Incubus

An allied incubus is a demon doing you a favor for reasons of its own, and you should set the price clearly before the party agrees. The cleanest framing is leverage: the party has captured the incubus's Soul Bag (use the Night Hag adjacency if you want), holds blackmail material against the incubus's current identity, or saved its life from a paladin's smite and is now owed a debt. Neutral Evil does not become Neutral Good because the players were nice. The incubus is loyal to the contract, not the people.

In combat, the incubus does what it does best: surgical removal of one named target. Multiattack is two Restless Touch hits at +7 for 3d6+5 psychic plus the 24-hour short-rest-denial curse, and that curse lands on enemies as well as PCs, which is excellent for a long campaign of attrition warfare against a recurring foe. Nightmare on a Recharge 6 is the closer; aim it at the enemy commander once they're below their bonus-action threshold of 20 HP. Disguise Self at-will means the incubus is an infiltration asset for the whole campaign, not just a fight.

The exit is the price. Once the agreed favor is done, the incubus collects what it was promised and leaves. If the party tries to renegotiate or hold the incubus past the contract, it goes Etherealness on its next turn and is gone. The incubus will remember everyone who tried to cheat it and will work against them later, telepathically, from inside their dreams via a borrowed Dream spell.

Write the contract on a piece of paper at session start. When the party fulfills it, hand them the paper. When they break it, set the paper on fire in front of them.

An incubus is a social monster first and a fight last. The whole stat block is built for infiltration: Deception +9, Persuasion +9, Stealth +7, Disguise Self at-will, Etherealness at-will, telepathy 60 ft., and the Succubus Form trait that lets it present as either presentation by long rest. The party should know an incubus is in town for two sessions before they ever roll initiative against one.

When combat finally happens, the incubus opens with Nightmare as a bonus action. DC 15 Wisdom save against one creature within 60 ft.; on a failure, if the target has 20 HP or fewer, they fall Unconscious for an hour or until damaged, and otherwise they take 4d8 psychic. That's a fight-ender against a downed PC and a serious tax on a healthy one. It's Recharge 6 so it'll fire roughly once per encounter; pick the moment. After the bonus action, Multiattack is two Restless Touch attacks at +7 for 3d6+5 psychic each, and every hit applies a 24-hour curse that denies short-rest benefits. Even if the party wins the fight, the curse follows them home.

Spellcasting is the escape hatch. Hypnotic Pattern (DC 15 Wisdom save, 30-foot cube) is the panic button when the party closes; one good cast can incapacitate three frontliners and let the incubus walk to the door. Etherealness is the actual exit. The incubus drops onto the Ethereal Plane as an action and is gone, free to return to the party's town next week wearing a new face. Dream is for the long game: a 1/day plant-an-image-in-sleep that lets the incubus continue working a target who the party already drove out of one identity.

Don't run the incubus to the death. They are not soldiers, they are predators with patience. Once Bloodied, the incubus uses Hypnotic Pattern, then Etherealness, and disappears. Give the players a beat where the room goes still and a single black feather is on the floor where the incubus was standing.

The incubus should already have one PC's true name written in a notebook before initiative rolls. That detail does the horror work without a single die.