Harden - A security layer for AI coding agents
by•
Harden AIF is a free, local security tool for AI coding agents. Its post-trained model checks tool calls before they run, using your request and session context. It beat frontier models on key agent-security benchmarks, while keeping your repo and tool output on your machine.
Replies
Triforce Todos
I like that the agent keeps working after one action gets blocked. A security layer that doesn't constantly interrupt the workflow sounds much better. looking forward to it
Harden
@abod_rehman Exactly, that’s the idea. We wanted the security layer to step in when needed without becoming another blocker for the agent. Really appreciate you checking it out 🙌
Congrats on the launch! Love that it checks agent actions locally before they actually run.. feels like a no brainer for anyone letting coding agents loose on real repos. Upvoted, excited to see where this goes!!
Harden
@vinayak_mishra5 Appreciate that a lot! That’s exactly the use case we had in mind, keeping agents useful without giving them unchecked access to real environments. Thanks for the upvote and support 🙌
I was just wondering what the plan is regarding how the teams implementing this work in shared repositories and CI pipelines because that’s where all the scary automation takes place.
Harden
@98win10 Great point. Harden's focus on tool calls also has shared repositories and CI pipelines covered, because ultimately managing and checking the shared environments is also done via tool calls.
HTTPDump
the intent-boundary check is the part i'd stress test hardest — real tasks drift too, agent finds it needs to touch a file you never mentioned but that's still correct. curious what your false-positive rate looks like on normal work vs the obvious stuff (rm -rf, exfil). that gap is usually where security layers get disabled by day 3, not where they fail the demo.
Harden
@pushpendraw You are absolutely right on this one! However, this is where we have spent the most time designing our product, our post trained model is trained in a way to clearly draw the contrast between dangerous/misaligned and "dangerous looking" but legitimate actions. Therefore, our model is trained to understand drift and block or steer the agent back into the right direction. That being said, this pipeline will keep getting even better quickly!
Youkti
The “nervous parent” analogy is painfully accurate. Giving coding agents more autonomy without giving up control feels like the missing piece.
Harden
@ramana_abhishek Hi Ramana, glad that analogy felt relatable, and that is exactly the feeling we are trying to solve for with Harden.
Serand
Does Harden work smoothly with different coding agents, or is it mainly optimized for tools like Claude Code right now?
Harden
@maali_baali Hi Maali, Right now, we support 7 AI coding agents, including:
Claude Code
Cursor
Kiro
Codex
Hermes
OpenCLaw
Anti Gravity
Dial
Running the security check locally instead of shipping tool calls to a hosted service is the right call for anything touching a real repo. Curious how the post-trained model handles false positives on legitimate but unusual tool calls, like a deploy script that intentionally rewrites env files. Does it lean toward blocking and asking, or does it just log and let the agent proceed?
Harden
@galdayan The false positive rates in our evaluations have been very low, we specifically trained the model to understand the contrast between a harmful call and a call which looks similar in design and style but isn't harmful. However, currently the post trained model works in advisory mode, therefore it only logs but we are shipping fast and the next version will block and provide feedback to the main agent on how to proceed to safely if possible or stop and ask if a safe route is not possible.
A few days in.
Small thing that turned out not to be small. I've stopped flicking back to the terminal to check what my agent is doing. Used to do it constantly. Now I just don't.
Wasn't expecting the main benefit to be "worrying less," but it has actually made me more productive to just focus on the next task.
Harden
@yash_tyagi7 Love this, Yash. “Worrying less” is such an underrated productivity gain. If Harden lets you stay focused on the next task instead of babysitting the agent, that’s exactly the behavior we wanted to enable.
Hi, i liked that it checks the tool call before it runs, not another approve-everything popup. i mash allow in cursor all the time when i'm moving. not sure if i'd just start ignoring this too if it fires on every small edit.
Harden
@therayess Totally fair concern, Ammar. The goal is to stay quiet on normal edits and only step in when a tool call actually crosses a risky boundary.
We’ve shared more on the research and evidence behind AIF here: https://harden.run/blog/aif-research-and-evidence
And if you run into any issues, feel free to book a call with us. I’d be more than happy to answer questions and help get it set up on your system. It’s completely free for individual developers.
Lancepilot