Alternatives
Products that do what Protect Your CI/CD from SolarWinds-Type Attacks with This Agent does
Hello HN, my name is Varun, and I am the co-founder of StepSecurity. Here is the backstory about Harden-Runner. We thoroughly researched past software supply chain security incidents. The devastating breaches of SolarWinds, Codecov, and others, have one thing in common – they attacked the CI/ CD pipeline or the build server. These incidents made it clear that a purpose-built security agent was needed for CI/ CD. While there are numerous agents available for desktops and servers, such as from CrowdStrike and Lacework, none have been tailored specifically to address the unique risks…
- 1HR
2022 · github.com
- 2
- 3
- 4
- 5
- 6RO
Claude Code is great, but it’s focused on coding. The missing piece is a native way to build and run custom background agents for non-code tasks. We built RowboatX as a CLI tool modeled after Claude Code that lets you do that. It uses the file system and unix tools to create and monitor background agents for everyday tasks, connect them to any MCP server for tools, and reason over their outputs. Because RowboatX runs locally with shell access, the agents can install tools, execute code, and automate anything you could do in a terminal with your explicit permission. It works with any…
Nov 2025 · github.com
- 7WX
Hey HN, I’m Surya and I’m excited to show you WarpBuild! WarpBuild provides fast, secure `x86-64` and `arm64` Github actions runners. This speeds up your workloads by 30%, at half the cost, and takes ~2mins to get started. We’ve been seeing pretty good results since we opened up signups a week ago and I’ve shared some numbers publicly here [1]. Currently, we support linux runners for Github organizations (not personal accounts) and MacOS support is coming soon (~Jan). The way the runners work is deceptively simple: Runners are assigned to hardware that is ideal for build workloads with fast…
2023 · warpbuild.com
- 8SF
Hi HN! We are the team behind Spacelift (https://spacelift.io/). Spacelift is the CI/CD for infrastructure-as-code, be it Terraform, Pulumi, CloudFormation or Ansible (coming soon), and policy as code. It enables collaboration, automates manual work and compliance, and lets teams customize and automate their workflows. Here’s what you can do with Spacelift - Build sophisticated Git-based workflows - Use Open Policy Agent to declare rules around your infrastructure, access control, state changes, and more - Author and maintain reusable modules for your organization; we…
2021
- 9IB
2025 · github.com
- 10IB
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com
- 11RT
Now that AI is capable of writing large volumes of production-quality code, our role as developers is changing. Our primary job is no longer writing code. It’s planning and communicating software design and architecture. We have to do this collaboratively with agents and then review and iterate on their implementations. IDEs were not built for this workflow. So about three months ago I decided to try to build what I thought this new interface should look like. Runner is a coding agent purpose-built for this new “plan and review” workflow. It’s not for vibe coding. It’s for professional…
Sep 2025 · runnercode.com
- 12
- 13OS
We build runtime security for AI agents. The playground started as an internal tool that we used to test our own guardrails. But we kept finding the same types of vulnerabilities because we think about attacks a certain way. At some point you need people who don't think like you. So we open-sourced it. Each challenge is a live agent with real tools and a published system prompt. Whenever a challenge is over, the full winning conversation transcript and guardrail logs get documented publicly. Building the general-purpose agent itself was probably the most fun part. Getting it to reliably use…
Mar 2026 · github.com
- 14
- 15NA
I've been tired with the current options on the market for awhile and decided to do something about it after the running into the disaster that is MLOps at my last two startups and having to manage a multiple operation platforms both for my fellow ML engineers, the general application CI/CD and orchestration layers while simultaneously building the application itself. Its still extremely early for the product but its functioning and is well on its way. I'd love feedback on the approach and peoples thoughts on the problem space. Personally my irritations have been in the poor tooling,…
2025 · egdaemon.com
- 16DO
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com
- 17FS
2025 · github.com
- 18AA
At my last company, we connected Claude Code and Cursor to almost all our internal services via MCP. It made the team incredibly fast, but we hit a wall: permissions. If you give an agent "Read Only" access, it can’t actually fix anything. If you give it "Write" access, it’s only a matter of time before a hallucination or a bad prompt results in a deleted database or a nuked production bucket. We had a few "close calls" that convinced us that simply reducing IAM permissions makes agents useless. I built Armour (https://github.com/fuushyn/armour) to solve this. It’s a…
Jan 2026 · github.com
- 19
- 20FL
Hi HN! We just launched Codacy Guardrails, an IDE extension with a CLI for code analysis and MCP server that enforces security & quality rules on AI-generated code in real-time. It hooks into AI coding assistants (like VS Code Agent Mode, Cursor, Windsurf), silently scanning and fixing AI-suggested code that has vulnerabilities or violates your coding standards, while the code it’s being generated. We built this because coding agents can be a double-edged sword. They do boost productivity, but can easily introduce insecure or non-compliant code. One recent research team at NYU found that 40%…
2025
- 21IB
Hi HN, I’m the creator of Cordum. I’ve been working in DevOps and infrastructure for years (currently in the fintech/security space), and as I started playing with AI agents, I noticed a scary pattern. Most "safety" mechanisms rely on system prompts ("Please don't do X") or flimsy Python logic inside the agent itself. If we treat agents as autonomous employees, giving them root access and hoping they listen to instructions felt insane to me. I wanted a way to enforce hard constraints that the LLM cannot override, no matter how "jailbroken" it gets. So I built Cordum. It’s an open-source…
Jan 2026 · github.com
- 22
- 23FA
Jul 2026 · github.com
- 24BI
Jun 2026 · bastion.computer
Ranked by how close each launch is in meaning, then by votes. Refine with a description →