An AI harness is the software around a language model that turns it into an agent: the loop that calls the model again and again, the tools it may use, the context it sees, the rules that decide what runs without asking, and the sandbox that limits the damage when it runs anyway. The model predicts text. The harness does everything else. The field’s one-line formula, used by LangChain, Databricks and Microsoft alike: agent = model + harness.
Claude Code, Codex, OpenCode, goose and Hermes Agent are harnesses. So is Contenox. The model inside any of them can be swapped; what you are really choosing when you choose one is the harness.
What an AI harness does, in one turn
Here is the whole thing, stripped to its loop. This is runnable pseudocode, not a diagram:
messages = [system_prompt, user_task]
while True:
reply = model(messages, tools=[read_file, write_file, run_command])
if reply.is_text:
break # the agent is done
call = reply.tool_call # e.g. run_command("npm test")
if not policy.allows(call): # permissions live here, not in the model
messages.append(denied(call))
continue
result = sandbox.run(call) # the sandbox limits what it can touch
messages.append(result) # the model sees what happenedTwelve lines, and every decision that matters is on one of them: which tools exist, who decides whether a call runs, where it runs, and what the model is told afterwards. A production harness adds context trimming, retries, timeouts, logging and an interface, but it is this loop with more care around it.
Watch what the model never does in that loop. It never touches a file. It never runs a command. It asks, in a structured message, and the harness acts or refuses. That is why “the AI deleted my files” is almost always a harness story: the harness let the call through.
What’s inside an AI harness
Every harness has the same parts; the differences are in how each is done.
| Part | What it decides | Where it goes wrong |
|---|---|---|
| The loop | When to call the model again, when to stop, what to do on an error | Stops after the first passing test; retries a flaky command forever |
| Tools | Which actions exist and how they are described to the model | A clumsy edit format makes a good model fumble; too many tools eat the context |
| Context | Which files, instructions and earlier turns the model sees this turn | Early instructions fall out of a long session; a 5,000-line test log buries the one error |
| System prompt | How to plan, when to run tests, when to ask | Vague prompts produce confident guesses |
| Permissions | What runs without asking, what asks, what is blocked | Everything asks, so the user switches it off; or a model judges its own risk |
| Sandbox | Where commands may write, whether they reach the network | None, so one wrong rm is unrecoverable |
| Sensors | Tests, linters and type checks that feed results back | No feedback, so the agent declares victory on broken code |
| Memory | What persists between sessions: notes, progress files, project rules | Nothing persists, so every session rediscovers the build command |
| Observability | Logs and traces of every call and its cost | No log, so nobody can say what the agent did or what it cost |
Red Hat’s Ralph Bean draws one more line that helps: the sandbox is subtractive, it takes abilities away, and the harness is additive, it gives the model better odds. A sandbox failure means the agent did something it should never have been able to do. A harness failure means it did badly something it should have done well.
Why the harness changes the result
Because most agent failures are not the model being unable to write the code. They are the loop around it going wrong. The measurements are not subtle.
Terminal-Bench 2.0 lists agent and model separately, and its published submissions include one model in several harnesses. For Claude Opus 4.6:
| Harness | Tasks solved |
|---|---|
| Terminus 2, the benchmark’s own minimal agent | about 63% |
| GitHub Copilot CLI | about 60% |
| Terminus-KIRA, from KRAFTON AI | about 74% |
Same model, same tasks, a 14-point spread. The others who looked found the same:
- LangChain moved its coding agent from the top 30 to the top 5 on Terminal-Bench 2.0 by changing only the harness.
- A paper at an ICML 2026 workshop separated the two effects statistically. Picking the best harness gains about as much as picking the best model, and some harnesses suit some models better than others.
- Anthropic gave one Claude model the same task twice, a retro game maker. Alone: 20 minutes, $9, and the core feature didn’t work. In a harness with a planner, a builder and a separate skeptical tester: 6 hours, $200, a working game.
Model generations still move more than harnesses do. On Terminal-Bench 4.0, Claude Code’s own rows span from 12.4% with Sonnet 5 to 64.8% with Opus 5.5. But you don’t pick a model generation; you pick the best one you can afford. The harness is the part you can still change.
Harness vs agent vs model vs framework vs runtime
Five words that get used as if they were rivals. They are layers.
| What it is | Examples | |
|---|---|---|
| Model | The LLM. Text in, text or a tool request out. Never touches your disk. | Claude Opus 5.5, GPT-6 Astra, DeepSeek V4.1 Flash, Qwen 3.8 |
| Harness | Everything around the model: loop, tools, context, permissions, sandbox | Claude Code, Codex, OpenCode, goose, Hermes Agent, Contenox |
| Agent | Model and harness together, working on a task | ”Claude Code with Opus 5.5” |
| Framework or SDK | Parts for building your own harness | LangGraph, the OpenAI Agents SDK, Microsoft Agent Framework, the Claude Agent SDK |
| Runtime | The part of a harness that runs the loop and dispatches tools, when someone splits it out | Red Hat’s term for Claude Code’s engine; Microsoft’s “Harness” package |
The borders are contested on purpose. Anthropic calls its Claude Agent SDK “a general-purpose agent harness”: Claude Code’s loop, tools and permissions as a Python or TypeScript library. Microsoft’s Agent Framework ships a create_harness_agent factory that composes tool calls, approvals, todo tracking and compaction into one object. Red Hat argues the opposite: the engine that runs the loop is a runtime, and the harness is only the part you tune, your AGENTS.md, skills, custom tools and tests. Both uses are live. When someone says “harness”, ask whether they mean the whole machine or the part they can edit.
Scaffolding is the older word for the same thing. The UK government’s AI safety institute described an agent as a model plus its scaffolding in October 2023, and research papers still say scaffolding. Harness is the 2026 product word.
AI harness examples
The ones people compare, as of November 2026:
- Built by a model company: Claude Code (Anthropic), Codex (OpenAI, open source), Antigravity CLI (Google), DeepSeek Harness (DeepSeek, open source), GitHub Copilot CLI, IBM Bob for enterprise.
- Independent, open source, any model: OpenCode, Kilo Code, Cline, goose, Pi, Hermes Agent, Aider, OpenHands.
- Launched by a model runner: Ollama is not a harness, but
ollama launchstarts Claude Code, Codex, OpenCode, Pi or DeepSeek Harness against a local or Ollama Cloud model with one command. - Desktop apps built around the permission layer: Contenox, goose’s desktop app, Cline Desktop.
- For benchmarks: Terminus 2, the minimal agent the Terminal-Bench team built as a neutral baseline.
The full matrix, with license, models, sign-in, Windows support, permissions and sandbox for each, is in the AI coding harness comparison. For the coding-specific angle, including harness engineering in your own repo, see what is an AI coding harness?.
Which is the best AI harness?
There isn’t one, and the benchmarks say why: a harness tuned for one model does worse with another. The ICML paper found some harness-model pairs that beat both components’ averages. Four questions pick one faster than a leaderboard:
- Which model can you pay for? A Claude plan only works in Claude Code. A ChatGPT plan works in Codex, OpenCode and several others. A Copilot plan works in Copilot CLI and OpenCode. Local models work in OpenCode, Codex, Pi, Hermes and Ollama’s launcher.
- Where do you want to work? Terminal, editor, desktop app, or a chat app on your phone (Hermes Agent).
- What decides whether a command runs? A rule list you can read (Codex, Kilo Code, Contenox), a model judging risk (Claude Code’s
automode, Hermessmart), or nothing (Pi, goose’s default). - What stops the damage when the rule is wrong? A sandbox on your OS (Codex natively on Windows; Claude Code on macOS, Linux, WSL2), a container you run, or nothing.
Benchmarks rank the first question and ignore the other three. The third and fourth are where harnesses differ most, and where “I switched everything to YOLO mode” starts. Why that happens, and what each agent’s skip-all flag does, is in YOLO mode.
How to build an AI harness
The loop at the top of this page is the whole minimum: a model call, three tools, a policy check, a sandbox call. People build that in an afternoon. What takes months is everything the table lists, and three things in particular:
- Context management. The agent must keep working when the conversation no longer fits. Summarize old turns, keep a progress file, give side tasks a fresh context.
- Permissions that people keep on. If every call asks, users switch approvals off and the policy check becomes decoration. The rules have to say yes to the routine calls on their own.
- Feedback the model can act on. A test runner that prints the one failure, a linter whose message says how to fix it. OpenAI’s team that built a million-line product with no hand-written code spent its time on exactly this: docs as a map, enforced architecture layers, linters and structural tests.
AI agent platform architecture walks through one real build, with the bugs that showed where each rule belongs.
Where the word came from
The mechanisms predate the name. ReAct (2022) alternated reasoning and acting; Toolformer (2023) showed models calling tools. “Harness engineering” as a discipline arrived in February 2026 from two directions at once: Mitchell Hashimoto made “engineer the harness” a step in his own workflow, adding a line to AGENTS.md or a small tool every time the agent got something wrong, and OpenAI published its account of the harness-engineered million-line product. Birgitta Böckeler’s April 2026 write-up on martinfowler.com split it for people who use agents rather than build them: guides steer the agent before it acts, sensors check it after.
The name trap: not everything called “harness” is this. EleutherAI’s lm-evaluation-harness runs benchmarks on models. Harness is also a CI/CD company, which is why “Harness AI” in an ad is usually that. AWS AgentCore has a managed “Harness” for building agents. And “DeepSeek Harness” is a product name, DeepSeek’s own coding agent.
Contenox
Contenox is a harness built around the permission part of the table: a policy engine decides what the agent may run, with rules you can read in Permissions, so that the routine calls go through and the rest asks. It runs its own agent with the model you pick, hosts Claude Code and other ACP agents under the same rules, and keeps every call in a log. Download it here.
Related guides
- What is an AI coding harness?: the coding case, and harness engineering in your own repo
- AI coding harness comparison: 16 harnesses, every cell checked
- AI agent permissions: the rules a harness enforces, and what to allow
- What is an AI coding agent?: one turn of the loop in JSON