H

AI SCA

Developer tool

by Harness

AI SCA applies reachability analysis and EPSS scoring to open-source risk detection.

Find alternatives to AI SCA

What it does

• Threat detection and response

Features 8

• EPSS scoringPrioritizes findings by the likelihood of a vulnerability being exploited in the next 30 days.
• Static reachabilityIdentifies vulnerabilities in open source functions or methods the code actually calls.
• Runtime reachabilityCorrelates findings with runtime context to prioritize remediation by observed risk.
• Malicious package detectionAlerts on open source packages with intentionally injected malicious code.
• Direct and transitive dependenciesScans every dependency in the tree, including hidden transitive ones.
• License complianceIdentifies license violations and incompatibilities before they reach production.
• Auto-PRRemediation Agent opens pull requests with context-aware fixes for critical dependencies.
• Pipeline enforcementPolicies automatically block unsafe dependencies from reaching production across pipelines.

Sources

Pricing

Official documentation · 15 Oct 2026

"For licensing details or to enable the Enterprise license, contact Harness Sales"

Description

Official documentation · 15 Oct 2026

"SCA adds reachability analysis and EPSS scoring"

What it does

Official documentation · 15 Oct 2026

"Detect malicious packages, license violations"

Sold within

Official documentation · 15 Oct 2026

"Security Testing Agent's SCA"

Name

Official documentation · 15 Oct 2026

"Get started with Harness AI SCA"

URL

Official documentation · 15 Oct 2026

"Get started with Harness AI SCA"

Deployment

Official documentation · 15 Oct 2026

"Fully managed, cloud-hosted version of Harness."

Intended for

Official documentation · 18 Oct 2026

Page: 'Open source risk is a team effort Developers AppSec DevOps Developers'.

Also from Harness

• Harness Platform Platform

  AI-native software delivery platform: pipelines and canary deployments, AI security testing, runtime API and AI protection, cost management and policy governance, driven by AI agents that recommend while people decide.

• Security Testing Agent AI agent

  Uses agents to triage and remediate software vulnerabilities.

• Runtime Protection Agent AI agent

  Blocks prompt injection and unsafe model output.

• Cost Management Agent AI agent

  Tracks cloud and AI spending and automatically fixes waste.

• AI SRE Application

  Correlates deployment, feature flag, and infrastructure changes during incidents.

• AI SAST Developer tool

  AI SAST scans agent-generated code and provides AI-generated fix suggestions.

• AI Posture Application

  AI Posture discovers AI assets and agents and assesses their security posture.

• AI Firewall Application

  AI Firewall blocks prompt injection, evasion, and malicious payloads targeting AI applications.

• AI and Cloud Costs Application

  AI and Cloud Costs translates natural-language governance intent into cloud rules and remediates violations automatically.

• Software Delivery Agent AI agent

  Automates CI/CD and infrastructure-as-code delivery.

• AI Evals Developer tool

  Scores AI-agent responses for faithfulness, relevance, and task completion.

• AgentTrace Developer tool

  Monitors AI-agent LLM calls, tool calls, and decisions.

• Harness AI Test Automation Developer tool

  Creates intent-based tests and runs them within CI/CD pipelines with AI-assisted failure analysis.

• AI Code Review Developer tool

  Reviews pull requests by grouping diffs by risk so the riskiest changes come first, enforcing required checks that cannot be bypassed, and citing delivery history and the knowledge graph for context.

• AI DLC Insights Application

  Engineering-intelligence module that tracks DORA metrics, developer productivity and AI coding-tool spend together: which AI tools teams use, token consumption by developer, team, agent and model, AI-authored code and its effect on delivery.

• Worker Agents Agent platform

  Governed AI agents defined in a committed file that run inside Harness pipelines on events such as CI failures and pull requests, with prebuilt agents for autofix, code review, code coverage, feature-flag cleanup, manifest remediation and IaCM remediation.

• API Advanced Protection Application

  Detects and blocks API attacks, bots and Layer 7 DDoS with behavioral AI trained on live traffic, covering credential stuffing, account takeover and business-logic abuse such as BOLA and mass assignment.

Open Harness in the directory

Something wrong here? Send a correction — quote this product id: harness-ai-sca.