Harbor

Inspiration

Every time someone builds an AI agent, they redo the same setup: connect the tools, pick a model, write the instructions, add logging. Then a company still won't let it run, because nobody can say what it will do when a customer tries to trick it.

We built Harbor for Maya, a support team lead at a mid-size company. She isn't an engineer. She wants an agent that sorts tickets and handles refunds, and her manager wants proof it won't refund $10,000 because a ticket told it to.

What it does

Maya types what she wants in plain English, for example: "Sort incoming tickets by urgency, check for outage news when a ticket mentions one, and post urgent tickets to #support-urgent." Harbor turns that into an agent with instructions, a list of tools it may use, and limits on what it can do. She can edit any of it before it goes live.

Before deploy, Harbor runs the agent on sample tickets and shows how many it handled correctly.

Then Harbor attacks it. Red-team mode generates adversarial tickets: prompt injections, refunds over the limit, a fake CEO demanding approval, requests to email customer data to an outside address. Risky tools are intercepted during the attack, so nothing real happens, and each attack is marked as resisted or as getting through, with the step where it went wrong.

When attacks get through, Harbor reads the failed runs and proposes a fix as a diff: changed instructions, a refund cap enforced in code, refunds moved behind manager approval. Maya accepts or rejects it. Accepting creates a new version of the agent, and Harbor reruns the same attacks and the original tests on it. In our demo agent, red-team results go from [X/10] to [Y/10] after one fix.

Every run, tool call and approval is written to an activity log, and any agent can be saved as a template and cloned into a new one.

How we built it

The app is [Next.js with TypeScript, Tailwind and shadcn/ui]. Agents run on opus with tool calling. SerpApi is a built-in tool every agent can use: our triage agent calls Google Search and Google News through SerpApi to check whether a reported outage is real before it escalates the ticket. Tiger Data hosts our Postgres database, which stores templates, agent versions, runs, every tool call, approvals and red-team results. Agent versions are never edited in place, so each run points to the exact config it used.

The red-team grader runs two passes. A code check catches forbidden tool calls, exceeded limits and leaked email addresses. An LLM judge handles the cases a rule can't.

Challenges we ran into

Prompt-only guardrails were the biggest lesson. Telling the model "never refund more than $500" stopped some attacks and not others. We moved limits into the tool layer, where the code refuses the call no matter what the model decides.

Accomplishments that we're proud of

An agent that finds its own weak spots and fixes them, with a person approving each change.

What we learned

What's next for Harbor

Single sign-on and roles so a security team can sign off on agents, more connectors beyond Slack and our ticket inbox, scheduled red-team runs against live agents, and per-agent spending limits.

Built With

• gemini
• llm
• nextjs
• node.js
• postgresql
• react
• serpapi
• shadcn-ui
• slack-api
• tailwindcss
• tiger-data
• timescaledb
• typescript
• vercel