Harden

What is Harden?

Harden Agentic Integrity Foundation is a local, no-account security layer that inspects coding-agent tool calls on your machine and can allow, ask, redact, block, or log them before they execute. It is for developers running Claude Code, Codex, Cursor and similar CLIs against real repos who want a pre-execution gate rather than an after-the-fact audit.

Key features

• Pre-execution check of supported tool calls on the device; decisions are allow, ask for approval, make safe / redact, block, or log only
• Block-and-steer: when it blocks, it can suggest a safer retry (the site's example is blocking `kubectl delete namespace production` and steering to a staging rollout restart)
• Install with `curl -fsSL https://aif.harden.run/install.sh | sh` then `aif configure`; no account and no credit card for the free product
• Native hooks for Claude Code, Codex, Antigravity CLI, Cursor, Kiro, Hermes and OpenClaw, plus an MCP proxy fallback for other tools
• Local decision history and audit view on the device with no retention cap on the free tier; telemetry opt-out
• Free forever for individual developers; Enterprise adds compliance reporting, air-gap / zero-telemetry, MDM install and support SLAs
• Full local model path is macOS Apple Silicon with Metal; CLI and daemon also on macOS or Linux x86_64; Windows is not supported yet
• Published research table on harden.run compares Harden as a pre-execution monitor to a GPT monitor baseline on SLEIGHT, AgentHazard, SABER and LinuxArena — those figures are vendor-reported

Who it's for

• A developer running Claude Code or Codex on a laptop that already has prod kubeconfigs and git push rights, and wants dangerous calls stopped before they execute
• A team standardizing one local gate across several coding agents (Claude Code, Codex, Cursor, Kiro) instead of per-tool allowlists
• Someone who needs a local audit trail of what an agent tried to run, including blocked and redacted calls, without creating a Harden account
• An organization that wants MDM-managed, air-gapped agent security and is evaluating the Enterprise tier

When not to use it

Not for Windows (unsupported). Not a hosted policy gateway or a substitute for an isolated CI sandbox: it runs on the developer machine next to the agent. Machines below 16 GB RAM or without the listed agent versions are outside the published requirements. Do not treat the homepage session counters as live production metrics.

FAQ