 29% versus 34% where lower is better. The stated baselines are GPT-5.5 for SLEIGHT, AgentHazard and SABER, and GPT-5 Nano for LinuxArena, with benchmark-specific measures detailed in the research. The underlying models are proprietary: Harden's custom cybersecurity models run on your devices, and per the FAQ, proprietary cybersecurity-focused LLMs run locally and privately on every developer's laptop alongside a proprietary code-analysis algorithm for feedback-driven placement of dynamic inline reference monitors. Because processing is local, the repo and tool output can stay on the machine. Overall, AIF is a local pre-execution monitor. It installs with one command, is configured with aif configure, and then connects to the coding agents the developer already uses. From that point on, supported tool calls are intercepted — through native hooks where available and through an MCP proxy fallback for other tools — and checked before they execute, using the request and session context. The decision is made on the local machine by a post-trained model, and the outcome is recorded in a local decision store with an audit view and no retention cap. Harden's stated core proprietary IP combines those cybersecurity-focused LLMs with a code-analysis algorithm for feedback-driven placement of dynamic inline reference monitors, which determines where monitoring is applied within the agent's workflow. Users gain protection without changing their agent workflow: run one local setup, and the agents already in use are discovered and checked. The free tier covers core pre-execution secret-flow blocking on the machine forever, block-and-steer with safe retry, a local decision store and audit view with no retention cap, no account required, and telemetry opt-out. Keeping decisions local means the repository and tool output do not need to leave the device, which matters for teams working with sensitive code. Logos and memberships shown on the site include Randstad, CALDIC, Relfast Solutions, the Coalition for Secure AI, and the Financial Institution Insurance Council. Harden states that AIF beat frontier models on key agent-security benchmarks while keeping the repo and tool output on the machine. Concrete scenarios appear directly in the content. An agent working in ~/payments-api runs kubectl rollout status deployment/payments-api -n production; Harden allows it and records it locally. The same agent then attempts kubectl delete namespace production; Harden blocks it because production is protected and offers a safe retry that restarts the deployment in staging instead. Across connected agents, sessions such as harden-platform with Codex, agent-workspace with Claude Code, or release-tools with OpenClaw accumulate thousands of checked calls, with blocked and made-safe actions routed for review or inspection. Organizations that need more than individual protection can add shared controls and enterprise deployment, including compliance reporting, air-gap / zero-telemetry mode, managed installation via MDM, support SLAs, and custom terms. Developers who want the evidence behind the tool can read the AIF blog or watch the YouTube playlist. AIF is described as free for individual developers and supported on macOS and Linux; the free tier requires no account and no credit card. System requirements are published: a full local model needs macOS with Apple Silicon and Metal, the CLI and daemon run on macOS or Linux x86_64, 16 GB of memory is the minimum with 24 GB recommended, 15 GB of free disk is required for install, updates and rollback, and Windows is not supported yet. Getting started means installing the free product, running aif configure, and connecting the coding agents you use, with a call available for help. On pricing, Harden says protection starts free on your machine and that you add shared controls and enterprise deployment when your organization needs them. The free tier works with Claude Code, Codex, Cursor, Antigravity CLI and Kiro, while the enterprise tier adds compliance reporting, air-gap / zero-telemetry mode, managed installation via MDM, support SLAs, and custom terms. The company is built by AI researchers and security operators, with team background spanning Google DeepMind, MILA, WhatsApp, Zscaler, Oracle, Microsoft, Amazon, CrowdStrike, and Sony. The takeaway Harden puts forward is simple: let the agents run, but control what they do. By checking supported coding-agent tool calls locally before execution and blocking or making safe the dangerous ones, AIF gives developers a free, private guardrail that sits alongside the agents they already use — with optional shared controls and enterprise deployment when an organization needs them.