Harden - A security layer for AI coding agents
by•
Harden AIF is a free, local security tool for AI coding agents. Its post-trained model checks tool calls before they run, using your request and session context. It beat frontier models on key agent-security benchmarks, while keeping your repo and tool output on your machine.
Replies
Running the security check locally instead of shipping tool calls to a hosted service is the right call for anything touching a real repo. Curious how the post-trained model handles false positives on legitimate but unusual tool calls, like a deploy script that intentionally rewrites env files. Does it lean toward blocking and asking, or does it just log and let the agent proceed?
@galdayan The false positive rates in our evaluations have been very low, we specifically trained the model to understand the contrast between a harmful call and a call which looks similar in design and style but isn't harmful. However, currently the post trained model works in advisory mode, therefore it only logs but we are shipping fast and the next version will block and provide feedback to the main agent on how to proceed to safely if possible or stop and ask if a safe route is not possible.
A few days in.
Small thing that turned out not to be small. I've stopped flicking back to the terminal to check what my agent is doing. Used to do it constantly. Now I just don't.
Wasn't expecting the main benefit to be "worrying less," but it has actually made me more productive to just focus on the next task.
@yash_tyagi7 Love this, Yash. “Worrying less” is such an underrated productivity gain. If Harden lets you stay focused on the next task instead of babysitting the agent, that’s exactly the behavior we wanted to enable.
Hi, i liked that it checks the tool call before it runs, not another approve-everything popup. i mash allow in cursor all the time when i'm moving. not sure if i'd just start ignoring this too if it fires on every small edit.
@therayess Totally fair concern, Ammar. The goal is to stay quiet on normal edits and only step in when a tool call actually crosses a risky boundary.
We’ve shared more on the research and evidence behind AIF here: https://harden.run/blog/aif-research-and-evidence
And if you run into any issues, feel free to book a call with us. I’d be more than happy to answer questions and help get it set up on your system. It’s completely free for individual developers.
This looks really useful for keeping coding agents safe.
Nice to see it works in the background without adding extra work.
@renu_rani Thanks, Renu! AIF stays in the background, checks actions before they run, and keeps the workflow moving without constant interruptions.