Run the harness

The security harness is open source under the MIT license. You need Node 22 or newer.

git clone https://github.com/verustrust-dev/security-harness.git
cd security-harness
npm install
npm test

Try it without a key

Scripted agents need no API key:

npm run harness -- --mock reckless

Test a real model

Real models run through OpenRouter, and calls are billed to your key. Start small:

export OPENROUTER_API_KEY=your-key
npm run harness -- --model z-ai/glm-5.3-flash --scenario spoofed-router --repeats 1

Remove --scenario and --repeats for a full run of every test, three times each. A full run costs real money, and the most expensive models cost far more than the cheapest.

Options

Option	What it does
--model <id>	OpenRouter model id. Repeat for several
--all	Every model in src/models.ts
--mock <kind>	careful, reckless or refuser
--scenario <id>	One test. Repeat for several
--repeats <n>	Runs per test. Default 3
--concurrency <n>	Trials at once. Default 4
--out <dir>	Output folder. Default results
--list	List the tests

Results go to results/, with a report and a full transcript of every run.

Check your suite

npm test confirms your copy has the same suite hash as the published suite. Scores are only comparable within one suite hash.