For teams running Claude Code, Codex, OpenClaw, and custom agents
Agent identity that can’t be forged. That’s true zero trust.
An agent that never holds a real credential can’t leak one, no matter how it’s compromised. Harbinger sits in front of every agent, bot, and service account as a transparent proxy. It checks policy on every request, then swaps in the real secret from your own vault, but only for the destination that request is actually approved for. Even a fully compromised agent has nothing to steal, and nowhere approved to send it.
Non-human identities already outnumber people 144 to 1 in the average enterprise, driven largely by AI agents, and weak management of them was the root cause in 41% of last year’s identity breaches.1,2 Compromise one, or prompt-inject an agent, and it reads the credential straight out of its own environment.
Harbinger treats every non-human identity as an identity to manage, not a secret to hide.
1. Entro Labs, NHI & Secrets Risk Report H1 2025 · 2. Sophos, State of Identity Security 2026
Point an agent at the gateway and it’s covered. No SDK, no code change, no rewrite, regardless of what it’s built on: Claude Code, Codex, OpenClaw, a custom MCP agent, or anything else you don’t control the source of. Three pieces enforce this independently underneath, so a broad policy can never accidentally grant secret access.
Every agent enrolls with a real mTLS certificate, issued, tracked, and revocable from one place. No shared API keys standing in for identity.
Every request is evaluated against Rego policy before it’s allowed, and secret access is a separate, explicit grant, so approving traffic never implicitly approves credentials.
Secrets are fetched live from your own vault and substituted only for destinations a request is explicitly approved for. Harbinger never stores them. The agent never touches the real value, and a compromised agent can’t redirect one somewhere it wasn’t approved to go.
Every customer gets one fully isolated Harbinger stack, deployed into their own cloud or on-prem environment. Our side of the system is a thin control layer (signup, licensing, software distribution) that never touches your certificates, your policies, or your secrets.
Real-time enforcement, not just visibility into what already went wrong.
Drop-in for existing agent infrastructure, no code change needed.
Self-hosted, so there’s no vendor lock-in on secrets or data residency.
Do I need to change my agent’s code to use Harbinger?
No. Harbinger is a transparent proxy: point your agent’s traffic at the gateway and it’s covered. No SDK, no code change, works on third-party agent frameworks you don’t control.
Does it work with the agent I already run, like Claude Code, Codex, or OpenClaw?
Yes. Harbinger works at the network layer, not the code layer, so it doesn’t matter what your agent is built on. Point Claude Code, Codex, OpenCode, OpenClaw, or any custom agent at the gateway directly, or wrap it with harbinger_agentd if it can’t be pointed at a proxy itself, and its traffic is covered without touching its source.
Does Harbinger store my secrets?
No, never. Secrets are fetched live from your own vault and substituted into the request at the edge. Harbinger never persists a real secret value anywhere.
Is Harbinger self-hosted or a SaaS product?
Self-hosted. Every customer runs a fully isolated Harbinger stack in their own cloud or on-prem environment. We never have access to your certificates, policies, secrets, or traffic.
Which vault providers do you support?
AWS Secrets Manager today. GCP Secret Manager and HashiCorp Vault are on the roadmap; the provider interface is built to add them without changing anything else.
Why is Harbinger’s mTLS-based identity better than other platforms?
Most other platforms, whether it’s a proxy issuing bearer tokens, a pre-shared key the agent presents on every request, or an OIDC or cloud-IAM-issued session token, are still built on a secret that can be copied. If that string leaks from a log, a memory dump, or a compromised host, anyone holding it can impersonate the agent until it’s rotated. Harbinger doesn’t give agents a secret to protect in the first place. Every agent proves its identity with a real TLS client certificate at the network handshake itself, so identity is tied to possession of a private key, not knowledge of a string. There’s nothing for an attacker to steal and replay elsewhere, even from a fully compromised host.
How is this different from other NHI security tools?
Most existing NHI tools are discovery and governance dashboards. They scan your code and cloud for existing credentials and tell you something is risky after the fact.
A newer wave of tools injects a placeholder credential the way Harbinger does, but stops there: a compromised agent can still send that placeholder anywhere. Harbinger checks the destination as well as the credential, so a compromised agent can’t redirect the real secret to an attacker-controlled host. Every request is checked against policy in real time, and the bad request never happens in the first place.
Who is Harbinger for?
Security and platform engineering teams running AI agents, bots, or automation with real access to production systems, the kind of teams tired of a shared, unrotated API key being the only thing standing between an agent and a real breach.
We’re working with a small number of security and platform teams ahead of general availability.
Have questions or want to talk shop? Join our Discord, or check out the code on GitHub.