NESSCO Agentic Harness
New Nessco task

Ness Code · generation · runtime · GitHub deploy · per-tab browser agent

No context attached
0 tokens

Teach a task

Stored as a hidden .nessco/skills file, like ChatGPT skills. The agent reads it; chat does not show it.
Attach page to chat
◎

Browse public HTTP(S) websites in an isolated preview. Known private addresses, credential access, pop-ups, and automatic downloads stay blocked.

Some interactive or sign-in-only sites must be opened directly in your system browser.
Physical AI

Import a robot, simulate it, train a policy against it, and export to Omniverse and Isaac Lab.

Drop a URDF, STL, STEP, or USDA file

URDF is what RoboDK and ROS export. From SolidWorks, export STL or URDF — STEP gives bounds only.

Joint targets

Reinforcement learningheld-out · population mean

SLAMmap · drift vs ground truth

Inverse kinematicsDamped least squares, as RoboDK and MoveIt solve it
Nessco

Browser settings

Manage browser-only data and preferences on this device.

General

Allow NSFW outputsOff by default. When on, RapidGen requests unfiltered output only where supported.
Reference

Terminal commands

Commands are typed in the terminal. This reference explains them; it does not run them.
Workbench

Plugins

Loading catalog…

Save the tools you use, explore the workbench and Kimi libraries, or connect a custom HTTPS plugin. Kimi Skills attach to Ness Code. HTTPS MCP servers connect here. Local stdio plugins stay listed until they have a hosted URL. Connector secrets stay encrypted in an HttpOnly cookie.

Pinned tools stay here so you can open them without hunting the catalog.
Install Nessco

Choose your app

Fastest

Web app

Install the current Nessco experience from your browser. It opens in its own window, updates automatically, and includes a safe offline fallback.

Available in supported versions of Edge, Chrome, and other installable web-app browsers.

Native desktop

Desktop app

Build a lightweight Windows installer from the selected repository using Tauri 2 and Microsoft Edge WebView2.

  • Output64-bit NSIS setup .exe
  • RuntimeTauri + Evergreen WebView2
  • SecurityAllowlisted navigation · no native IPC

Select a connected GitHub repository to build its native release.

Every release includes a SHA-256 checksum. Configure a trusted Windows code-signing certificate, or an Apple Developer ID plus App Store Connect notarization credentials, in repository secrets before public distribution; unsigned builds trigger Microsoft SmartScreen and macOS Gatekeeper.
Software updates

What's new

Version

Short summaries of user-facing changes only. Update notes never include your account, project or session details.
0% of agent actions pass through policy before execution
0 intent, tool, data and network control planes
0 target overhead for inline enforcement on the hot path
On-prem air-gapped and edge deployments, your keys only
Capabilities

Four ways an agent gets away from you.
Four places we hold the line.

Autonomy fails at the boundary — where an agent decides, where it reaches for data, where it was taught what "good" looks like, and what it is shown. Nessco covers all four.

Agentic firewalls

A policy boundary that sits between an agent and everything it can touch. Every intent is classified, scored and either allowed, held for a human, or killed — before the tool call leaves the process.

  • Intent classification on every tool call
  • Prompt-injection and jailbreak interception
  • Human-in-the-loop holds for high-blast-radius actions
  • Hard kill-switch and blast-radius caps per agent
How the firewall works

Cyber attack & data leak prevention

Agents are a new attack surface and a new exfiltration path at the same time. We watch both directions: what gets into the context window, and what leaves it.

  • Outbound checks for secrets, PII and source code
  • Poisoned-tool and untrusted-content quarantine
  • Lateral-movement detection across agent fleets
  • Immutable, replayable audit trail for every decision
See the threat model

Training edge-AI agents & LLMs

Small models that run on your hardware, trained on your data, aligned to your policy — so the safe behaviour is baked in before the firewall ever has to catch it.

  • Domain fine-tuning and distillation to edge-size models
  • Quantisation and compilation for constrained devices
  • Policy-aligned reward models and refusal training
  • Red-team evaluation harness with regression gates
Explore edge training

Vision-language models & real-time classifiers

An agent that can see is an agent that can be shown something. We inspect what a model looks at — screens, camera feeds, scanned documents — and run the classifiers that have to answer in milliseconds, on the device, without a round trip.

  • Prompt injection hidden inside images, screenshots and PDFs
  • Millisecond-budget classifiers running on the device
  • Frame-level redaction of faces, badges and open screens
  • Drift monitoring against a held-out labelled reference set
See how vision is harnessed
04 · Vision & real-time classifiers

What the model sees is an input too.

Text inputs get inspected as a matter of course. The moment an agent takes a screenshot, opens a scanned invoice or reads a camera frame, the same untrusted content arrives through a channel most guardrails never look at.

Injection hides in pixels

Instructions rendered into an image are invisible to a text filter and perfectly legible to a vision-language model. We read what the model reads — rendered text, QR codes, overlays — and apply the same policy to it as to any other untrusted source.

Fast enough to sit inline

A classifier on the hot path has a millisecond budget, not a second one. These run quantised on the device, so a camera feed is judged where it is captured rather than shipped somewhere to be judged.

Redact before it is stored

Faces, badges, whiteboards and open screens are masked at the frame, before anything reaches a log, a prompt or a training set. What was never captured cannot leak later.

Watched for drift

Vision models decay quietly as lighting, hardware and scenes change. A held-out labelled set runs on a schedule, and a classifier that loses ground is flagged rather than trusted.

Visual attack surface

inspected per frame
  • HIGH
    Text rendered into an image"Ignore prior instructions" printed on a slide the agent screenshots.
  • HIGH
    Malicious QR or barcodeScanned document encodes a destination the agent then fetches.
  • MED
    Incidental captureA colleague's screen or badge caught in frame and written to a log.
  • MED
    Adversarial perturbationCrafted noise flipping a classifier's label without a visible change.
  • LOW
    Silent accuracy driftNew camera firmware shifts colour balance; confidence stays high, labels do not.
The Harness

Four checkpoints between intent and impact.

The harness wraps the agent loop itself. Nothing reaches a tool, a dataset or the network without clearing all four.

  1. 01

    Intercept

    The runtime shim sits inside the agent loop. Every planned tool call, retrieval and network request is captured as a structured intent instead of executing straight away.

    SDK · sidecar · gateway
  2. 02

    Reason

    A small, fast classifier scores the intent against policy: who is asking, what it touches, how reversible it is, and whether the context that produced it can be trusted.

    policy engine · risk score
  3. 03

    Enforce

    Allow, redact, hold for a human, or block and terminate. Enforcement happens inline, so a rogue action never reaches the system it was aimed at.

    allow · redact · hold · block
  4. 04

    Learn

    Every decision is signed, stored and replayable. Blocked patterns become training data for your edge models and new rules for the fleet.

    audit · replay · retrain
01 · Agentic firewalls

Stop a rogue agent at the intent, not at the incident report.

Traditional security assumes a human on the keyboard. An agent has credentials, a plan, and no hesitation — it will chain forty tool calls before anyone opens a dashboard. The agentic firewall makes that loop reviewable at machine speed.

Intent-level policy

Rules are written against what the agent is trying to do — "no writes to production billing", "no outbound POST with customer records" — not against brittle string matches.

Injection interception

Retrieved documents, web pages and tool output are treated as untrusted input. Instructions smuggled into content never gain the caller's privileges.

Blast-radius caps

Per-agent budgets on spend, rows touched, files written and external calls. Breach the cap and the harness freezes the agent with its state intact for review.

policy/agent-boundary.yaml 
agent: support-copilot
boundary:
  allow:
    - tool: crm.read
      scope: "tenant:self"
    - tool: ticket.write
      limit: 50/hour
  hold:
    - tool: refund.issue
      when: amount > 250
      approver: finance-oncall
  block:
    - sendsTo: "*"
      carrying: [secret, pii, source_code]
    - origin: untrusted_content
      escalates_to: [shell, iam, deploy]
on_violation: freeze + snapshot + page
02 · Attack & leak prevention

Two directions of failure. One inspection point.

An agent connected to your stack is both a target and a courier. Nessco inspects the inbound context that shapes its behaviour and the outbound payload that carries your data.

Inbound: the attack path

Poisoned documents, hostile MCP servers, compromised tool responses and supply-chain prompts are quarantined before they reach the model's context.

Outbound: the leak path

Everything the agent sends out is classified for secrets, credentials, regulated data and proprietary code, then redacted or blocked according to the destination's trust tier.

Fleet-wide correlation

One agent probing is noise. Nine agents probing the same boundary in an hour is an incident — correlation runs across the whole fleet, not per session.

Threat surface

continuously monitored
  • HIGH
    Prompt injection via retrievalUntrusted page instructs agent to email an export.
  • HIGH
    Credential harvestingAgent asked to "debug" by printing environment secrets.
  • MED
    Silent data exfiltrationRecords dripped out through an allow-listed webhook.
  • MED
    Tool-chain escalationRead-only agent reaching shell through a helper tool.
  • LOW
    Model drift into over-collectionRetrieval scope widening beyond the task over time.
03 · Edge-AI & LLM training

Small models, your hardware, your rules.

Enforcement is the floor, not the ceiling. We train the models that run inside the harness — compact enough for a factory gateway or a handset, aligned tightly enough that the firewall rarely has to intervene.

Distil, don't just prompt

Frontier-model behaviour distilled into task-specific models you own, so latency, cost and data residency stop being negotiable trade-offs.

Aligned to the same policy

The policy that drives your firewall becomes the reward signal in training. Guardrail and model agree instead of fighting each other at runtime.

Evaluated like software

Red-team suites, refusal benchmarks and behavioural regression gates run in CI. A model that loses ground on safety does not ship.

Training pipeline

  1. 01
    CurateYour domain data, cleaned, de-identified, provenance tracked.
  2. 02
    DistilTeacher-student compression to supported models up to 3B parameters.
  3. 03
    AlignPolicy-derived preference training and refusal tuning.
  4. 04
    CompressQuantise, prune and compile for the target silicon.
  5. 05
    ProveRed-team and regression gates before any promotion.
  6. 06
    ShipSigned artefacts, staged rollout, one-command rollback.
Architecture

One harness. Four control planes.

Deploy as an SDK inside the agent, a sidecar next to it, or a gateway in front of the fleet. Same policy, same audit trail, wherever it runs.

L4

Network plane

Outbound control, destination trust tiers, DNS and payload inspection for everything the agent tries to reach.

outbound
L3

Data plane

Classification, redaction and residency rules applied to every record entering or leaving the context window.

classify
L2

Tool plane

Capability scoping per agent and per session: which tools exist, with what arguments, under what budget.

scope
L1

Intent plane

The model's plan itself — classified, risk-scored and checked against policy before a single call is made.

reason

SDK

Drop-in wrapper for Python and TypeScript agent frameworks.

Sidecar

Process-local proxy for containerised fleets and Kubernetes.

Gateway

Central chokepoint for model, tool and MCP traffic.

Edge

Air-gapped build for on-prem, industrial and offline devices.

Sectors

Built for the places where a rogue action is expensive.

Financial services

Agents with ledger access, held to approval thresholds and full replayable audit.

Healthcare

Clinical copilots that cannot leak a record, running on-prem where residency demands it.

Critical infrastructure

Edge models on isolated networks, with hard caps on anything that touches control systems.

Defence & public sector

Air-gapped deployment, signed artefacts, no data leaving the perimeter. Ever.

Software & platforms

Coding agents kept out of production secrets, credentials and customer databases.

Manufacturing

Gateway-class models on the factory floor, trained on your process data offline.

FAQ

Straight answers.

What exactly is an "agentic harness"?

A control boundary that wraps an autonomous agent's execution loop. The agent still reasons and plans freely; the harness decides what is allowed to actually happen. Think of it as the difference between trusting a driver and fitting the car with brakes, limiters and a black box.

How is this different from a WAF or a DLP product?

Those inspect traffic. We inspect intent. A WAF sees a well-formed API call and lets it through; the harness sees that a support agent — which has never issued a refund above $250 — is about to move $40,000 after reading an untrusted email, and holds it.

Will it slow our agents down?

Enforcement runs inline on small, local classifiers rather than a round trip to a frontier model. Low-risk intents clear on the fast path; only genuinely ambiguous ones take the deeper review, and only high-blast-radius ones wait on a human.

Do you need access to our data or models?

No. The harness is designed to run entirely inside your perimeter, including fully air-gapped. Training engagements happen on your infrastructure or an isolated environment you control, and the resulting model weights are yours.

Which agent frameworks do you support?

Anything that speaks tool calls. The SDK wraps common Python and TypeScript frameworks directly, the gateway sits in front of model and MCP traffic for everything else, and custom loops integrate through the intercept API.

What happens when the harness blocks something it shouldn't?

Every decision is logged with the full intent, the matching rule and the context that produced it. You can replay the moment, adjust the policy, and — where it makes sense — feed the correction back into the next training round.

Get started

Put a harness on it.

Tell us what your agents can reach today. We will map the blast radius, show you where the boundary should sit, and book you a free consultation with one of our experts — no payment details, no obligation.

  • A short questionnaire about your agents and your exposure
  • An instant, non-binding pricing estimate for your company's size
  • A free 30-minute consultation, booked straight into an expert's calendar

Prefer email? hello@nessco.ai

Two ways in

01
Request a demo

A short questionnaire about your agents, then straight to booking a free consultation with an expert.

Start the questionnaire
02
See pricing first

Get an instant estimate from your company size and revenue, then book when you're ready.

Open the pricing estimator