The Security Harness for AI Agents

Claude Code, Cursor, Claude Desktop, ChatGPT, agents you build, and the agents in your browsers: Medusa wraps the environment your team already uses. One policy across every tool call, model request and browser action. One signed receipt chain per endpoint. Evidence an auditor can verify.

Deploy Medusa Read the Setup Guide

$ npm i -g @medusasec/harness$ medusa setup --org-key sk-med_… # enrolls, wraps every agent, installs the service

Runs on the endpoint. Nothing routes through our cloud. Prompt text and file contents never leave the device; receipts commit to actor, tool, verdict and hashes only.

6 seams

browser, agent hooks, MCP stdio, MCP HTTP, model APIs, GUI apps

1 command

onboards a whole machine, MDM-ready

Signed

hash-chained receipt for every action

☍

Every seam, one gate

An agent reaches the world through a handful of doorways: its own shell and file tools, MCP tools over stdio and HTTP, model APIs from the terminal or from a GUI app, the browser, and the code you write yourself. Medusa puts the same gate in each one, so a rule holds no matter which path the agent takes.

Agent hooksMCP stdioMCP HTTP / SSEModel APIsGUI appsBrowserSDK

⚖

Wraps what you already run

Not another agent, not another IDE. One command rewrites the MCP configs it finds, routes model calls through a local proxy, and installs a service that keeps it up. Your team keeps its tools.

✓ Claude Code, Cursor, Windsurf, VS Code
✓ Claude Desktop, the ChatGPT app
✓ Claude in Chrome, ChatGPT in the browser
✓ Custom agents via the SDK

☉

Policy with approvals, not just logs

Protected paths, workspace confinement, blocked servers and tools, argument rules, rate limits, model allowlists and daily budgets. A tool result that smells like prompt injection taints the session, and later writes need an administrator. Blocks answer the agent with coaching, so it corrects course instead of retrying.

TOOL × SERVER × ARGS | ALLOW · COACH · APPROVE · DENY

☷

Signed receipts, mapped to controls

Every tool call, model request and browser action goes into a per-endpoint hash chain signed with a key that never leaves the machine. The control plane verifies chains nightly, attests them, and exports an evidence pack mapped to SOC 2, NIST AI RMF, ISO 42001 and the EU AI Act. Receipts carry actor, seam, tool, verdict and hashes. Never prompt text.

seq 418f1c2a…verified

seq 42d04e77…verified

seq 433b9a10…verified

On-device DLP on arguments, results and prompts

The same detectors run in the browser extension and inside the harness. They scan what an agent sends to a tool, what the tool sends back, and what goes to a model, before it leaves the machine. Per-category policy, approvals, and nothing shipped anywhere to be scanned.

SecretsPIIFinancialHealth / PHISource codeInsurancePrompt injection

Private by architecture

Your data never leaves the device

Most AI-security tools are cloud proxies: every prompt, every tool argument and every result your team produces is routed through a vendor to be inspected. Medusa does not do that. The detectors, the policy decision and the receipt signature all happen on the endpoint. What reaches the control plane is the verdict, the hashes and the metadata needed to verify them.

✓
On-device inference
The detection model runs in the browser for the extension and inside the harness process for tools and models. Nothing is shipped to a server for inspection.
✓
Text-free attribution
In the browser, the input fingerprint uses pointer pressure, movement trail and how text was inserted. It never records what was typed. At the tool and model seams, the actor is the process and the OS user.
✓
Receipts without prompt text
The signing key is generated on the endpoint and never leaves it. Receipts commit to actor, seam, tool, verdict and content hashes only.
✓
No cloud in the path
Enforcement runs on the endpoint. The optional GUI-app proxy is local-only, inspects just the model API hosts, and tunnels everything else untouched.
✓
You control the data
Self-host the entire stack on your own infrastructure, or run it fully air-gapped.

Your endpoint

Cursor calls write_file on the filesystem servergating

actor: Cursor · MCP stdio→Medusa gate→SECRET in args · held for approval

Policy, detection and the signed receipt all happen here, on the device. The tool never receives the call.

× never sent to a cloud

Vendor cloud / proxy

what other tools do

One dashboard for every seam

Every tool call, model request and browser action across your org, with the doorway it came through and who produced it: a person, a named agent, or automation.

Live tool calls and model requests

13 ENDPOINTS · 5 SEAMS · 4 AGENTS ONLINE

Timestamp	Endpoint	Actor	Seam	Tool / model	Verdict	Category
14:22:01.392	dev-mbp-04	Claude Code	MCP stdio	github · create_issue	BLOCKED	SECRET
14:21:58.210	design-mbp-07	Cursor app	Model API (GUI)	anthropic · claude-sonnet	LOGGED · RECEIPT #1042	NONE
14:21:55.101	MacBook-Air.local	Claude in Chrome	Browser	chatgpt.com · file upload	HELD FOR APPROVAL	PII
14:21:49.877	win-eng-12	Automation (SDK)	SDK	send_email	READ-ONLY · SESSION TAINTED	PROMPT INJECTION

Ready to govern every agent your team runs?

One command per machine, or one MDM profile per fleet. Every tool call, model request and browser action gated by the same policy, with approvals, on-device DLP and signed receipts, all from one dashboard.

Get Started Read the Docs

SAML SSO & RBACMDM rolloutSIEM exportSelf-host / air-gap