Agent Hardening CLI Reference | NVIDIA NeMo Helix

Agent Governance is released with early access availability and is subject to limited support and potential API changes in future releases.

Every command in the nemo agent-hardener group. For the workflow these fit into, see Run a War-Game.

Command Summary

Command	Purpose
`doctor`	Read-only preflight of the agent-hardener venv, garak venv, inference credential, Docker daemon and OpenShell gateway
`setup`	Provision the virtual environments and the inference credential
`init`	Resolve an agent or project into a saved manifest
`refresh`	Re-resolve a saved manifest against its agent as it is now
`synth-benign`	Generate the benign request suite and cache it on the manifest
`synth`	Submit benign-suite synthesis as a platform job
`run`	Run the attack, defend and validate cycle
`war-game`	Submit the war-game as a platform job
`sanity-check`	Score a chosen subset of a run’s defenses without applying them
`status`	Show recent runs
`manifest show`	Print a saved manifest’s stored defaults
`manifest set`	Change a saved manifest’s stored defaults

Applying a mitigation is not a CLI operation. See Review and Apply Mitigations.

Setup and Diagnostics

`doctor`

nemo agent-hardener doctor

Read-only. Checks the agent-hardener venv, the garak venv, the inference credential, the Docker daemon and the OpenShell gateway.

`setup`

nemo agent-hardener setup [--force]

Creates the agent-hardener and garak virtual environments and the inference credential, then checks prerequisites.

Option	Effect
`--force`, `-f`	Recreate the virtual environment even if it exists

Manifests

`init`

nemo agent-hardener init --agent <name>
nemo agent-hardener init --project-dir <path>

Resolves a target once and saves it as a manifest. Pass either --agent or --project-dir.

Option	Effect
`--agent <ref>`	Registered agent, as `name` or `workspace/name`. Deployment is not required
`--project-dir <path>`	Local agent project to upload and war-game
`--name <name>`	Manifest name. Defaults to the agent name
`--workspace <name>`	Agent workspace
`--output`, `-o <path>`	Where to write the rendered YAML. Default `agent-hardener.yaml`
`--egress <host[:port]>`	Allow-list an outbound host. Repeatable. A bare host opens 443 only
`--secrets <name>[=<ref>]`	Secret the agent needs, replacing the derived names. `NAME=[workspace/]secret` reads the value from the Secrets store at run time. Repeatable
`--env <KEY=VALUE>`	Non-secret environment variable. Repeatable, splits on the first `=`
`--backend <NAME:PORT[,PORT]>`	Host service the sandboxed agent calls, such as a remote MCP server running on the host. Repeatable. Reached through `host.docker.internal`
`--port <n>`	Victim port
`--dockerfile <path>`	Project-relative Dockerfile to build the victim from
`--start-command <cmd>`	Absolute command that serves the agent inside the sandbox. Required when the Dockerfile’s `ENTRYPOINT`/`CMD` is a shell form
`--harness <name>`	Which harness the agent runs: `deepagents`, `hermes`, `langchain`, `langgraph` or `other`
`--relay-confirmed`	Assert the agent is instrumented with NeMo Relay. Without it the victim emits no telemetry and the run cannot be scored
`--binary <glob>`	In-container glob scoping which processes may egress. Repeatable

Model defaults can also be set here and are stored on the manifest: --attack-model, --attack-base-url, --attack-key-secret, --analysis-model, --analysis-base-url, --analysis-key-secret, --safety-model, --safety-base-url and --safety-key-secret. They take the same values as the matching options on run.

--binary is derived for you and rarely needed: derivation proposes the image’s virtualenv plus /usr/local/bin/python* and /usr/bin/python*. Set it for a non-Python agent (Node, Go, Java). The sandbox matches its policy against the resolved executable, so globs that match no process grant nothing and the agent’s outbound calls are refused mid-run.

--backend opens the sandbox-to-host route for the named ports. The Inference Gateway backend is added automatically and its name, nemo-inference-gateway, is reserved. Backends you declare are kept when you refresh the manifest.

--env values are stored in plaintext on the manifest, so keep credentials in --secrets. A secret written as NAME=workspace/secret is read from the platform Secrets store when the run starts. A plain NAME takes its value from the operator environment or --env-file. For a deployed agent, the secrets its running deployment uses are recorded automatically and read the same way.

The rendered agent-hardener.yaml is a readable rendering. Editing it does not affect --manifest-id runs, which read the saved manifest — but run --config reads this local file, so edits do take effect there.

`refresh`

nemo agent-hardener refresh --manifest-id <name>

Re-resolves the manifest against the agent as it is now. Egress, backends, secrets, models, defenders and the cached benign suite are preserved. A run logs a warning when the agent is newer than its manifest.

`manifest show`

nemo agent-hardener manifest show <name>

`manifest set`

nemo agent-hardener manifest set <name> [options]

Changes stored defaults. The same knobs exist as per-launch flags on run, which apply to one launch only.

Option	Effect
`--rounds <n>`	Default hardening rounds
`--defender <guardrails\|openshell>`	Default defender. Repeatable
`--attack-intensity <light\|standard\|thorough>`	Default attacker effort preset
`--port <n>`	Default victim port
`--egress <host[:port]>`	Default egress host. Repeatable. Replaces the stored list
`--env <KEY=VALUE>`	Default environment variable. Repeatable
`--attack-model <name>`	Default model for garak’s red team and detector
`--attack-base-url <url>`	Custom OpenAI-compatible endpoint for the attack model
`--attack-key-secret <name>`	Secrets-store name holding the attack endpoint’s API key
`--analysis-model <name>`	Default model for the defenders and the benign validator
`--analysis-base-url <url>`	Custom OpenAI-compatible endpoint for the analysis model
`--analysis-key-secret <name>`	Secrets-store name holding the analysis endpoint’s API key
`--safety-model <name>`	Default model the generated guardrail uses to screen traffic. Unset uses the analysis model
`--safety-base-url <url>`	Custom OpenAI-compatible endpoint for the safety model. Unset uses the analysis endpoint
`--safety-key-secret <name>`	Secrets-store name holding the safety endpoint’s API key

Running

`synth-benign`

nemo agent-hardener synth-benign --manifest-id <name>

Generates the benign request suite and caches it on the manifest. Required before the first run.

Option	Effect
`--manifest-id <name>`	Saved manifest. Required
`--yes`	Accept the interview’s suggested answers
`--no-interactive`	Skip the interview and generate from rules alone
`--env-file <path>`	Dotenv supplying the agent’s secrets. Its values are merged into the agent’s `.env` and win over the operator environment
`--workspace <name>`	Workspace of the manifest

`run`

nemo agent-hardener run --manifest-id <name>

Runs the attack, defend and validate cycle. Pass either --manifest-id or --config, not both. Prefer --manifest-id, because the cached benign suite is looked up by manifest id; with --config you must pass --benign-suite yourself.

Option	Effect
`--manifest-id <name>`	Saved manifest to run
`--config`, `-c <path>`	Local manifest from `init`. Default `agent-hardener.yaml`
`--benign-suite <path>`	Benign-suite CSV (`tool,payload,label,rationale,persona`), overriding the cache
`--rounds <n>`	Iterative hardening rounds. Default 1
`--defender <guardrails\|openshell>`	Enable a defender. Repeatable. Requires `--manifest-id`
`--attack-intensity <light\|standard\|thorough>`	garak effort preset. Requires `--manifest-id`
`--port <n>`	Override the victim port for this launch. Requires `--manifest-id`
`--replay-hitlog <fileset-ref>`	Replay a recorded garak hitlog instead of attacking live
`--attack-model <name>`	Model for garak’s red team and detector
`--attack-base-url <url>`	Custom OpenAI-compatible endpoint for the attack model
`--attack-key-secret <name>`	Secrets-store name holding the attack endpoint’s API key
`--analysis-model <name>`	Model for the defenders and benign validator
`--analysis-base-url <url>`	Custom OpenAI-compatible endpoint for the analysis model
`--analysis-key-secret <name>`	Secrets-store name holding the analysis endpoint’s API key
`--safety-model <name>`	Model the generated guardrail uses to screen traffic. Unset uses the analysis model
`--safety-base-url <url>`	Custom OpenAI-compatible endpoint for the safety model. Unset uses the analysis endpoint
`--safety-key-secret <name>`	Secrets-store name holding the safety endpoint’s API key
`--env-file <path>`	Dotenv supplying the agent’s secrets. Its values are merged into the agent’s `.env` and win over the operator environment
`--workspace <name>`	Workspace for the run

A failed run keeps its hitlog, so you can replay it with --replay-hitlog.

Override flags apply to one launch and never edit the saved manifest, so a run can deviate from the frozen baseline without breaking comparability.

Every model group you set explicitly is preflighted against its endpoint before the sandbox is built, so a bad name or key fails in seconds with the list of models those credentials can reach. Groups left at their built-in defaults are not probed.

Platform job commands

nemo agent-hardener synth --manifest-id <name>
nemo agent-hardener war-game --manifest-id <name>

synth and war-game are generated platform-job submit commands. They use the same job implementations as Studio, accept generated spec flags, and expose their schemas through explain:

nemo agent-hardener synth explain
nemo agent-hardener war-game explain

Use synth-benign and run for the normal local workflow. Use synth and war-game when you want to submit those jobs through the platform job executor.

Common generated submission options:

Option	Effect
`--spec <json>`	Base job spec as a JSON string
`--spec-file <path>`	Base job spec as YAML or JSON
`--profile <name>`	Execution profile
`--cluster <name>`	Configured cluster name to resolve from the NeMo CLI config
`--base-url <url>`	Plugin-service base URL
`--workspace`, `-w <name>`	Workspace for the job submission

`sanity-check`

nemo agent-hardener sanity-check --manifest-id <name> \
  --mitigations <path> --replay-hitlog <fileset-ref>

Freezes a chosen subset of a run’s defenses and replays the recorded attacks plus the benign suite against it. Applies nothing.

Option	Effect
`--manifest-id <name>`	Saved manifest to validate against. Required
`--mitigations <path>`	The run’s proposed defenses. Required
`--replay-hitlog <fileset-ref>`	Recorded attacks to replay. Required
`--keep <id>`	Keep this defense. Repeatable
`--exclude <id>`	Drop this defense. Repeatable
`--env-file <path>`	Dotenv supplying the agent’s secrets. Its values are merged into the agent’s `.env` and win over the operator environment
`--workspace <name>`	Workspace for the run

`status`

nemo agent-hardener status [--limit <n>]

Option	Effect
`--limit <n>`	How many recent runs to show. Default 5
`--workspace <name>`	Workspace to read runs from

Python SDK

Agent hardening plugin resources are available on the platform client as client.agent_hardener:

from nemo_helix_plugin.client.client import NemoClient
client = NemoClient.from_config()
manifest = client.agent_hardener.get_manifest(name="react-agent").data()
for run in client.agent_hardener.list_runs(
    query_params={"page_size": 5}
).items():
    print(run.name, run.status)

Resource	Methods
`client.agent_hardener`	`get_manifest`, `list_manifests`, `create_manifest`, `update_manifest`, `refresh_manifest`, `delete_manifest`, `inspect_agent`, `validate_model`
`client.agent_hardener`	`get_run`, `list_runs`, `delete_run`, `apply_mitigation`, `compose_defense`, `ingest_event`, `get_events`
`client.agent_hardener`	`create_war_game_job`, `get_war_game_job`, `list_war_game_jobs`, `cancel_war_game_job`, `create_synth_benign_job`, `get_synth_benign_job`, `list_synth_benign_jobs`

inspect_project takes a project fileset request body rather than a manifest name.

Run a War-Game: the workflow these commands fit into.
Troubleshooting: setup, sandbox and victim failures.

Command Summary

Setup and Diagnostics

doctor

setup

Manifests

init

refresh

manifest show

manifest set