Harden Review: A Local AI Firewall for Your Coding Agents

What Is Harden?

The project is a local-first AI firewall. Where a traditional firewall guards network traffic, this one guards the actions your coding agent wants to take: running a command, editing a file, or calling a tool. Each covered action is evaluated before it executes, matched against security rules and a local decision model, and then labeled so you can see exactly why it was allowed, blocked, paused, redacted, or recorded. Records live locally in a history you can review, making an agent workflow inspectable rather than a black box.

How the Firewall Decides

The decision vocabulary is small and explicit: Allow, Block, Ask for approval, Redact sensitive content, Log only, or return a Model error. Security rules combine with the on-device model to reach a verdict, and in some paths the tool can rewrite a risky action into a safe variant instead of just refusing. Because every verdict lands in the local history, you can reproduce why an action happened long after the session closed — a property that matters more as agents touch production systems.

• Allow, Block, Ask, Redact, Log only, and Model error decisions
• Security rules plus a local decision model
• Safe alternative actions where supported
• Every verdict recorded in local history

Which Agents It Protects

Coverage follows the integrations the project ships. Claude Code, Codex, Cursor (in both the IDE and the CLI), and Gemini CLI connect directly, while Kiro is protected through a proxy that intercepts subagent MCP calls. OpenClaw and Hermes are handled with a block-and-steer bridge. The dependency to understand is coverage: it can only evaluate actions the integration can observe, so the guarantee is bounded by each agent's documented setup.

• Claude Code, Codex, Cursor, and Gemini CLI
• Kiro via subagent MCP proxy
• OpenClaw and Hermes via block-and-steer bridge
• Coverage is bounded by what each integration can observe

Privacy, Telemetry, and the Local Model

The privacy claim is structural. Evaluation runs locally, so repository context, tool output, and command arguments are not sent to a remote model. While telemetry exists, it is limited to anonymous operational counters — version, operating system, architecture, adapter list, and decision counts — and never code, commands, file paths, or prompts. The payload can be inspected with aif telemetry show, and telemetry can be disabled entirely by setting AIF_NO_TELEMETRY=1. For further detail, the trust and known-limits page is explicit about where coverage starts and ends.

• Local model evaluation; no remote request of your prompts
• Counters only, no code, commands, paths, or prompts
• aif telemetry show prints the exact payload
• Opt out via AIF_NO_TELEMETRY=1

Platform and System Requirements

It runs on macOS (both arm64 and x86_64) and Linux x86_64; Windows is not yet supported. The full on-device model is recommended on Apple Silicon with at least 16 GB of unified memory and about 10 GB of free disk for the initial install, with 24 GB recommended for everyday use and 32 GB when the machine also runs Docker, a large IDE, or browsers. A lighter fallback is available on machines that do not meet the full-model bar, which matters for team laptops and Linux rigs.

• macOS arm64 and x86_64, Linux x86_64
• Windows not yet supported
• Full model: Apple Silicon, 16 GB+ unified memory, ~10 GB disk
• Lighter fallback for smaller machines

Alternatives to Harden

The honest comparison is that most alternatives ship no firewall layer at all. [Claude Code](/tools/claude-code) and [Codeium](/tools/codeium) are the coding agents this project guards rather than peers, and [Sider Code](/tools/sider-code) is another agentic coding assistant without a pre-execution safety layer. If you want guardrails on top of these tools, two paths exist: run an AI firewall like this one, or rely on each agent's own permission prompts — which is exactly the surface the firewall formalizes.

• Claude Code, Codeium, Sider Code — agents guarded, not competing firewalls
• Agent-native permission prompts are the baseline alternative
• A firewall formalizes pre-execution decisions beyond that baseline

Who Should Use It

The product fits three groups cleanly: solo developers who let Claude Code or Codex act on real machines, platform teams tying agent security into a wider policy stack, and security-conscious teams that cannot accept a vendor proxy seeing their code. It is a weaker fit on Windows today, and teams on the lightest hardware will run the fallback model rather than the full one — both are worth checking before you commit.

• Solo developers running coding agents with real machine access
• Platform and security teams standardizing agent policy
• Teams that cannot send code to a vendor proxy

Pricing & Plans

AIF is free forever for individual developers with no credit card and no account. Commercial and enterprise deployments with a managed or self-hosted control plane use custom pricing.

Best For

Recommended use cases and scenarios where Harden shines.

Frequently Asked Questions

Common questions about Harden, answered.