Prisma AIRS Harness
A local terminal agent built to work with Prisma AIRS AI Gateway. It works with
your project files, runs commands you approve, includes bundled Prisma AIRS
skills, and calls remote MCP tools through the gateway.
Documentation ·
Getting started ·
Release notes ·
Canonical source
Install
Use Node ^22.13.0 || >=23.5.0 on Apple Silicon, Linux x64 or Linux ARM64.
npm install -g @cdot65/prisma-airs-harness
airs --version
airs cli --version
airs
The npm package is @cdot65/prisma-airs-harness from 0.1.4 onward; the command is airs.
Existing installations of the previous package name migrate once, keeping AIRS
environments, credentials and history:
npm uninstall -g airs-harness
npm install -g @cdot65/prisma-airs-harness
The uninstall only releases the old npm command links; never use --force.
See package migration. The Prisma AIRS CLI and
SDK are bundled, and airs cli --version shows the CLI version. If your
organization distributes through its own registry, add
--registry=<registry URL>.
A separate product CLI installation is unnecessary. Windows and Intel Mac
packages are not provided. Linux requires a usable Bubblewrap sandbox and an
unlocked Secret Service session; macOS uses the user's Keychain.
If npm configuration omits optional dependencies, reinstall the same version
with --include=optional. If another package owns airs, inspect type -a airs airs-cli airs-harness. An older standalone Prisma AIRS CLI must first be upgraded
to @cdot65/[email protected] or later, whose command is airs-cli; do not
force an overwrite. Upgrades preserve environments, credentials and history. Restart
running sessions after upgrading.
Connect and verify
Your administrator supplies the gateway URL and either public OIDC settings
or a user workspace API key. Inference supports Keycloak company SSO, including
Entra federation through Keycloak, or workspace keys entered in a hidden prompt.
Run airs. On a fresh installation it opens a welcome screen that asks for an
environment name and the gateway URL, then offers company SSO or a workspace API
key, so there are no setup flags to pass. Enter /doctor in the session to verify
the connection. It makes a small inference request and can consume quota. To
script the same steps, or to keep several environments, pass the flags directly:
airs env create work --gateway-url https://gateway.example.com/v1
airs login
airs doctor --verify-access
airs
Skip creation when the profile exists. Add --environment NAME to any command to
target a different environment for that command. Doctor does not verify MCP. In
the terminal, use /mcp to add the gateway integration and complete its separate
organizational login. After tool discovery, start a new conversation and verify an
actual read-only tool result.
It helps to know where the line sits between the local runtime and the gateway.
Both model inference and remote MCP go through AI Gateway, and the gateway owns
upstream MCP OAuth. Local files, shell execution, sandboxing, approvals and
history remain in the local runtime. Selected contents and tool results can
still become model context, so something read locally can end up in a request
to the gateway.
Documentation paths
Product administration uses a separate CLI tenant (airs cli tenant create).
It does not inherit inference SSO. The optional Jev judge also has a separate
TypeSafe credential and an explicit live-command approval boundary.
Source and releases
Forgejo is authoritative for review, CI and releases. GitHub is a public source
mirror and hosts the dedicated Docusaurus site. Documentation publishes from
exact airs-docs-<commit SHA> tags. Inherited upstream workflows stay disabled.
See development
and release deployment
for build commands, platform checks, provenance and publication procedures.
Apple Silicon artifacts are Developer ID signed and notarized. Linux ARM64
requires native installed acceptance; a cross-build or QEMU probe alone is
insufficient. Release notes distinguish fixtures from live-account acceptance.
Derived from OpenAI Codex; see LICENSE,
NOTICE and LICENSING.md for provenance and licensing.
The previous package name airs-harness stays at 0.1.3 on both registries for
rollback; it is not updated further.
