Harden's Agentic Integrity Foundation places a security check between a coding agent and the tool call it wants to execute. The check considers the developer's request, the proposed action and earlier session events. A command that was safe before an account or deployment target changed may no longer be authorized.
The system combines explicit rules with a local language model for decisions that depend on context. Its examples include blocking a production deployment after the user approved only staging, and stopping a log upload that would send information to an external destination. Supported calls can be allowed, rewritten or blocked.
Harden reports an 83.7% first-harm catch rate on its AgentHazard replay, compared with 81.4% for its GPT-5.5 monitor baseline. On a reconstructed SLEIGHT pre-tool-call test, Harden reports 15.8% detection at a 1% false-positive-rate target. That is not SLEIGHT's official completed-transcript score, and both comparisons come from Harden's own evaluation.
The full local model currently requires an Apple Silicon Mac with at least 16 GB of unified memory. Linux support for the CLI does not mean the full local model runs on Linux.