Your private guardian
Haris is a security-first desktop AI assistant for Windows. It talks, listens and acts on your PC without trusting the model: read-only and low-risk tools run and are logged, and anything that opens apps, changes files, touches the clipboard, screen or camera, or powers off waits for your click on an approval card.
حارس (Haris) means guardian in Arabic. The interface works in English or Arabic.
Version 0.6.0 for Windows 10 and 11. About 185 MB, with its own Java runtime. Free and open source under the MIT license.
See it work
A 96-second recording of the real app: the first-launch status report, a spoken weather answer, a file search, and an approval card that the user denies.
More videos on YouTube.
Asks before it acts
The model can only ask. Safe tools run and are logged; for everything else Haris shows you what it wants to do and where the result will go, and nothing happens until you click.
- Safe
- Runs and is written to the activity log.
- Confirm
- Needs your click, once or for the rest of the session.
- Critical
- Needs your click every time. Deleted files go to the Recycle Bin. Restart and shut down wait 60 seconds and can be cancelled.
- Approval buttons arm after 0.7 seconds, so a stray key press can't say yes.
- Esc or a 2-minute timeout denies. Voice can never approve.
- There is no shell, exec or script tool. The model can't run code it wrote.
What it can do
25 tools for everyday work on your PC: apps, files, clipboard, reminders, weather, media keys, lock, sleep and restart, message drafts, system status, web search, vision, memory and undo.
-
Your choice of engine
Claude, Ollama or LM Studio on your own PC, any OpenAI-compatible API, or Ollama on a free Google Colab GPU behind a token-checking proxy.
-
Voice
Say "Hey Haris" or hold Ctrl+Space. Replies are spoken sentence by sentence, you can interrupt, and conversation mode keeps listening.
-
Uses your GPU
Whisper turns Arabic and English speech into text on your NVIDIA GPU when you have one, and on the CPU when you don't. Piper voices run locally.
-
Vision, on request
One screenshot or one webcam photo when you ask for it. A screenshot is previewed before you approve it; a webcam photo is taken only after you approve, then shown in the conversation.
-
Encrypted memory
Haris remembers only facts you approve, encrypted with AES-256-GCM. The key lives in Windows Credential Manager.
-
Private web search
Searches go through a SearXNG instance on your own PC. Pages are reduced to text, with hidden elements removed.
-
Status greeting
On the first launch of the day Haris greets you by name and reports CPU, memory, power, engines and weather, without calling the model.
-
English or Arabic
A full right-to-left Arabic interface. Ask in either language. The optional Gemini voice speaks natural Egyptian Arabic.
Security and privacy
Haris was built after auditing a popular open-source assistant that opened firewall ports, switched the Wi-Fi profile to Private and ran model-written code. Each of those is designed out.
| Area | What Haris does |
|---|---|
| Network | The core listens on 127.0.0.1 only. A new 256-bit session token on every launch, Host and Origin checks, and a strict Content Security Policy. Model replies are shown as plain text. |
| Code | No shell, exec or script tool exists. Every action is one of the 25 named tools. |
| Approvals | Only a click approves. Buttons arm after 0.7 seconds; Esc and a 2-minute timeout deny. |
| API keys | Stored in Windows Credential Manager. The interface can save a key but never read it back. |
| Memory | AES-256-GCM, with the key in the vault. Each fact is saved only after you approve it. |
| Files | Only folders you choose. No .. or symlink escapes, secrets can't be read, and only text file types can be created. |
| Outside content | Files, clipboard, web pages and screenshots are marked as outside content. After that, every action that sends data shows you the exact data first. |
| Voice containers | Loopback ports, read-only root filesystem, all capabilities dropped, no-new-privileges, pinned images. |
With a local model, nothing leaves your PC except web searches through your own SearXNG, the address of a page you ask it to read (sent to that website) and the home-city name sent to Open-Meteo for weather. Found a vulnerability? See the security policy.
Problems seen in other AI agents, and why Haris is not exposed to them
| Seen elsewhere (with source) | Haris |
|---|---|
| Tens of thousands of agent servers reachable from the internet (Infosecurity Magazine, Feb 2026) | The core listens on 127.0.0.1 only and never adds firewall rules. |
| One-click takeover through a link that pointed the local control page at another server (CVE-2026-25253) | The window only talks to its own core, enforced by the Content Security Policy, and every request needs that launch's token. |
| A local AI server reachable from other devices on the network, or from a web page through DNS rebinding (CVE-2026-66005) | Listens on 127.0.0.1 only, the Host check stops DNS rebinding, and every request needs the per-launch token. |
| Hundreds of malicious add-ons in an agent's skill store (The Hacker News, Feb 2026) | No plugins, skills or store. The 25 tools are part of the app. |
| Shell commands written by the model run without asking by default (OpenClaw docs) | There is no shell, exec or script tool. |
| Approvals decided by another model, or switched off for a session (Hermes Agent docs) | Only your click approves. Never voice, never a model, and no setting turns approvals off. |
| Hidden text in a document made an agent send files away without asking (The Register, Jan 2026) | File and web content is fenced as data. After that, anything that sends data out asks and shows the exact data. |
Prompt injection is reduced, not solved: read the card before you click. The full threat model is in THREAT_MODEL.md.
Light on your PC
The HUD used to be a Three.js scene. It is now SVG and CSS, and the star turns on the graphics compositor.
Idle HUD, CPU use (% of one core)
About 9 times lighter.
JavaScript bundle
Whisper small, short English phrase
Arabic: 1.52 s on the CPU, 1.06 s on the GPU, using about 0.4 GB of video memory.
Measured on the author's laptop: Intel Core i7-1165G7, Intel Iris Xe and NVIDIA MX450 (2 GB).
Install in three steps
No admin rights needed. Haris installs for your Windows user only.
-
Download and unzip
Get
Haris-0.6.0-windows.zipfrom the latest release and unzip it. Haris is not code-signed yet, so first check the SHA-256 in the release notes and unblock the zip (how). -
Run the installer
Right-click
install.ps1and choose Run with PowerShell. -
Choose an engine
Start Haris from the Start menu, open Settings and pick an engine.
Requirements: Windows 10 or 11 with Microsoft Edge or Chrome. Optional: Docker Desktop for speech-to-text, spoken replies and web search, and an NVIDIA GPU for faster speech-to-text. To build from source you need JDK 21, Maven 3.9+ and Node 20+; see the README.
Questions
Is Haris free?
Yes. Haris is open source under the MIT license, and the full source is on GitHub. Ollama and LM Studio run models on your own PC; cloud engines such as Claude use your own API key.
What leaves my PC?
With a local model, nothing leaves except web searches through your own SearXNG, the address of a page you ask it to read (sent to that website) and the home-city name sent to Open-Meteo for weather. With Claude or another cloud API, the conversation text goes to that provider, including the results of file reads (which run without a click). Screenshots and camera photos are sent only after you approve each one, and the optional Gemini voice sends reply text to Google.
Can the AI run commands or code on my PC?
No. There is no shell, exec or script tool. The model can only ask to use one of 25 named tools, and anything beyond the safe tier waits for your click on the approval card.
Do I need a GPU or Docker?
Neither is required. Docker Desktop adds speech-to-text, spoken replies and web search. If you have an NVIDIA GPU, speech-to-text uses it; otherwise it runs on the CPU. You can also run Ollama on a free Google Colab GPU.
Does it work in Arabic?
Yes. The interface switches to Arabic, right to left. Speech recognition understands Arabic and English, and the optional Gemini voice replies in natural Egyptian Arabic. اقرأ الصفحة بالعربي.
How do I uninstall it?
Run uninstall.ps1 to remove the app. Add -RemoveData to also erase settings, memory, stored keys and engine data.