The runtime boundary for agentic development

Ship code.
Not secrets.

SecretHarbor gives your coding agent everything it needs to move fast—and nothing it needs to become a security incident.

Enter the safe port ↘ ↓ Watch the boundary
ONE-LINE INSTALL
$ curl -fsSL https://secretharbor.dev/install.sh | sh
Developer Beta macOS + Linux Windows preview
REAL CREDENTIALS✦ SYNTHETIC SECRETS✦ HUMAN CONTROL✦ LOCAL AUDIT✦ AGENT AGNOSTIC✦ KERNEL BOUNDARY
01 The premise

Most security for agents is a promise.
This is a place.

Your agent is powerful because it can touch the whole system. SecretHarbor makes that power safe by giving it a projected world instead of your actual one.

See how the harbor works ↘
THE SAME PROJECT / TWO VIEWS LIVE
A YOUR WORKSTATION TRUSTED
Real values
DATABASE_URLpostgresql://prod_admin:••••••••@aws.rds:5432/appALLOW
STRIPE_KEYsk_live_51Oz••••••••••••••••94F1ALLOW
SSH_AUTH_SOCK/var/run/ssh-agent.sockALLOW
Human capabilities are preserved
B AGENT PROCESS UNTRUSTED
Synthetic values
DATABASE_URLpostgresql://fake_agent:shb_sync@127.0.0.1:5432/testFAKE
STRIPE_KEYsk_test_shb_fake_mocked••••••••FAKE
SSH_AUTH_SOCK[Blocked by SecretHarbor]DENY
Real values never enter the process
SECRET HARBOR / CAPABILITY PROJECTION
02 The boundary

Not a wrapper.
A lower layer.

The agent controls its work. It does not control its security boundary. SecretHarbor intercepts capabilities at the OS and process layers, then follows every child process through the tree.

THE AGENT IS INSIDE THE SYSTEM. THE SYSTEM IS STILL YOURS.
PROCESS TREE / SESSION 7F2ABOUNDARY ACTIVE
DATA PLANE
◈ claude agent
⌘MCP serverchild
›_bun testchild
◌subprocessdescendant
SECRETHARBOR / KERNEL SECURITY BOUNDARY
CONTROL PLANE
FILESVIRTUALIZED
ENVSANITIZED
IPCINTERCEPTED
REAL SECRETSHUMAN-ONLY
RUN A SESSION READY
One command.Everywhere below.
$ shb run -- claude ▋
LAUNCH ENFORCE RESTORE
REAL SECRETS0 in agent
FAKES ISSUED03 format-safe
CHILDREN04 in boundary
03 The control plane

Quietly powerful.
Deliberately explainable.

The safety layer should not be another black box. Every decision has a reason, every capability has a name, and every boundary can be inspected.

◇01 / VIRTUALIZE↗

Real for you.
Synthetic for agents.

Keep the normal file shape and developer workflow. Change what the agent receives.

ALLOW→FAKE / DENY
⌘02 / ISOLATE↗

Protection that
travels downward.

Children, grandchildren, MCP servers, and task runners inherit the boundary — but only if the root process was started from the terminal under shb run.

TERMINAL LAUNCH→FULL TREE PROTECTED
≋03 / SANITIZE↗

Strip the
ambient power.

Secrets and privileged local endpoints are faked or removed before the agent begins.

HOST ENV→SAFE ENV
⌁04 / CONTROL↗

Network access
on your terms.

Allow, restrict, or deny destinations. Capability use stays explicit and auditable.

REQUEST→APPROVAL
▣05 / GATE↗

Powerful tools
need a human.

Docker and local services can be leased briefly instead of exposed without limits.

REQUEST→LEASE
✚06 / PROVE↗

Adversarial by
default.

Run the attacks yourself. Eighteen live vectors show pass, fail, limited, and not tested.

ASK→shb doctor
04 Policy, not vibes

Ask what happens
to a file.

Policy is a product surface. Explore a few examples, then run the same command against your own project.

RESOURCE POLICY INSPECTOR
secretharbor / policy explain ● EVALUATED
you@harbor:~/project $ shb policy explain .env
MATCHED RULE built-in secret pattern
AGENT READFAKEsynthetic
AGENT WRITEDENYshadow synced
AGENT DELETEDENYblocked
HUMANALLOWunchanged

Sensitive project files are virtualized with synthetic values so normal development tools keep working.

05 Know your posture

Trust the
inspection.

Security claims should be measurable. SecretHarbor exposes what passed, what failed, and what the current platform could not test.

Run your own audit ↘
SHB DOCTOR / LAST RUN POSTURE READY
18 VECTORS
Adversarial
coverage.

Direct reads. Python & Node interpreters. Symlinks. Path traversal. Copy & rename tricks. ptrace & core dumps. Network egress. Filesystem escape. Policy tampering.

✓Direct secret accessPASS
✓Process-tree inheritancePASS
~Platform-specific limitsLIMITED
✓Tamper-proof sandboxPASS
LOCAL AUDIT / NO PRODUCT TELEMETRY
$ shb doctor
06 Start protected

Make your next
agent session safe.

DEVELOPER BETA Verified Pre-Compiled Release Packages

SecretHarbor is currently in active beta development. Pre-compiled binaries for macOS, Linux, and Windows are distributed via GitHub Releases and installed only after SHA-256 checksum verification.

Install once. Initialize in your project. Keep the commands you already know.

⌁ No product telemetry. Local audit logs only.
INSTALL SECRETHARBOR 
curl -fsSL https://secretharbor.dev/install.sh | sh
shb init
THEN LAUNCH FROM YOUR TERMINAL
claudecodexgeminicursor .
! Protective by default. shb guard off intentionally disables the guard.
⌁ Desktop apps opened directly are not protected. Launch them from the terminal (cursor ., open -a Cursor .) so they inherit the SecretHarbor boundary set by shb run.
07 The fine print

Good questions
make better boundaries.

Here are the details that matter when you put a security layer between an agent and your work.

Does SecretHarbor replace my .env?+

No. On macOS it runs inside an ephemeral shadow workspace and on Linux inside a mount namespace, so familiar tools still read a .env file — but the real file on disk is never modified. The agent sees format-preserving synthetic values, while your editor, shell, and test runners keep the real ones.

Can an agent read my real secrets?+

In fake mode, it receives synthetic, format-preserving values. In deny mode, it receives no value. The real value never enters the agent memory space or execution environment.

Can it use Docker?+

Standard mode intercepts common Docker and Podman sockets, asks for human approval, and can grant a short-lived capability lease instead of handing over unrestricted root socket access.

Can it protect an already-running agent?+

Existing processes cannot be retroactively sandboxed. Use shb adopt or shb restart to move an existing agent into a fresh protected session.

Is SecretHarbor agent-agnostic?+

Yes. Integrations and shims make common agents convenient (Claude Code, Gemini CLI, Cursor, OpenAI Codex), but the security boundary is the OS runtime beneath them, not a system prompt inside any one agent.

Does it protect Cursor, VS Code, or other GUI apps?+

Only if you launch them from the terminal. A desktop app opened by double-clicking, via Spotlight, or from the Dock starts outside the shb run process tree and receives no protection — even if shb is installed.

To bring Cursor inside the boundary: shb run -- cursor . — or just cursor . from a shell after shb init. Every child process, including the agent running inside the IDE, inherits the full kernel security boundary automatically.