# Harden AIF

> Harden AIF is a local cybersecurity tool that checks every coding agent tool call before it executes, blocking dangerous actions using custom on-device AI models.

Harden AIF (Agentic Integrity Foundation) is a pre-execution security monitor for coding agents, built by an AI safety products company founded by researchers from Google DeepMind, Amazon Alexa, and security operators from Zscaler and CrowdStrike. It runs proprietary cybersecurity-focused LLMs locally on a developer's machine to intercept and judge every tool call a coding agent is about to make — before it executes. No account is required to get started, and the core protection is free for individual developers.

## What It Is

Harden AIF is a coding-agent endpoint security product that sits between a coding agent and the systems it can reach. When a coding agent issues a tool call — such as a shell command, a Kubernetes operation, or a database query — AIF intercepts it, runs it through local AI models and a proprietary code-analysis algorithm, and decides whether to allow, block, redact, ask for approval, or log the action. The product is described by Harden as a "pre-execution monitor" rather than a sandbox or gateway, because it can stop actions that sandboxing cannot — such as an agent deleting a production namespace or exfiltrating credentials through a legitimate tool.

## How the Decision Engine Works

AIF uses a combination of locally-running cybersecurity LLMs and a proprietary feedback-driven inline reference monitor to classify each tool call. The five possible outcomes are:

- **Allow** — the call proceeds normally
- **Block** — the call is stopped and a safe retry may be suggested
- **Redact** — sensitive values are removed before the call executes
- **Ask** — the action is held for human approval
- **Log only** — the call proceeds but is recorded for audit

The homepage demo shows a concrete example: `kubectl rollout status` is allowed, while `kubectl delete namespace production` is blocked with a suggested safe alternative targeting staging instead.

## Benchmark Performance

Harden publishes evaluation results across four agent-security benchmarks, comparing AIF against a GPT monitor baseline. According to Harden's own research page:

- **SLEIGHT**: 15.8% (baseline: GPT-5.5 at 14.3%)
- **AgentHazard**: 83.7% (baseline: GPT-5.5 at 81.4%)
- **SABER**: 48% (baseline: GPT-5.5 at 44.7%)
- **LinuxArena** (lower is better): 29% (baseline: GPT-5 Nano at 34%)

These figures are vendor-published and sourced from Harden's own AIF research blog.

## Supported Agents and Deployment Model

AIF is local-first: it installs on the developer's machine and finds supported coding agents automatically. It uses native hooks for supported agents and falls back to an MCP proxy for others. Supported agents with documented setup and version baselines include Claude Code, Codex, Cursor, Antigravity CLI, Kiro, Hermes, and OpenClaw. Decision history is stored locally on the device with no retention cap.

## System Requirements and Platform Support

AIF has specific hardware requirements due to its on-device model runtime:

- **Full local model**: macOS with Apple Silicon and Metal support
- **CLI and daemon**: macOS or Linux x86_64
- **Memory**: 16 GB minimum, 24 GB recommended
- **Disk**: 15 GB for install, updates, and rollback
- **Windows**: not supported yet

The install path is a single curl command (`curl -fsSL https://aif.harden.run/install.sh | sh`) followed by `aif configure`.

## Why It Matters for Agentic Security

Harden positions AIF in a gap between existing security approaches: MCP gateways can hide credentials but cannot block tool access, and sandboxing protects the local machine but cannot stop an agent from managing cloud infrastructure. The company frames autonomous agent security as a discipline that must evolve independently of frontier LLM providers, arguing that base models — like developers — are incentivized to complete tasks quickly, which can lead to shortcuts or unsafe actions even when instructed otherwise.

## Features
- Pre-execution tool call interception for coding agents
- Local on-device cybersecurity LLM models
- Block, allow, redact, ask, or log-only decisions per tool call
- Native hooks for Claude Code, Codex, Cursor, Antigravity CLI, Kiro, Hermes, OpenClaw
- MCP proxy fallback for unsupported agents
- Local decision history and audit view with no retention cap
- Block-and-steer with safe retry suggestions
- No account or credit card required for free tier
- Telemetry opt-out
- Compliance reporting (enterprise)
- Air-gap / zero-telemetry mode (enterprise)
- Managed installation via MDM (enterprise)

## Integrations
Claude Code, OpenAI Codex, Cursor, Antigravity CLI, Kiro, Hermes, OpenClaw, MCP (Model Context Protocol)

## Platforms
MACOS, LINUX, API, CLI

## Pricing
Freemium — Free tier available with paid upgrades

## Links
- Website: https://harden.run
- Documentation: https://docs.harden.run
- EveryDev.ai: https://www.everydev.ai/tools/harden-aif