Agent harnesses

D1 · StoryFor young children and total beginners

Guess first: who actually runs the command, the model or the harness?

A model on its own can only write words. It cannot open files or press buttons.

A harness is the program around it. It reads what the model asks for, checks it is allowed, does it, and tells the model what happened.

The model asks, the harness does it

1. The model asks: open this file
2. Harness checks: is it allowed?
3. Harness does it: opens the file
4. The model hears: what happened

Like: A learner driver in a dual-control car: the learner steers, the instructor can brake.

D2 · PictureFor curious beginners

A harness is everything except the model: the loop that calls the model, the tools it is offered, the code that runs those tools, and the rules for what needs a person's approval.

It also manages context: what goes into each call (instructions, project notes, file contents, tool results) and what gets summarised or dropped as the window fills. Many harnesses plug in extra tools through a standard protocol such as MCP.

The same model can feel very different in different harnesses. Open harnesses let you choose the model, including one running on your own machine.

Like: A learner driver in a dual-control car.
Where it breaks: A learner improves with every lesson. A model learns nothing from a session unless the harness writes notes it can read next time, and the 'instructor' is a set of coded rules plus you approving actions.

D4 · MechanismFor practitioners

A harness runs one loop. It sends the context to the model and reads the reply. If the reply is a tool call, it checks permission, runs the tool and appends the result. It stops when the model answers without a tool call, or when a step budget runs out.

The model keeps nothing between calls, so the harness resends the whole context every turn: system prompt, tool definitions, the task and every earlier call and result. Each call is longer than the last, so the total input over n calls grows roughly with n².

Prompt caching softens this: the unchanged prefix is read from a cache at a fraction of the input price, and only the new tail is written. The permission check runs in the harness, not the model. A rule table maps each kind of tool and each mode to allow, ask or deny, and a denial goes back to the model as a tool result it can react to.

Try the interactive version in the map.

Things to try

• In ask-before-write mode, deny the first test run. What does the model do instead?
• Switch to read-only. Where does the run end, and what does the model hand back?
• Switch to full auto and run to the end. Which action happened that nobody approved?
• Set the step budget to 4. Which turn is the last one, and is the bug fixed?
• Compare the last row's Σ input with its own input. Then open "The same loop, run for longer" and compare the cost with and without the cache at 100 calls.

context = [system_prompt, tool_definitions, task]
for step in 1..max_steps:
    reply = model(context)                  # the whole context, every call
    context.append(reply)
    if reply has no tool call:
        return reply.text                   # final answer: the loop ends
    call = reply.tool_call
    rule = rules[mode][kind_of(call.tool)]  # allow | ask | deny
    if rule == "ask":
        rule = ask_human(call)              # show the call, wait for yes or no
    if rule == "allow":
        result = run_in_sandbox(call)
    else:
        result = "Not run: permission denied"
    context.append(result)                  # the model sees denials too
return "stopped: step budget reached"

# tokens: prefix P resent every call, about a tokens added per call
input(k)       = P + a * (k - 1)
total_input(n) = n * P + a * n * (n - 1) / 2
# with a cache: read last call's prompt cheaply, write only the new part
cost(k) = (read_x * input(k - 1) + write_x * a) * price_in + out(k) * price_out

Trade-offs

• Asking before every write is safe but slow, and people asked too often start approving without reading.
• Full auto finishes sooner but acts on whatever the model decides, including steps suggested by text injected through a file or web page. Run it in a sandbox.
• A small step budget caps cost and runaway loops, but it can stop a task just before it finishes.
• Resending the whole history makes long runs expensive. Caching cuts the price of the repeated prefix; summarising or dropping old turns cuts the tokens themselves but can lose detail.
• Cached prefixes expire after a few minutes without use, so a long wait for a human's approval can mean the next call pays to write the cache again.
• Rules keyed on the kind of tool are coarse. Real harnesses also match specific commands and paths, and should not trust a tool's own description of what it does.

D5 · FrontierFor experts

"A model plus tools" undersells the harness: the same model behaves differently depending on the loop, the context handling and the permissions around it.

Containing injection. Because prompt injection is unsolved, harnesses limit the damage instead: break the lethal trifecta of private data, untrusted content and a way to send data out (Willison, 2025).

Approval fatigue. Constant prompts teach people to click yes. Anthropic reports that sandboxing its coding agent's files and network cut permission prompts by 84% in internal use (Anthropic, 2025).

Plug-ins run with your rights. Tools added through a protocol such as MCP can carry hidden instructions or change after approval (Invariant Labs, 2025).

Context management. Compaction, note files and sub-agents are still largely hand-tuned in each harness (Anthropic, 2025), and results depend on model, tools and task together, so harnesses are hard to compare.

Examples as of 2026-10-13

• Claude Code
• OpenCode
• OpenClaw
• Hermes Agent

Sources

1. Building effective agents (Anthropic) (2024-12-19)
2. Effective context engineering for AI agents (Anthropic) (2025-09-29)
3. Model Context Protocol specification (2026-07-28)
4. The lethal trifecta for AI agents: private data, untrusted content, and external communication (Simon Willison) (2025-06-16)
5. Model Context Protocol specification: Tools (human in the loop, untrusted tool annotations) (2026-07-28)
6. Prompt caching (Claude API documentation) (2026-10-15)
7. Beyond permission prompts: making Claude Code more secure and autonomous (Anthropic engineering blog) (2025-10-20)
8. MCP Security Notification: Tool Poisoning Attacks (Invariant Labs) (2025-04-01)

How it connects

• Agent harnesses runs and guards The agent loop.
• Coding agents runs inside a Agent harnesses.
• Computer & browser use sandboxed by Agent harnesses.

More in Layer 8 · Agents

• The agent loop
  Plan, act with a tool, observe the result, and repeat until the goal is met.
• Coding agents
  Agents that work inside a code repository: read files, make edits, run commands and tests, and iterate until the checks pass.
• Computer & browser use
  Agents that operate a screen like a person: look at a screenshot, then click, type and scroll.
• Multi-agent systems
  Several agents with different roles or contexts work together on one task.