metaharness
MetaHarness — mint a custom AI agent harness from any repo. Browser Studio + `npx metaharness` CLI. Runs on Claude Code, Codex, pi.dev, Hermes, OpenClaw, RVM, Prime Agent.
No outside reports on file
Use this tool only with repos you trust completely, run it in an isolated environment, and carefully review the generated agent code before deploying it to production systems.
Based on public adoption and transparency signals as of Oct 27, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachFetches arbitrary web URLsREVIEW
- CredentialsRequires API key or tokenREVIEW
- Package sourcenpm (metaharness)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
npx -y metaharnessEverything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: D (from public signals such as stars and downloads, not a code review). Graded 2026-10-27.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Metaharness
MetaHarness is a tool that creates custom AI agent setups from any code repository. It works through a browser interface and a command-line tool, letting you quickly turn a repo into an AI agent harness that runs on various AI platforms like Claude Code.
Who it’s for
Developers who want to quickly set up AI agents from existing codebases without building the harness from scratch. It's designed for people using Claude or other AI coding assistants who need fast agent setup.
Alternatives
- Vercel AI SDK — build AI agents with type safety and defined tools
- Anthropic's Implementations — official Claude agent examples and patterns
- LangChain — framework for building custom AI agent chains
- OpenAI Assistants API — managed agent hosting with built-in safety controls
Setup
Check these steps against the project’s own instructions before running anything.
Install via npm:
npx metaharness
Then follow the project's README for browser studio setup and platform configuration.
Why this grade
Signal-based grade (1/7 points): no public source code found. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- Weekly npm downloads
- 61.8k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Repo code execution: The tool reads and may execute code from any repository you point it at, including malicious or outdated code that could harm your system.
- AI agent control: Once deployed, the harness runs AI agents that could make unintended API calls, modify files, or access credentials if misconfigured.
- Dependency chain: Like all npm packages, hidden dependencies could contain malware or security flaws that compromise your environment.
- Untrusted repo analysis: The tool scans repos to build harnesses, so tricky repo structures or embedded scripts could exploit the parser in unexpected ways.
- Credential exposure: Agents created this way might accidentally expose API keys or secrets if the harness isn't carefully isolated from sensitive files.
How to lower the risk
Least-privilege permissions
- Run metaharness in a sandboxed dev container or VM, never on production systems.
- Use restricted API keys scoped to minimal permissions for any AI agents created.
Network isolation
- Test generated harnesses in offline or limited-network environments first.
- Block external outbound requests until you've audited what the agent needs.
Monitoring
- Log all file operations and API calls made by generated agents.
- Set up alerts if agents attempt to access unexpected files or services.
Red flags to watch for
- Repos with suspicious build scripts or obfuscated code in the root.
- Generated harness code that includes credential handling or unrestricted file access.
- High npm download counts without corresponding GitHub activity or documentation.
Questions
How do I install Metaharness?
Run npx -y metaharness in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page.
Are there security reports about Metaharness?
No reports found for this package in our research (last checked 2026-10-30). Metaharness currently holds Grade D (High risk signals) based on public adoption and transparency signals. Key risk areas to watch include repo code execution, ai agent control, dependency chain.
Is Metaharness actively maintained?
Metaharness has 61.8k weekly npm downloads. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues before pinning it in production.
What are alternatives to Metaharness?
Notable alternatives to Metaharness include Vercel AI SDK (build AI agents with type review and defined tools), Anthropic's Implementations (official Claude agent examples and patterns), LangChain (framework for building custom AI agent chains), OpenAI Assistants API (managed agent hosting with built-in review controls). You can also compare Metaharness side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Metaharness? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/ruvnet-metaharness)HTML embed:
<a href="https://agentarmorhq.com/skills/ruvnet-metaharness"><img src="https://agentarmorhq.com/api/badge/ruvnet-metaharness" alt="AgentArmorHQ Risk Grade for Metaharness" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "ruvnet-metaharness"Share with your security lead
Need sign-off to use metaharness? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: metaharness
- **Listing URL:** https://agentarmorhq.com/skills/ruvnet-metaharness
- **Type:** App connector
- **Risk Grade:** Grade D (High risk signals)
- **Outside Security Advisories on File:** 0
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Fetches arbitrary web URLs
- **Credentials:** Requires API key or token
- **Package source:** npm (metaharness)
#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts metaharness`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 27, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Install command
- npm install metaharness
- Est. context load
- ~550 tokens / turn (~3 tool schemas, 0.27% of 200k context)
- Popularity
- 61.8k weekly npm downloads
- Last updated
- 2026-10-29
- Last graded
- 2026-10-27
Community
Discussions for Metaharness
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude