Skip to content

harnesswatch

Security audit toolkit and research project for AI coding-agent harnesses: the runtime loop (Claude Code, Codex CLI, OpenCode, Cursor, Copilot, Kiro, Goose, Aider and others) that holds credentials, runs shell commands, mounts MCP servers and reads repository-level config.

📄 Read the paper: The Harness Is the Attack Surface: A Security Analysis of AI Coding-Agent Harnesses (2025–2026) (PDF).

What it does:

  • Inventory the harnesses installed on a machine and the harness files in a repository.
  • Audit configs, MCP declarations, instruction files and CI workflows, offline and read-only.
  • Observe a harness black-box in a sandbox: hosts contacted, files written, prompts shown.
  • Bench inert canary prompt-injection scenarios across harnesses.
  • Report in Rich, JSON, Markdown or SARIF.

Start with the quickstart. Rules are listed in the rule reference, and the threat taxonomy explains what they map to.

Status

Pre-0.1.0. The project is under construction; see MISSION.md and PROGRESS.md in the repository.