Prisma AIRS Harness
A local terminal agent for coding and Prisma AIRS operations. It works with your files, runs your project tools, includes the bundled product CLI, and reaches remote tools through Prisma AIRS AI Gateway.
npm install -g @cdot65/prisma-airs-harness
airs env create work
airs
These docs are split in two, because the questions are different. One set explains how the harness works: what runs where, which credential does what, and why a request is allowed or denied. The other set is for operating it: the steps, commands and checks you run to get something done. Start in whichever matches what you are trying to do.
Operate the harness
If you have a task in front of you, start with installation and sign-in. The gateway connection details and access grants come from your administrator, so you'll need those before you can sign in.
| Task | Guide |
|---|---|
| Install, sign in with a workspace key and send a first request | Getting started with a workspace API key |
| Sign in as yourself with Keycloak or Microsoft Entra ID | Getting started with company SSO |
| Connect ServiceNow or another remote MCP server with OAuth | Getting started with MCP servers |
| Separate accounts, destinations and history | Environments |
| Authorize ServiceNow and other remote tools | Gateway MCP |
| Resume work, select routes and configure the terminal | Terminal workflow |
| Provision a workspace with the bundled CLI (administrators) | Provision a workspace |
| Score exported red-team results | TypeSafe Jev judge |
| Look up a command or flag | Command cheat sheet and CLI reference |
| Check that a deployment works end to end | Acceptance validation |
| Build and publish from source | Development |
| Install, upgrade or roll back | Release channels |
Administrators setting up the gateway side will also want the configuration guides for workspaces and API keys, Keycloak, Entra and MCP authorization.
Understand how it works
If you want the model before the steps, or something is behaving in a way you can't explain, start here. The main thing to know is where the line sits between the local runtime and the gateway.
Inference and remote MCP both go through AI Gateway. Files, shell execution, approvals and history stay in the local runtime. Selected file contents and tool results can become model context, though, so something read locally can end up in a request that goes to the gateway. The gateway, in turn, controls model access, policy and upstream MCP authorization.
| Question | Page |
|---|---|
| What runs locally, what runs at the gateway, and which credential covers each path? | Architecture |
| How do a skill and a tool call move through the agent loop? | Skills and the local agent loop |
| What has to be deployed around the harness, and in what order? | Deploy the gateway platform |
Supported platforms are Linux x64, Linux ARM64 and Apple Silicon. There are no Windows or Intel Mac distributions. Channels and how to install or roll back are on the release channels page, and each release's contents and test results are in its release record.
This is the harness product documentation. The separate reference architecture curriculum explains the wider identity and infrastructure system.