Check harness changes on a host without Docker by running the pinned Claude Code CLI against a local mock API server. Capture request headers and verify behavior using the authentication environment generated by the harness.
Verify harness changes end-to-end without docker — drive the real pinned CLI against a header-capturing stub server with the exact env resolve_auth_env() produces.
Review the instructions the agent will receive before you install.
The pipeline's real surface is the in-container claude -p process and its
outbound API requests. Without docker, drive the same pinned CLI binary
directly with the env dict the harness would inject via docker -e.
harness/agent_image.py:CLAUDE_CODE_VERSION):
npm install --no-save @anthropic-ai/claude-code@<pin> in a temp dir →
binary at node_modules/@anthropic-ai/claude-code/bin/claude.exe (the
.exe name is the real native-binary entry on Linux too, filled in by the
package's postinstall — not a Windows leftover).invalid_request_error
(non-retryable, so the CLI exits fast; exit=1 is expected).python3 -c "from harness.auth import resolve_auth_env; ..." and dump to
an export-lines file with shlex.quote (values contain newlines —
NEVER pass via env $(...), word-splitting mangles them; source the file).unset ANTHROPIC_CUSTOM_HEADERS (and any
other ambient var not in the resolved dict) before sourcing — a Claude
Code session in this repo injects .claude/settings.json env into shells,
which containers never see.ANTHROPIC_BASE_URL=http://127.0.0.1:<port> CLAUDECODE= IS_SANDBOX=1 timeout 30 <cli> -p hi --model claude-sonnet-4-5 --max-turns 1, then read
the captured JSONL.tests/test_patch.py / tests/test_patch_grade.py need
docker and fail on docker-less hosts — pre-existing, not your change.-e injection leg itself can't be exercised without docker;
it's the same mechanism that carries ANTHROPIC_API_KEY in production..claude/settings.json into a
fresh temp dir and run the host claude from there (with ambient
ANTHROPIC_CUSTOM_HEADERS unset so settings.json is the only source).No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Adapt a C/C++ vulnerability pipeline to another language, target, or detection method. The workflow gathers requirements, proposes file changes for approval, updates the implementation, and validates it against a test target containing known bugs.
Hunt for signs of compromise in web and application logs without an initial alert. Establish normal activity, record investigative hypotheses, check source code, and reproduce issues locally before producing incident records and a report.
Investigate an alert or suspicious identifier using logs and source code. Assess attack success, measure affected data and users, test the suspected flaw locally, and produce a response plan for human review and execution.
Turn security findings into candidate code fixes with review results and summaries. Depending on the input, use independent source review or a pipeline with execution checks, then provide diffs for a person to review and apply.
Get started with vulnerability review through a guided practice target, from threat modeling to scanning and triage. Ask questions about the pipeline and receive answers grounded in its documentation and source, with references and a next command.
Build a threat model that identifies valuable assets, attack entry points, potential threats, and mitigation priorities. Use source code and past vulnerabilities, an interview with the application owner, or a combination of both.