Harden Agentic Integrity Foundation (AIF)

Evidence checked September 12, 2026. Harden’s returned HTML says AIF inspects supported coding-agent tool calls locally before execution. It identifies a separate AI Scanner for release-time attack-path checks and names hardcoded secrets, missing authentication, and uncontrolled egress as example findings. The page says the open-source CLI is free forever; fleet dashboards, approval gates, and compliance reporting use custom enterprise pricing. The pricing route returned the homepage rather than a distinct catalog, and supported-agent boundaries were not fully exposed, so manual verification remains appropriate.

Harden is an AI application security company, and Agentic Integrity Foundation (AIF) is its guardrail layer for coding-agent actions. Vendor metadata says AIF checks supported coding-agent tool calls locally before they run. That timing differs from post-generation scanning: AIF aims to stop an unsafe action at execution time, while a companion scanner examines the application before release.

Verified scope and pricing. Fetched source names hardcoded secrets, missing authentication, and uncontrolled egress as scanner targets. It describes automatic fixes, software bills of materials, audit logs, and deployment through a CLI or web interface. Harden says it is framework-agnostic and supports apps built with Cursor, Bolt, Lovable, Replit, and others. The open-source Harden CLI is advertised as free forever. Fleet dashboards, approval gates, compliance reporting, and other enterprise capabilities use custom pricing.

The homepage and /pricing route returned the same sparse script-oriented document. Exact supported agent versions, policy syntax, deployment architecture, license, and prices need manual verification. Do not infer universal interception from “supported tool calls.” Request a demonstration of shell, editor, MCP, file, network, and deployment actions used in your environment.

Comparison. Agent Security Suite is a broader agent-security comparison. Auth0 handles identity rather than agent intent. NVIDIA NeMo Guardrails controls model interactions, while Promptfoo provides repeatable evaluations and red-team tests. Harden's claimed difference is combining pre-execution controls, scanning, remediation, and release evidence.

Build a disposable repository with a dummy secret, unauthenticated admin route, outbound request to an unapproved domain, safe package install, and destructive command targeting only temporary data. Use no production credentials. Record every allow, block, and approval plus explanation quality. Review every proposed patch, run tests, and rescan the built artifact. Measure detection, false positives, false negatives, approval time, bypass resistance, and developer overhead. Test whether failures default to block or allow and whether logs redact sensitive arguments.

Pre-execution checks are valuable, but use isolated environments, least privilege, branch protection, peer review, dependency and secret scans, and CI tests too. The free CLI lowers evaluation cost. Enterprise adoption should wait for verified compatibility, auditable behavior, safe failure semantics, and a written quote for fleet controls and support.

Procurement checklist. Ask for a supported-agent matrix, operating systems, update cadence, policy examples, offline behavior, and measured overhead per tool call. Verify whether local inspection sends code, command text, diffs, or metadata to Harden services. Enterprise buyers should request role-based access, single sign-on, immutable audit export, retention controls, deployment regions, support targets, and a documented emergency bypass with accountability. Red-team the guardrail itself: renamed binaries, shell aliases, indirect scripts, encoded commands, child processes, symlinks, network tunneling, and agent-created tools. A control is production-ready only when bypass tests, false-positive thresholds, and failure behavior are documented and repeatable.