Harpax is a security and governance runtime for AI agents. It sits between you and Claude Code, watching every action your agent takes — the tools it calls, the commands it runs, the files it reads, the prompts it receives — and stops the ones that look dangerous before they execute.
The problem Harpax solves
Modern AI agents are powerful because they can act on your behalf: run shell commands, read your files, fetch URLs, install packages. That same capability is what makes them risky. A single injected instruction in a webpage, a tampered MCP skill, or a stray prompt can turn an agent that was helping you debug into one that exfiltrates credentials, modifies your shell profile, or makes outbound network calls you never asked for.
Most existing tooling for AI agents trusts the model to behave. Harpax assumes the opposite — that any tool call could be the wrong one — and verifies each action against a layered detection pipeline before letting it run.
What Harpax actually does
Three things, continuously, while your Claude Code session is running:
1. Observes
Harpax captures every event in a Claude Code session through three channels: the hook system (synchronous tool-call interception), an I/O tee (the conversation stream), and an event stream (token usage, model selection, session lifecycle). Together these give Harpax full visibility into what the agent is doing, what it saw, and what it's about to do next.
2. Decides
Every captured event runs through a multi-tier detection pipeline. Fast regex rules catch known-bad patterns — credential exposure, prompt injection, jailbreak attempts, recon commands. Sequence rules catch multi-step attacks that no single event would reveal (for example, a credential read followed by an outbound curl). Higher tiers using embeddings and LLM review are available for ambiguous cases.
3. Enforces
When a high-severity detection fires, Harpax blocks the tool call before it executes. You see a toast in the live monitor and can Allow Once, Always Allow, or Deny. If you don't decide within 30 seconds, the action is denied automatically — safe by default.
How it runs on your machine
Harpax is a desktop application. A small Go daemon runs locally and listens on three loopback ports (the WebSocket bridge, the IPC channel for hook verdicts, and an MCP server for re-injecting allowed actions). A Tauri-based GUI gives you the live monitor, session history, rules editor, and skill scanner.
Sessions are stored as JSONL on disk under ~/.harpax/sessions, with configurable retention. Nothing leaves your machine unless you wire up a webhook or enable an external LLM tier yourself.
Harpax runs entirely on your device. There is no required cloud account, no telemetry pipeline, and no shared state between users.
What Harpax is not
- Not a model. Harpax doesn't generate text or replace Claude. It observes the model your agent is already using.
- Not an antivirus. Harpax is scoped to AI agent activity inside Claude Code sessions, not arbitrary processes on your machine.
- Not an audit-only tool. Active mode blocks; passive mode logs. You choose the posture.
Who Harpax is for
- Developers giving Claude Code access to production-adjacent systems
- Security teams writing detection rules for agentic workflows
- Researchers studying agent behavior and attack surfaces
- Anyone running long-lived agent sessions on machines that matter