Start here: the basics
What is an agent harness?
A model only predicts text. The harness is everything else: the loop that runs it, the tools it can call, and the limits on what it's allowed to do.
An agent harness is the code that sits around a language model and gives it the parts a model doesn't have on its own: a loop that keeps it running, a way to call tools and act on the results, memory of what happened before, and limits on what it's allowed to do without asking. Anthropic calls the Claude Agent SDK "a general-purpose agent harness." OpenAI calls the system behind Codex "the open agent harness."
A model by itself takes text in and predicts text out, and it can't run a command. Whatever turns that prediction into an agent that edits a file or opens a ticket is the harness.
The pieces
LangChain's engineering team puts it as an equation: agent equals model plus harness. Anything in the system that isn't the model belongs to the harness. The usual pieces:
- The loop. Code that keeps calling the model, feeding it the latest state, until it decides the task is done. A chat app stops after one answer. An agent keeps going because of the loop.
- Tool calling and execution. The model names a tool and some arguments. The harness actually runs it and feeds the result back in.
- Context management and compaction. A model's context window is finite, so the harness decides what to keep and when to summarize older turns. Anthropic's write-up on long-running agents says a general-purpose harness "has context management capabilities such as compaction," and that compaction alone didn't keep a coding agent on track across many sessions. Their setup also had the agent keep progress notes in a file.
- Memory. Anything that outlives one context window: a progress file, a project memory file like
AGENTS.mdorCLAUDE.md, a database the harness reads from on the next run. - Permissions and approval prompts. The harness decides which tool calls run automatically and which stop to ask a person first. Claude Code's permissions model is a harness feature: by default it asks before editing a file or running most shell commands, but reading files in the project needs no approval.
- Sub-agents. Some harnesses can spawn a separate agent instance to handle one part of a task and report back, so the main agent's context stays smaller. LangChain's Deep Agents SDK and Anthropic's Agent SDK both support this.
- The system prompt. The instructions sent before the user's message that set the agent's role and rules. The harness assembles and sends it on every turn.
None of this is in the model's weights. Swap the model under a given harness and the loop, the tools and the approval rules stay the same, which is why the same model can feel like a different product depending on what it's running inside.
Harness, LLM harness, evaluation harness
People use "harness" in two different senses.
Agent harness and LLM harness mean the same thing: the execution system around a model that makes it act. Both names describe the same layer.
Evaluation harness is a different tool entirely. EleutherAI's lm-evaluation-harness is "a framework for few-shot evaluation of language models": it runs a model against a batch of benchmark tasks and scores the answers. It doesn't give the model tools to act with, and it isn't trying to. Apart from the word, the two have little in common.
Examples, in the vendors' own words
Claude Code is a harness built on top of a model: it reads a codebase, edits files, and runs shell commands, asking approval for most of the risky ones. The Claude Agent SDK exposes that same harness, including its context management and tool execution, for developers to build other agents on.
Codex CLI is OpenAI's equivalent. OpenAI describes the reusable part plainly: "A capable agent is more than a prompt and a model response. It needs a way to understand a task, maintain context over time, inspect relevant information, call tools, expose progress, handle failures, request human approval when necessary, and return a useful result. That surrounding execution system is the harness." The Codex harness is open source, and the Agents API gives applications access to it as a managed service, handling "sessions, orchestration, context compaction, and recovery" while the calling application supplies tools.
The OpenAI Agents SDK is a level lower: a library for writing your own agent loop, with tools and hand-offs between agents. LangChain draws the line between the three this way: a framework like LangChain gives you abstractions to build with, a runtime like LangGraph gives you the infrastructure to run agents in production, and a harness like Deep Agents or the Claude Agent SDK bundles in "built-in tools and capabilities for building sophisticated, long-running agents": planning, sub-agent delegation and a managed filesystem, already wired in.
Harness, framework, model, gateway
| Model | Agent harness | Framework | LLM gateway | |
|---|---|---|---|---|
| What it is | Predicts text from text | The loop, tools, memory and limits around a model | A library of abstractions for building agents or harnesses | A proxy between apps and model providers |
| Does it act | No | Yes, this is what gives a model the ability to act | Only once you build or wire in a harness with it | No, it only moves and manages model calls |
| Examples | Claude Opus, GPT-5 | Claude Code, Codex CLI, Claude Agent SDK | LangChain, OpenAI Agents SDK | LiteLLM, Portkey, Cloudflare AI Gateway |
| Where you'd put it | Behind an API call | On your machine, in a container, or as a managed service | In your own agent's codebase | In front of your model provider calls |
Where this sits next to MCP and a gateway
An LLM gateway sits between an app and the model providers. The harness sits around the model and runs the task. An MCP gateway sits between the agent and the tools it calls through MCP, and decides which agent can call which tool.
Statio today is an MCP gateway. It doesn't proxy model calls or run an agent loop. It sits in front of the MCP servers an agent's harness calls and controls which tools each agent can reach. MCP permissions covers that layer in more depth.
Next
What is an LLM gateway? covers the layer in front of the model provider. What is an AI agent? covers the agent a harness produces, with real examples of what each one is allowed to touch. What is an MCP server? covers how a harness's tool calls reach an outside service.