Launched this week
Harden AIF is a free, local security tool for AI coding agents. Its post-trained model checks tool calls before they run, using your request and session context. It beat frontier models on key agent-security benchmarks, while keeping your repo and tool output on your machine.
Harden
@iamhetpatel Thanks, Het. Great question. That number matters a lot for something that sits on every tool call. We specifically train and evaluate Harden model to keep false positives low. For example, our SLEIGHT evaluation reports TPR at a ≤1% false-positive rate, and LinuxArena is also measured at a 1% step-wise FPR target.
I would love to hear how it behaves in your daily sessions and how many tool calls it ends up blocking for you. You can also refer to this article for more details on the benchmarks and evaluation setup: https://harden.run/blog/aif-research-and-evidence
And of course, happy to answer any other questions you might have.
Hi, i liked that it checks the tool call before it runs, not another approve-everything popup. i mash allow in cursor all the time when i'm moving. not sure if i'd just start ignoring this too if it fires on every small edit.
Harden
@therayess Totally fair concern, Ammar. The goal is to stay quiet on normal edits and only step in when a tool call actually crosses a risky boundary.
We’ve shared more on the research and evidence behind AIF here: https://harden.run/blog/aif-research-and-evidence
And if you run into any issues, feel free to book a call with us. I’d be more than happy to answer questions and help get it set up on your system. It’s completely free for individual developers.
I was just wondering what the plan is regarding how the teams implementing this work in shared repositories and CI pipelines because that’s where all the scary automation takes place.
Harden
@98win10 Great point. Harden's focus on tool calls also has shared repositories and CI pipelines covered, because ultimately managing and checking the shared environments is also done via tool calls.
Does the protection and noticeable delay before tool calls or can developers use it smoothly during fast coding sessions?
Harden
@haolin Thanks for the question, Hao. Harden runs the security checks locally on your system, so it’s designed to work smoothly even during fast coding sessions without relying on a second remote model for every action. Hope this answers your question and we are happy to answer any other questions you might have.
Harden
@hamza_afzal_butt Great question, but it totally depends on the device that you are on, for example on an M5 Pro, The p50 latency is about 2 seconds and p95 latency is about 3.4 seconds. However, this is one thing which we are working on actively right now to push the latency below 500ms.
Paste
"Babysitting caps how much work you can hand off" is such a clean way to put it. I also like that it all stays local, a tool that reads every command is exactly the thing you don't want phoning home. Does the model learn anything from what you approve or reject over time?
Harden
@protsenkoalexandra As of now the model doesn't learn locally but this is a feature that we are working on - based on your long term approve / reject pattern, AIF will be able to actively adapt itself to ensure it runs in the way you expect it to.
Paste
@rishav99 cool :)
Serand
Does Harden work smoothly with different coding agents, or is it mainly optimized for tools like Claude Code right now?
Harden
@maali_baali Hi Maali, Right now, we support 7 AI coding agents, including:
Claude Code
Cursor
Kiro
Codex
Hermes
OpenCLaw
Anti Gravity