Wererat

A wererat ally is the reformed thief who controls her curse, the sewer-guide the party hired in a port city, or the urban ranger who took the lycanthropy as a deliberate choice. Frame the relationship around access, not combat. The wererat knows every roof, drain, and sewer in the city and can move through them faster than any human guide. That is the value. The combat contribution is secondary.

In a fight, the wererat's role is mobility and flanking. 30 ft. walk plus 30 ft. climb means rooftop chases and second-story entries are trivial. Hybrid form gives the Bite, and a curse landing on an enemy who later drops creates a converted ally for the GM (the party's GM, in this case) to play. That is a complication most groups don't want, so most wererat allies stick to Scratch and Hand Crossbow and reserve the Bite only for an enemy the party explicitly wants turned. Have the wererat ask permission before a Bite. It is a story tool, not a default attack.

Outside combat the wererat is the contact. She knows the smuggler with the back room, the alchemist who sells without questions, and the watch sergeant who takes bribes. Use her as a navigation system through the city's underbelly. The party loses three sessions of investigation if she is not on the team.

Have her one-rule be no bites without consent. The line is what makes her a person, not a monster.

A wererat is a city-tier infiltrator with a curse mechanic and a hand crossbow. CR 2, AC 13, 60 HP, two attacks per Multiattack using Scratch (+5 for 6 slashing) or Hand Crossbow (+5 for 6 piercing at 30/120 ft.), with the option to replace one attack with a Bite for 8 piercing plus the curse. The Bite is restricted to Rat or Hybrid form, so a wererat opening in humanoid form must spend a bonus action on Shape-Shift before it can curse anyone.

Run wererats as ambushers, not standup fighters. The 30 ft. climb speed plus Stealth +5 plus Darkvision 60 ft. means they prefer to start in the rafters or the sewer mouth, drop into hand crossbow range, and pick at the party from cover. Once the party closes, shape-shift into hybrid form and start biting for the curse. The DC 11 Constitution save is low enough that a back-rank PC will fail it sooner or later, and a cursed PC who drops to 0 HP becomes a wererat under the GM's control with 10 HP. That is the encounter's hook: the party doesn't just want to kill the wererats, they want to keep their cleric from becoming one.

Damage priority is whoever is wounded enough that the Bite's curse follow-through matters. The wererat will not waste a Bite on a full-HP target since the curse kicks in only if the target hits 0 later. Save the Bite for the round after a PC has taken a hit and looks droppable. This makes the rogue's slowed-down ally suddenly the highest priority.

Wererats are cowards. Once Bloodied (30 HP), shape-shift to rat form (Small, Stealth still +5) and disappear into a drain or cracked wall. They come back. The infestation is a campaign element, not a single fight. A party who killed three wererats but let one escape will see the survivor next session, recruiting from the docks.