The threat blocking agent you can set up in five minutes and actually understand.
Report Bug · Request Feature · Website · Discord
curl -fsSL https://breachharbor.com/install.sh | sh
Help keep it free and actively developed by buying me a coffee ☕, becoming a sponsor, or supporting on Patreon. If you're running this at a company, a business license funds the project too (see Pricing on the website). Every contribution helps keep the build machines running and the blocklist honest.
One static binary, two modes:
breachharbor agent # watches one machine and blocks attackers
breachharbor server # aggregates signal from many agents, publishes blocklists
The agent auto-detects your logs (sshd, nginx, fail2ban), watches quietly for 24 hours by
default, and blocks nothing until you tell it to. Everything it blocks lives in one dedicated
firewall table, so breachharbor agent flush undoes all of it, instantly, any time. No server
required: the agent is a complete product on its own.
curl -fsSL https://breachharbor.com/install.sh | sh
breachharbor doctorThat downloads the right prebuilt binary for your OS/arch (linux/amd64, linux/arm64,
darwin/arm64, openbsd/amd64), verifies its checksum, and installs it to /usr/local/bin.
No release built for your platform yet? Build from source instead (requires Go 1.24+):
git clone https://github.com/Dyneteq/Breach-Harbor.git
cd Breach-Harbor
make build
./bin/breachharbor doctordoctor tells you what's ready to go and what isn't; it never needs root.
breachharbor agent flush # always safe: reports what would be removed
sudo breachharbor agent flush --yes # actually removes itsudo breachharbor agent install # systemd (Linux) or launchd (macOS)
sudo breachharbor server install --listen :8080Installs a service that starts at boot and restarts on crash: a systemd unit on Linux
(sudo systemctl status breachharbor-agent), a LaunchDaemon on macOS (sudo launchctl list | grep breachharbor, logs at <data-dir>/agent.log). The agent comes up in dry run by default;
add --enforce to start enforcing immediately. breachharbor agent uninstall removes the
service and flushes every firewall rule it added.
breachharbor update # installs the latest release over the running binary
breachharbor update --check # just report whether a newer release existsRe-run with sudo if the binary lives in a root-owned directory (the default
/usr/local/bin install does). Updates both breachharbor and bh when both are present.
Being rebuilt into the CLI above, one milestone at a time:
- ✅ M0: it builds.
version,doctor,agent flushwork today. - ✅ M1: the agent stands alone.
agent run/status/top/enforce/sources/install/uninstallall work. - ✅ M2: the server is useful.
server run/install/statusandagent enrollwork; agents can publish to a server and pull its blocklist. - ⏳ M3: trust hardening and M4: sharing. Sketched, not started.
make build # bin/breachharbor + bin/bh
make test
make vet
make fmt-checkCI runs all of these plus a cross-compile check for linux/amd64, linux/arm64, darwin/arm64, openbsd/amd64.
docker build -t breachharbor .
docker compose upStatic binary, no CGO, ~8MB image. Healthcheck is just breachharbor doctor --json.
- Nothing leaves the machine unless you run
breachharbor agent enroll <url>;doctorshows exactly what would be sent and where. - No AI/ML. Detection is plain rules plus free public threat feeds (Spamhaus, FireHOL, Tor exit nodes).
PRs welcome: fork, branch, and open a pull request. Add tests: this runs as root and edits firewalls, so untested code doesn't ship.
IP geolocation/ASN enrichment is powered by one of these, whichever database you install into
./data (see scripts/download-geoip.sh and scripts/download-geoip-dbip.sh):
- MaxMind GeoLite2 - this product includes GeoLite2 data created by MaxMind, available from maxmind.com.
- DB-IP - IP geolocation by DB-IP, licensed under CC BY 4.0.
Join the Breach Harbor community:
