Harden

AIF inspects a covered action before it runs, not after the damage is done. That ordering matters. A post-hoc scanner can tell you what went wrong; AIF tries to keep the wrong thing from happening at all. The check produces one of six labels: allow, block, ask, redact, log only, or model error, so you always know what the tool decided. This is the heart of what AI coding agent security should mean.

Not every risky action deserves a hard block. The ask label pauses an action and waits for a person to approve or decline it with the aif review command. This is the middle ground for tasks that look suspicious but might be legitimate, like a deploy step or a database migration an agent wants to trigger.

When an action would expose a protected value, AIF replaces it with a safe placeholder and lets the retry go through. You can see the rewritten command before running it again. Secrets are the worst thing to leak. For teams shipping fast, this is often the difference between catching a leaked key at the terminal and finding it in a public repo.

AIF treats the project directory as a boundary. Commands that reach outside it, like deleting files in a parent folder, get blocked by default. Simple rule. Big payoff. It stops the most common category of agent mistake: acting on paths it never should have touched.

The tool ships with documented setup for Claude Code, Codex, Cursor, Antigravity CLI, Hermes, Kiro, and OpenClaw. Each integration lists version baselines, setup commands, and coverage notes. So you know what's protected. And what isn't. Coverage varies by agent, and the docs don't pretend otherwise.

Every decision is recorded on your machine rather than a remote server. You open the local viewer to read the recorded commands and the reasoning behind each allow, block, or redact. It doubles as an audit trail and a way to tune rules that fire too often.