What threats does Harpax defend against?

Harpax targets the risks that are specific to AI agentic workflows — the ones where the agent itself, rather than a traditional process, becomes the attack surface. The built-in rule set covers four categories: prompt injection, memory poisoning, skill / MCP threats, and behavioral attack sequences.

1. Prompt injection and jailbreaks

Prompt injection is the OWASP LLM01 risk: an attacker hides instructions in content the model is about to read, and the model follows them instead of (or in addition to) yours. Harpax catches the most common patterns at multiple points — in user prompts, in tool output that's about to be fed back into the model, and in skill definitions themselves.

Rule	Detects	Severity
PI-001	"Ignore previous instructions" and variants	High
PI-002	Developer-mode and DAN-style jailbreak prompts	Critical
PI-003	System-override attempts and prompt-disclosure requests	Critical

2. Memory poisoning

A memory-poisoning attack tries to plant persistent instructions that survive across turns or sessions. Sometimes this looks like a benign-seeming "remember this always…" message; sometimes it's a faked success log designed to make the model think it already completed an action it never ran (the MemoryGraft pattern).

Rule	Detects	Severity
MP-001	Persistent-instruction injection ("from now on always…")	High
MP-002	MemoryGraft pattern: fabricated success claims	Medium

3. Skill and MCP threats

MCP servers ("skills") extend Claude's capabilities — and expand the blast radius if one of them is compromised. Harpax scans skill definitions and hook scripts for known-dangerous patterns, and flags tool calls that match them.

Rule	Detects	Severity
SK-001	Data exfiltration via curl, wget, nc, base64 pipelines	Critical
SK-002	Credential file access (~/.ssh, ~/.aws, ~/.kube, credentials.json)	Critical
SK-003	Permission-bypass flags (dangerouslyDisableSandbox, bypassPermissions, --no-verify)	Critical
SK-004	Prompt injection embedded inside skill definitions	High
SK-005	Dangerous shell patterns: curl | bash, eval, unsafe exec	Critical
SK-006	Persistence via writes to .claude/skills, settings.json, shell profiles	High

4. Behavioral attack sequences

Some attacks are invisible at the level of a single tool call. A whoami is fine; three reconnaissance commands inside thirty seconds followed by an outbound network call is not. Harpax's sequence engine looks at session history to catch multi-step attacks.

Rule	Detects	Severity
credential_exfil.js	Network egress (curl, wget, WebFetch) after a credential exposure earlier in the session	Critical
prompt_stuffing.js	Repeated prompt-injection markers across the last five user prompts	High
recon_sequence.js	Three or more recon commands (whoami, netstat, systeminfo, etc.) in a thirty-second window	High

What Harpax does not catch (today)

Honest answer: AI-agent threats are a moving target, and no single rule set is complete. The current built-in coverage is strongest on the OWASP LLM Top 10 categories and the most common abuse patterns seen in agentic workflows. The following areas are partial coverage today and improve with each release:

• Tier 2 (embedding) and Tier 3 (LLM-review) detections are scaffolded but ship disabled by default. Enabling them broadens semantic coverage but adds latency and external dependencies.
• Supply-chain attacks on MCP servers themselves — a compromised package update, for example — require additional tooling outside Harpax's runtime detection.
• Threats specific to your environment — internal endpoints, custom credential locations, business-logic abuse — need custom JS rules.

How severities map to actions

In active mode, the default severity mapping is:

• Critical → block (hook returns code 2, action does not run)
• High → warn (surfaced in the GUI, action proceeds)
• Medium → log (recorded to session JSONL)

Adjust these per-severity in your config if you want a stricter or looser posture. Passive mode never blocks, regardless of severity.