The agent harness
Agents write it. Gates prove it.
A free CLI for Next.js and Expo apps on Supabase. When a check fails, its hooks send Claude Code back to work.
It writes the project, then holds the agent to it.
initwrites a pnpm monorepo: a Next.js 16 web app and an Expo 57 mobile app on one Supabase backend. Postgres row-level security is the one authorisation boundary for both.- Before the agent’s tool runs, hooks check every shell command, file write and MCP call against 151 guard rules.
- When the agent tries to end its turn, the Stop hook runs the checks and sends it back to work if one fails.
pnpm validateis one chain of 37 gates, run cheapest first. A gate is a check that fails the build, and each one is documented with a proof that it can fail.- CI runs the same chain from a frozen copy of the list, so a project can add a gate but cannot quietly remove one. Gates that need a database skip loudly on a laptop and fail closed in CI.
Why it exists.
AI coding agents write most of our code, and we wanted their work checked by gates, not by asking. That has been the harness’s thesis since its first commit, on 22 July 2026: “quality is a deterministic gate, not a request.”
Row-level security, tested before the work lands.
The Stop hook runs the row-level security tests, in pgTAP and in supabase-js, against a real local Postgres. If no database is running, it fails closed: isolation counts as unproven, and the agent is sent back. CI runs the same tests on every pull request. On 14 October 2026, UpGuard reported 16,326 Supabase databases exposing readable tables.
Source:UpGuard, 14 October 2026
rls-check’s output on sample migrations in a plain repository, 2 November 2026. Outside a harness project, its database checks do not run.One shape, on purpose.
It assumes a pnpm monorepo with a Next.js web app and an Expo mobile app on one Supabase backend. It also assumes Node 22 or newer, Docker for the local database, and Claude Code as the agent. Claude Code runs the hooks that block a turn.
- A web-only app. Not a fit today.
- An existing pnpm monorepo with
apps/weborapps/mobile:initretrofits it and parks its own configs beside yours for review. A repository on npm, yarn or bun is refused. - Another agent. The commit hooks,
pnpm validateand CI still apply, but nothing stops a command before it runs: a violation is caught at the commit or at the pull request.
What it costs to run.
On a GitHub-hosted Linux runner on 2 October 2026, pnpm validate took about 27 seconds warm and 145 seconds cold, and a full Stop hook 54.8 seconds.
What it does not do.
- The database gates are proven on Linux only.
- Rate limiting covers the application layer only, and fails open if its fallback also fails.
- The
e2eemodule ships building blocks, not an encrypted app. - Device tests run nightly and by hand, not on every pull request.
- The guards are tamper-evident, not tamper-proof. A turn that stays red ends after eight blocks in a row, and the harness records it.
What we don’t claim yet.
- It blocks a merge only once you make its
gate-summarycheck required. The installer sets no branch protection. - It maps ASD’s Essential Eight, ASVS 5.0.0, MASVS 2.1 and Annex I of the EU Cyber Resilience Act. These are mappings, not certifications, and it claims no conformance level.
- It has one maintainer and no named successor yet.
Source:the harness’s governance file on GitHub, 11 November 2026
Releases.
28 releases from 1 August to 11 November 2026, on npm since 2 October.
Paid help, when you want it.
The harness is free, under Apache-2.0. The code it writes into your project is Apache-2.0 OR 0BSD, so it carries no attribution requirement. When asked, we move an app into it or bring a project’s security floors up to date, as paid work.