OPEN X SECURITY How AgentHarbor keeps your configs safe: backups, drift detection, and undo
← RESEARCH
JUN 24, 2026 · 7 MIN READ

How AgentHarbor keeps your configs safe: backups, drift detection, and undo

Deploying into dotfiles that three other tools also write to is inherently risky. Here is the pipeline that makes every AgentHarbor deploy previewable, reversible, and honest about external changes.

ENGINEERINGAGENTHARBOR

An MCP server entry in ~/.claude/settings.json, a rule block in CLAUDE.md, a .cursorrules file the whole team edits — agent configuration lives in files that you, your teammates, and the IDEs themselves all write to. AgentHarbor's deploy pipeline is built around that assumption.

Any tool that deploys into that space has to assume something else will touch those files.

Preview everything before it lands

The deploy wizard shows a live, syntax-highlighted diff per adapter — split, unified, or raw — before anything is written. Every file gets a strategy dropdown: Replace the file, Merge into existing JSON, or Append to the end. Writes are atomic, so a crash mid-deploy can't leave a half-written settings file.

Backups and one-click undo

Before overwriting anything, AgentHarbor copies the pre-deploy files into a backup store under its app-data directory, along with a manifest of timestamps and content hashes. The success screen has an Undo Deploy button that restores that snapshot in one click, and the project view lets you list, restore, or delete older backups. A launch-time cleanup keeps the per-project backup count bounded so the store never grows without limit.

Drift detection

After a deploy, AgentHarbor remembers the hash of every managed file, and writes a manifest comment block into CLAUDE.md and AGENTS.md marking what it owns. When a file changes outside the app — a teammate edits CLAUDE.md, you tweak .cursorrules by hand — the project gets a drift badge, and the drift review modal shows a side-by-side diff with two honest options per file: Accept the external change as the new baseline, or Restore the deployed content.

Removal is a real inverse

Removing a capability reverses the deploy rather than deleting files wholesale: JSON keys AgentHarbor added are removed while everything else is untouched, markdown blocks bounded by its manifest comments are cut out, and standalone files like skills and agent definitions are deleted. A backup is taken first, so even removal is undoable.

← PREVIOUS Introducing AgentHarbor: one harbor for all your AI agents PRODUCTAGENTHARBOR· 5 MIN READ NEXT → Live usage limits for 17 AI providers, right in your menu bar 6 MIN READ ·USAGE & LIMITSAGENTHARBOR