JustujuAI, layer by layer.Open in the interactive map

Agent harnesses

The program wrapped around a model that turns it into an agent: it runs tools, asks permission, manages context and keeps memory.

Layer 8 · Agents · Run time · Draft, awaiting expert review, reviewed 2026-10-02

Read first: The agent loop, Tool use & protocols (MCP).

D1 · StoryFor young children and total beginners

Guess first: who actually runs the command, the model or the harness?

A model on its own can only write words. It cannot open files or press buttons.

A harness is the program around it. It reads what the model asks for, checks it is allowed, does it, and tells the model what happened.

Like: A learner driver in a dual-control car: the learner steers, the instructor can brake.

D2 · PictureFor curious beginners

A harness is everything except the model: the loop that calls the model, the tools it is offered, the code that runs those tools, and the rules for what needs a person's approval.

It also manages context: what goes into each call (instructions, project notes, file contents, tool results) and what gets summarised or dropped as the window fills. Many harnesses plug in extra tools through a standard protocol such as MCP.

The same model can feel very different in different harnesses. Open harnesses let you choose the model, including one running on your own machine.

Like: A learner driver in a dual-control car.
Where it breaks: A learner improves with every lesson. A model learns nothing from a session unless the harness writes notes it can read next time, and the 'instructor' is a set of coded rules plus you approving actions.

D5 · FrontierFor experts

Open problems: prompt injection, where text in a web page or file steers the agent, is unsolved, so harnesses lean on sandboxes and approvals. Constant approval prompts tempt people to allow everything.

Context management is still largely hand-tuned, and harnesses are hard to compare because results depend on the model, the tools and the task together.

Examples as of 2026-10-13

Sources

  1. Building effective agents (Anthropic) (2024-12-19)
  2. Effective context engineering for AI agents (Anthropic) (2025-09-29)
  3. Model Context Protocol specification (2026-07-28) (2026-07-28)
  4. The lethal trifecta for AI agents: private data, untrusted content, and external communication (Simon Willison) (2025-06-16)