Once upon a codebase forest: The story behind Harness Your Mechs

When it's over, there's a section for the grown ups that explains what each part of the story means for securing software in a world where AI coding agents write more of it every day.

AT and the forest that kept growing

AT is a guardian. He is small, and he is steady, and he is very good at paying attention. Wherever AT goes, he carries his staff. It glows a soft, steady green, like a light left on so you can find your way home.

One evening, AT was working late at the base on his homeworld. He set his staff down next to his monitor, just for a moment, and leaned in to read the screen. On the screen, a little cursor blinked, waiting for someone to type.

Blink. Blink. Blink.

The staff began to hum. Its green glow flickered in time with the cursor. Then, with a quiet whoosh, the staff slipped right through the screen. And it was gone.

AT did not panic. Guardians don't. He looked at the blinking cursor. He took one deep breath. And he dove in after his staff.

AT tumbled, and tumbled, and landed with a soft thump.

He was in a forest. But it was not an ordinary forest.

Every leaf was made of code. Every root was made of code. Every tree, from the bottom of its trunk to the very tip of its tallest branch, was made of little letters and numbers and brackets, stacked up just so. When the wind blew, the leaves rustled like a keyboard.

AT went to brush himself off, and then he stopped. He held up his hands.

They were made of tiny squares. Neat little blocks of light, like the pictures on an old computer screen. He wiggled his ears. Squares. He peeked over his shoulder at his hood. Squares there, too.

AT was pixelated, from the tip of his hood all the way down to his toes. In a world made of code, he was made of code, too.

He decided he rather liked it.

Then he looked around. Somewhere in this forest was his staff. And he was going to find it.

The forest was a busy place.

All around him, little growers hurried here and there. They had round bellies and quick feet and pockets full of seeds. Everywhere they went, they planted new saplings.

Pat, pat, plant. Pat, pat, plant.

The growers were cheerful, and they were helpful, and they were very, very fast. "Morning," one called as it zipped past AT, already planting three more saplings.

Every morning, there were more trees than the night before. Paths that were open yesterday were full of brand new branches today.

The forest grew, and grew, and grew. That was a good thing. A growing forest is a happy forest. But the more it grew, the deeper AT's staff was buried.

AT did not travel alone. Clanking along beside him was RNG-R, a very old machine with a very old sensor on top.

RNG-R had been with AT for a long time. It was loyal, and it was sturdy. But its sensor beeped at everything.

It beeped at roots. It beeped at rocks. It beeped at shadows. Once, it beeped for a whole minute at a leaf that looked a little bit like a bug.

Beep. Beep. Beep.

After a while, AT stopped listening. When everything beeps, it's hard to tell which beep matters.

So when the ground turned soft beneath their feet, the sensor beeped, and AT didn't notice. The ground gave a little sigh, and then it gave way. Down slid AT. Down slid RNG-R, its sensor still beeping.

AT grabbed a strong root with both hands and held on tight. He pulled himself up, and then he pulled RNG-R up after him. They sat at the edge of the sinkhole, muddy and puffing, but perfectly fine.

The old sensor was still beeping. It had known something was wrong. But it couldn't tell AT where, or why, or what to do about it.

"Knowing something is wrong," AT said to RNG-R, "is not the same as knowing how to fix it."

RNG-R beeped. AT decided to take that as a yes.

Just past the sinkhole, AT spotted a soft green glow between the trees.

It was a little outpost with a round door and a lantern in the window. A sign above the door said THE LAB. Inside, a few builders in work aprons were tinkering at long wooden tables.

The builders had walked forests like this one many, many times. They knew how forests grow, where the soft ground hides, and what it takes to keep a path safe. They listened carefully while AT told them about his staff.

Then they unrolled a map across the table. The map showed the forest ahead in four parts: the growing edge, the old woods, a stretch of ground the map didn't fill in at all, and, at the very heart of the forest, a deep, quiet place where something glowed green.

AT studied the map for a long time. Then he tapped the first part.

"First," he said, "the growers."

The builders packed their tools and followed AT to the growing edge.

First, they counted the growers, every single one. There were more than anyone expected. A few had even wandered off to plant on their own, so AT went and found them, too. After all, you can't look after a grower you don't know about.

One by one, they fitted each grower with a small green sensor, no bigger than a button. The growers didn't mind one bit. They just kept planting.

But now, every time a grower planted a sapling, the little sensor checked it. Was the soil firm? Were the roots strong? Was it planted in a safe spot?

Plant, check. Plant, check. Plant, check.

Healthy saplings grew straight and tall. Wobbly ones were fixed right then and there, before they could lean over the path. The trail ahead came up solid and safe, and the growers didn't slow down at all.

AT smiled. Then he looked past the growing edge, deeper into the forest.

There were old trees in there. Big ones. Trees planted long ago, before anyone checked anything at all. Some were perfectly healthy. Some might not be. From here, there was no way to tell.

Checking the new trees, AT realized, didn't check the old ones. He would need some help.

So AT went back to the Lab, and the builders helped him put together a squad.

First, RNG-R got a brand new core, right in the middle of its chest, so it could think for itself instead of just beeping. Its job was to scout ahead and find what needed finding.

Next came VER-8, tall and careful, with big round lenses. VER-8's job was to look closely and decide what was real and what was just a shadow.

Last came PAT-3, sturdy and steady, with a toolbox for hands. PAT-3's job was to fix whatever needed fixing.

Three mechs, each with a job. AT gave each one a pat on the shoulder, and into the old woods they went.

Soon they came to the Split Canopy Crossing.

Here, the old trees grew so close together that their branches tangled overhead and blocked out the light. There was a deep chasm to cross. There was something moving in the dark on the far side. And there was a rope bridge that was starting to sag in the middle.

The mechs got to work. But the work was slow.

RNG-R searched tree by tree by tree, checking every single one. VER-8 stopped at every shadow to study it, just in case. PAT-3 waited, and waited, for someone to tell it what to fix.

And on each mech's core, a little power bar went down, and down, and down.

AT watched the bars drop. His mechs were trying their very best. They just couldn't see the forest clearly enough to know where to look.

AT walked back to the nearest outpost. "My mechs are good mechs," he told the builders. "But they can't see the forest the way you do. Can you help me show them?"

The builders nodded. Together, they built a harness: a frame that fit around all three mechs at once and connected them to everything the builders knew about the forest. Where the paths ran. Which trees were connected to which. Which kinds of shadows had ever turned out to be anything at all. When they switched it on, the harness glowed green from end to end.

The mechs had the very same cores as before. Nothing inside them had changed. But now, they could see.

RNG-R found the safe path across the chasm in a blink. VER-8 looked at the thing moving in the dark and saw right away that it was only a sleepy owl. PAT-3 found exactly which planks were loose and showed AT its plan. AT looked it over and nodded, and PAT-3 patched the bridge, plank by plank.

Across they went, with plenty of power to spare.

"They didn't need bigger brains," said AT. "They needed a better harness."

The third part of the forest wasn't on the map at all.

It was AT's own ground. He knew every hill and hollow of it, the way you know the way to your own bedroom in the dark. Nobody else knew it the way he did, not even the builders.

The builders met him at the edge with a small wooden box. Inside were blank cartridges, the kind that slot right into a mech, and a set of tiny tools. "Your mechs know the forest," the builders said. "Only you know this part of it."

So AT sat down and got to work. He made one cartridge for the steep hills, one for the narrow gaps, and one for the twisty roots that only grew on his ground. Each cartridge taught his mechs one thing about the way AT did things.

Before he trusted a cartridge, AT tested it on a little practice path he knew by heart. He ran it again, and again, and again, until it got every single turn right.

The harness still told the mechs about the forest. Now the cartridges told them about AT's ground, too. Up the steep hills and through the narrow gaps they went, without a single wrong turn.

At last, they reached the chamber where the staff lay. AT could see its green glow, faint and far away, through a great wall of roots.

RNG-R pushed against the roots. They didn't budge. VER-8 tried, and PAT-3 tried. Nothing. The roots were too strong for any one mech alone.

So AT built one last mech. He called it SYN-C.

SYN-C didn't scout, or check, or fix. Its job was to listen to the whole forest and send each mech exactly where it was needed, at exactly the right moment.

Now AT didn't have to tell every mech what to do. He stepped back and watched, ready to help if anything looked wrong. RNG-R was trusted to scout all on its own. PAT-3 still checked with AT before any big fix. Each mech had earned just the right amount of trust.

SYN-C gave the signal. RNG-R steadied the ground. VER-8 found the one safe spot to push. PAT-3 showed AT its plan, got a nod, and sealed the gap so nothing would slip.

All together, all at once, the roots parted.

AT stepped into the chamber and lifted his staff.

It glowed green, the very same green as the sensors on every mech. The glows pulsed together, slow and steady, like a heartbeat.

AT looked at his squad. "Thank you," he said. And the four mechs blinked their sensors back at him.

Then, far up in the branches, a little cursor began to blink.

Blink. Blink. Whoosh.

AT was back at the base, standing next to his monitor, his staff glowing in his hand.

He looked down. No more tiny squares. He was back to his usual self.

He looked at the screen. Through it, he could still see the forest.

The growers kept planting, and every new sapling was checked the moment it sprouted. Deep in the old woods, the squad kept watch, finding, checking, and fixing, long after AT had gone.

The forest kept growing. It always would. But now, it had a squad that could keep up.

The end.

For the grown ups

The forest is your codebase. The growers are AI coding agents, and they're doing exactly what they should: shipping more code, faster, than any team has had to secure before. That's good news. It also means securing software looks different now.

The old sensor is the legacy scanner most teams already know: it alerts on everything and explains nothing. Finding a problem isn't the same as fixing it, and a wall of alerts nobody acts on doesn't make anyone safer.

AT's journey follows the four levels in The applied AI playbook for AppSec: Four levels for architecting security into the Agentic SDLC. Each level adds capability, and each one changes your team's role.

Level 1: Governed generation (counting and fitting the growers). Know every coding agent in use, run them under company accounts, and deliver security guidance as code is written, through rules files, hooks, and MCP servers. Your team's role is operator. Endor Labs Coding Agent Governance inventories agents, enforces policy through hooks, and checks code as it's written.

Level 2: Agentic security tools (the squad and the harness). Securing new code doesn't secure the code you already have. Purpose-built agents find, verify, triage, and fix vulnerabilities, and people approve what they propose. Your team's role is approver. The mechs' draining power bars are real: in Endor Labs research, agents without precomputed security evidence used 12x more tokens. Same model, different harness, very different result. Endor Labs AI SAST reviews a PR in under a minute and found 2.6x as many real vulnerabilities as Claude Opus 4.7 in an eight-project benchmark.

Level 3: Custom security skills (AT's cartridges). Bought tools know about vulnerabilities. Skills know about you: your triage rules, your fix conventions, your threat model. Your team builds them, tests each one against an eval suite, and has them look up security context instead of re-deriving it. Your team's role is builder. Endor Labs exposes its code context graph to your skills, so they reason over facts instead of hunting for them.

Level 4: Orchestrated security agents (SYN-C). Specialized agents work as a system, acting on events within limits you set, and each agent earns its autonomy one action at a time. Your team's role becomes overseer. Endor Labs provides the same deterministic foundation under every agent, so results stay consistent and costs stay predictable from one repository to thousands.

The Lab is Endor Labs: an applied AI lab for software security. That means a playbook for each level, published research you can check, people who work alongside your team, and AURI as the foundation underneath.

Where is your team in the forest? Read The applied AI playbook for AppSec: Four levels for architecting security into the Agentic SDLC to see what each level takes and to find out where you stand.