Risky harness settings
Bypass and never-ask modes, disabled sandboxes and disabled hooks, with the scope (user, project, managed) that set them.
Free assessment
Find risky agent settings in one local scan.
guard scan reads the AI harnesses configured on a machine and reports risky settings, rules, memory, skill and hook files per harness and scope. It runs locally: no account, nothing uploaded.
What the scan checks
Configuration risk, before it becomes runtime risk.
Static, heuristic checks: a finding shows risk, not that anything was attacked or leaked, and a clean scan is not proof the machine is safe.
Broad allow rules
Permission rules that let an agent run far more than it needs to.
Secrets in rules and skills
Text that matches secret patterns in the rule, memory and skill files every session reads.
Possible hidden instructions
Invisible characters, HTML comments and override phrasing in rules and skills that a reviewer would not see at a glance.
Assessment Hub
From a single scan to an organization-wide report.
The Assessment Hub turns evidence from one device, or from all of them, into reports you can act on. Each report is versioned and keeps its checks, evidence and limitations.
- Local and self-hosted modes that keep data inside your environment
- Optional Cloud upload that shows exactly what leaves the device
- No secret values, raw prompts or unhashed private paths in default reports
- Versioned JSON and accessible HTML/PDF with a limitations appendix
- A fixed statement in every report that findings show risk, not exploitation
Your agents already have access. Ward off the risks.
Join Guard early access for your team, or run the free local scan today. Agents in automation too? Add the open-source Rune Box.