# step-security/harden-runner

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

Repository: https://github.com/step-security/harden-runner
Canonical: https://ross.abutalabs.com/products/harden-runner
Homepage: https://www.stepsecurity.io
Language: TypeScript
License: Apache-2.0
License Family: permissive
Topics: github-actions, actions, supply-chain-security, hardening, security-hardening, runners, egress-filtering, network-security, runtime-security
Last push: 2026-08-15T06:05:32+00:00

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 97, release rhythm 98, longevity 100
- inputs: {"age_days": 1770, "days_push": 18, "days_rel": 18, "gap_med": 15.0, "n_releases_24m": 31}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1258, forks 111 (observed 2026-08-28T04:04:09.518769+00:00)

## What it is
Harden-Runner is a CI/CD security agent that acts like an EDR for GitHub Actions runners, monitoring network egress, file integrity, and process activity in real time. It detects compromised dependencies and malicious workflow behavior, and has caught several real-world supply chain attacks such as the tj-actions/changed-files and axios npm compromises.

## Use cases
- detect compromised npm packages in CI builds
- monitor network egress from GitHub Actions runners
- prevent secrets exfiltration during CI/CD pipelines
- harden GitHub Actions workflows against supply chain attacks
- get alerts when a build step downloads from unexpected domains
- audit file and process activity on CI runners
- comply with software supply chain security requirements

## When to choose
- you run builds on GitHub Actions and want runtime security monitoring
- you need to detect malicious dependencies or exfiltration attempts in CI
- you want an EDR-like agent tailored to ephemeral CI/CD runners
- you need egress filtering and file integrity monitoring for build pipelines

## When to avoid
- you need security monitoring for developer laptops or production servers rather than CI runners
- you use CI systems other than GitHub Actions without the enterprise plan
- you only need static dependency scanning rather than runtime detection

## Facets
- artifact type: service
- maturity: active
- function: security, monitoring, ci-cd, alerting, tracing
- domain: security, developer-tools
- platform: windows, cloud, self-hosted
- tags: github-actions, supply-chain-security, edr, egress-filtering, ebpf, runtime-security, ci-cd-security, hardening, devops, automation, linux, macos, docker

## Member repositories
- step-security/harden-runner (main) score 98

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:09.518769+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T05:05:37.159066+00:00, confidence not recorded.
  - readme: https://github.com/step-security/harden-runner (fetched 2026-08-28T04:04:09.518769+00:00, sha 1017afc51747)
  - homepage: https://www.stepsecurity.io (fetched 2026-08-29T12:17:21.758777+00:00, sha 0a0874ddb60a)
  - site_page: https://docs.stepsecurity.io/ (fetched 2026-08-29T12:17:21.771140+00:00, sha a138bdcbe557)
  - site_page: https://www.stepsecurity.io/pricing (fetched 2026-08-29T12:17:21.768536+00:00, sha c862f2ab5ddf)
  - site_page: https://www.stepsecurity.io/company (fetched 2026-08-29T12:17:21.773240+00:00, sha 04ef9d864fd7)
  - site_page: https://www.stepsecurity.io/blog (fetched 2026-08-29T12:17:21.775283+00:00, sha 6978d7225bb9)
- Data as of 2026-08-30T08:39:29.467469+00:00.