A useful way to think about a language model is as raw power that arrives without a steering mechanism. The model can reason, write, and plan, but on its own it cannot run a command, read a file, remember what it did yesterday, or stop itself when it has gone off course. The software that wraps the model and turns that raw capability into directed work has acquired a name over the past year. People call it the .
The word is borrowed twice over. In software testing, a test harness is the scaffolding that sets up a system, feeds it inputs, and checks the results. The older meaning is the one I keep coming back to, because it explains the whole story. For most of human history a harness was what let people put an animal's strength to work, and the history of that one piece of equipment turns out to be a surprisingly close guide to what is happening with AI right now.
In this article
- What the harness did for us: how a piece of medieval tack turned animal strength into usable work, and why that is the right lens for the rest of the piece.
- The model is the horse: the argument in one line: the recent leap was mostly the scaffolding.
- What a harness does: the loop at the center of every agent.
- A short history of harnesses: from image-generation rigs and -wrangling to the first coding agents.
- Inside a state-of-the-art harness: the parts: tools, shell, context handling, skills, , memory, and .
- The current field: , , , Kilo, , , and the harnesses that have nothing to do with code.
- Better harness, smaller model: how good scaffolding makes open and local models viable, and what that does to cost and access.
- Orchestration and harnesses on the inside: agent teams, autonomous agents, and the embedded harnesses inside , , Microsoft, and .
- What comes next: agent-first editors, the return of the , and automatic .
What the harness did for us
Humans domesticated the horse on the Central Asian steppe somewhere in the third millennium BCE, and for thousands of years afterward we used it badly. The fault was the harness. The earliest design was borrowed from the yokes used on oxen and ran a strap across the horse's throat. When the horse leaned into a heavy load, the strap pressed on its windpipe, so the harder it pulled the less it could breathe. This throat-and-girth arrangement capped how much a horse could move regardless of how strong the animal was. Rome felt the limit directly. With horses unable to haul much, the empire relied on grain shipped from North Africa and Sicily to feed its capital, and at one point issued edicts capping the weight a horse could be made to pull .
The fix came from China, where over the first millennium BCE the rigid, padded collar took shape. It sat on the horse's shoulders and chest and moved the line of pull off the windpipe and onto the skeleton, where the animal's strength really lives. The same horse that choked under the old strap could now lean into a plough and pull with everything it had. The collar spread west slowly and was in wide use across Europe by the tenth to twelfth centuries.
What followed was one of the larger productivity shifts of the pre-industrial world. A horse in a proper collar worked faster than an ox and for more hours a day, and farmers began swapping oxen for horses at the plough. More land came under cultivation, surpluses grew, and the population of Europe climbed by tens of millions between 800 and 1300, feeding the rise of market towns. Some estimates put the gain in useful animal work at as much as two to three times. Historians argue over the exact figures, and a few have pushed back on the most dramatic tellings of the story. The direction, though, is not in dispute. The animal had not changed. Its strength had been there the whole time. A harness shaped to the way the animal works is what made that strength usable.
Hold that picture. It is the lens for everything below: the same power, released by a better coupling.
The model is the horse
A is raw capability in the same sense. It can reason, draft, and plan, but on its own it cannot run a command, read a file, remember last week, or stop when it has wandered off course. Everything around it that decides what it sees, what it can touch, and when it should halt is the harness. As with the horse, most of the recent gain came from the coupling rather than the animal.
The wave of capable agents that landed between November 2025 and February 2026 came mostly from harnesses getting dramatically better, and only partly from the underlying models improving. The models did improve. But the gap between a model that produces a plausible-looking answer and a system that finishes a real task closed because of work happening in the scaffolding: better tool cataloging, smarter use of the shell, skills and commands, short-lived sub-agents, and far more careful handling of the .
The model is no longer the bottleneck
A widely shared observation among agent builders is that the harness has become the bulk of the engineering. Even the company that makes one of the best models in the world spends enormous effort on the software wrapped around it. Claude Code alone reached an estimated ~$2.5B annualized revenue by February 2026, up roughly 2.5x in three months .
| Claude Code ARR | MCP servers | SWE-bench Verified |
|---|---|---|
| ~$2.5B | 16,000+ | ~2% → 88% |
| annualized, Feb 2026 | by late 2025 | 2023 → 2026 |
SWE-bench scores reflect model and harness combined [R4].
What a harness does
Strip away the marketing and a harness is a loop. The model is called with some context. Its output is parsed. If it asked to use a tool, the harness runs that tool and feeds the result back in. Then the model is called again. The loop repeats until the work is done or a limit is hit.
That loop is older than the current excitement. What changed is everything packed around it: how tools are described, how the context window is managed when it fills up, how the system recovers from an error instead of repeating it, and how it knows when to stop. The Agents materials draw a clean line worth keeping. The , the tool descriptions, and the output format the model follows are the scaffolding. The loop that calls the model, handles its tool calls, and decides when to stop is the harness . An sits one level up and manages several agents, each running its own harness.
A short history of harnesses
The idea did not start with coding agents. It started with people building rigs around the first generative models to get predictable output out of them.
The image-generation prologue
The earliest harnesses were graphical wrappers. When arrived in August 2022, it ran from the command line. Within a month AUTOMATIC1111's web gave people sliders for the things that matter in diffusion: steps, seed, sampler, classifier-free guidance scale. ComfyUI followed in early 2023 with a graph that let people wire generation pipelines together . These were harnesses in everything but name. They existed because a bare model was hard to steer, and the interface made it controllable.
The decisive jump in that world was ControlNet, published in February 2023 by Lvmin Zhang and collaborators at Stanford . It let a diffusion model take a second input alongside the text , a pose skeleton or an edge map, and respect that structure while generating. It was the first time most people saw raw model power and a separate control mechanism working side by side: the model supplied the image, ControlNet supplied the constraint.
Forcing structure out of text models
The same pressure showed up on the text side. Early API users wanted output they could parse, so they wrapped models in prompts that begged for valid JSON and retried when the model produced prose instead. shipped in June 2023, which gave the model a defined way to request a tool . The loop closed when OpenAI launched Structured Outputs in August 2024, where the model's output is guaranteed to match a developer-supplied JSON schema . That progression, from praying for JSON to a hard guarantee, is the history of harnesses in miniature: a workaround becomes a convention becomes a platform feature.
The coding agents nobody trusted yet
Through 2023, a group of enthusiastic and slightly chaotic people on Twitter were running autonomous loops. AutoGPT and BabyAGI chained model calls together and let them set their own subtasks . They mostly did not work. They looped, burned , and wandered off. But the shape was right, and the people building them were early to a real idea: give the model an environment to act in, not just a prompt to answer.
In 2024 the idea got serious. The authors of the SWE-agent paper argued that a model needed a purpose-built agent-computer interface to navigate a repository, edit files, and run programs . , from , packaged a shell, an editor, and a browser inside a sandbox and was marketed as an autonomous software engineer . OpenHands turned the same thesis into an open, self-hostable stack. The history tells the story compactly. In 2021, HumanEval asked whether a model could write one correct function from a docstring . By 2023, asked whether a system could resolve a real issue in a real repository . That is a far harder question, and answering it well required the harness as much as the model.
The connective tissue arrived in November 2024, when released the . MCP standardized how an agent connects to external tools and data, solving what people called the M×N problem: instead of writing a custom connector for every pairing of tool and application, you implement the protocol once on each side. The comparison everyone reached for was USB-C. By late 2025 there were more than 16,000 MCP servers in the wild, and OpenAI, Google, and Microsoft had all adopted it. In December 2025 Anthropic handed the protocol to the 's Agentic AI Foundation .
When Code shipped in February 2025 alongside Claude 3.7 , it did not introduce a new model trick . It shipped a more complete control stack than its rivals had: read and edit code, run tests, use command-line tools, commit to , all inside one terminal loop. The model was good. The harness is what people noticed.
Inside a state-of-the-art harness
A modern coding harness like Claude Code, Codex, or a strong open-source equivalent is built from a recognizable set of parts. None of them is the model. All of them shape what the model can accomplish.
The tool layer. This is where MCP and function calling live. The improvement over the past year was less about having tools and more about cataloging them well: describing each tool clearly enough that the model picks the right one, and presenting only the relevant subset so the model is not drowning in options. Tool description quality alone measurably changes how often tasks complete.
Shell and CLI access. A capable harness teaches the model to reach for real commands instead of reinventing them in its head. The difference between a model guessing at the contents of a directory and a model running ls and reading the result is the difference between a confident and a fact. The best harnesses bias hard toward checking reality with a real command.
Context management and compaction. The context window is finite, and long tasks overflow it. Older harnesses simply failed when they ran out of room. Current ones summarize older messages as the limit approaches, keeping the goal, the progress, the blockers, and the next steps while discarding the rest. Pi, for instance, exposes this so you can write topic-based or code-aware summaries, or use a cheaper model to do the summarizing. Smarter compaction is one of the quietest and most important upgrades of the past year.
For the same subject treated economically, what each tool-call return and reasoning block actually costs, see:
Skills and commands. Skills are capability bundles, instructions plus tools, loaded on demand rather than stuffed into the prompt from the start. This is progressive disclosure: the harness brings in the knowledge for filling a PDF form only when a PDF form appears. Slash commands give the human reusable, named prompts. Both keep the working context lean.
Sub-agents. Instead of one agent carrying every detail of a long task, the harness spawns short-lived helpers with narrow jobs and clean context. A sub-agent searches the codebase, returns a summary, and disappears, so the main agent never has to hold the raw search output.
Memory. Files like CLAUDE.md and the increasingly standard AGENTS.md turn the repository itself into onboarding for the agent: how to run the tests, what style to follow, what to avoid. This is persistent context that survives across sessions.
Permissions, sandboxing, and observability. Approval gates before destructive commands, file-pattern denials so the agent never touches a .env, and tracing so a failure can be diagnosed and fixed once rather than retried blindly. Harness engineering treats a failure as a system defect to repair permanently, not a prompt to rephrase.
The current field
The market sorted itself into a few clear shapes. The headline contest is between two terminal-first tools, with a growing tier of open-source and editor-based alternatives underneath, and a separate category of harnesses that have nothing to do with code.
| Harness | Shape | Model strategy | Worth knowing |
|---|---|---|---|
| Claude Code (Anthropic) | Terminal-first; also web, IDE, mobile | Anthropic models | Sub-agents, skills, plan mode; estimated ~$2.5B ARR by Feb 2026 |
| Codex (OpenAI) | CLI plus a cloud command center for parallel tasks | OpenAI models | Supervises agents running independently; Skills connect to Figma and Linear |
| OpenCode | Open-source, terminal-native (MIT) | Model-agnostic, 12+ providers | 160k+ GitHub stars; the foundation others build on |
| Kilo | IDE, CLI, Slack, and cloud | 500+ models via a gateway | Fork of OpenCode; Architect / Coder / Debugger modes |
| Cursor (Anysphere) | AI editor (a VS Code fork) | Multi-model with auto-routing | ~1M daily users; up to 8 parallel agents in git worktrees |
| Pi (Mario Zechner) | Minimal terminal harness (MIT) | 15+ providers | Four built-in tools; everything else is an extension you add |
Vendor sites and project repositories [R20]; Claude Code revenue per [R3]. Star counts and user figures change quickly; the linked repositories carry the live numbers.
What separates these tools is how much each one decides for you. At one end sits a managed, opinionated product that ships strong defaults and a single model family. At the other sits a minimal harness that hands you the building blocks and expects you to assemble your own workflow.
Pi is the clearest statement of the minimal philosophy. It ships four built-in tools and deliberately omits sub-agents and plan , on the bet that you will install or write those behaviors only when you need them. One community extension reportedly replaced the editor with a playable game of Doom while the model thinks. That is a joke, but it makes the point: the harness is yours to reshape.
Harnesses go well beyond code. The same machinery applied to a general assistant produces a different category. OpenClaw became a popular self-hosted assistant gateway: it connects an agent to the messaging apps you already use, runs around the clock, and acts on your behalf across services. Hermes, from Nous Research, took the opposite design and built around a self-improving loop where the agent writes and refines its own skills as it works, so today's task builds on last week's. Both run on a cheap VPS for tens of dollars a month in API calls. Both also illustrate the risk in this category, which I will come back to.
Better harness, smaller model
If the harness accounts for much of the outcome, you do not always need the most expensive model.
The evidence is direct. In evaluations on SWE-bench, the same base model wrapped in different harness configurations produced widely varying solve rates, and a purpose-built agent-computer interface moved the number more than swapping the underlying model . Adding a structured planning loop improved results more than upgrading to a pricier model. The scaffolding moved the number more than the engine did.
Pre-Devin baseline and Devin launch figure (Cognition AI, March 2024 [R13]); 2026 figures from the SWE-bench Verified leaderboard for gpt-5-codex and Claude Opus 4.7 [R4]. These reflect the full system, model and harness together.
Open weights are now viable for real work
Hermes auto-detects local models through Ollama and ships per-model tool-call parsers. A common pattern routes the bulk of work, perhaps 70 to 85% of tasks, to a small model like Qwen 3 8B and escalates only the hard cases to something larger like Llama 4 Maverick. A full self-hosted stack runs on a $40-to-$95/month server with no per-token API bill at all.
This changes the economics of access. A capable model behind a good harness can be expensive and metered, or it can be an model running on hardware you own. For an individual or a small team that runs many tasks, the break-even against cloud arrives around a few million tokens a day. For anyone in a region or a budget where frontier API access is impractical, a strong harness over a modest local model is the difference between having an agent and not having one.
The catch is real: small local models still struggle with the long, multi-step reasoning that handle, and a harness can lift a weak model only so far. Nobody is claiming a 7B model matches Opus. The claim is narrower and more useful: a good harness closes enough of the gap that "good enough" becomes reachable far down the cost curve.
Orchestration, virtual companies, and harnesses on the inside
Once a single agent works, the obvious next move is to run many of them. The orchestration layer manages agents as units, each with its own harness, and coordinates their work. This is where the "virtual company" and "agent team" language comes from. Cursor runs up to eight agents in parallel, isolated in git worktrees. Google's rebuilt Antigravity is organized around running and supervising parallel sub-agents. Codex's cloud product is explicitly designed around the assumption that the bottleneck is no longer what one agent can do but how a human directs and supervises many at once.
The role this leaves for the human, directing a fleet rather than typing each diff, is the subject of:
The autonomous, always-on agents sit in the same family. OpenClaw and Hermes are built to keep running, reachable from your phone, doing scheduled work while you sleep. Pi pushes personalization to its limit: a harness you bend completely to one person's habits through extensions and packages.
A distinct and important variant is the embedded harness, the agent that lives inside an application and acts through that application's own internal interfaces rather than only through external tools. Salesforce shows this most fully. Its platform is driven by the Atlas Reasoning Engine, which is a harness in everything but name: it reads the user's intent, plans the steps, calls tools, retrieves data through Data Cloud, checks itself against guardrails, and then executes actions inside Salesforce. Developers shape its behavior with Agent Script, pairing deterministic workflow with model reasoning, and the underlying model is swappable . The agent runs in the building with the keys, not poking at Salesforce from the outside through a connector.
ServiceNow does the same thing for enterprise workflow. Its Orchestrator, generally available since March 2025, is a meta-agent that routes work to specialized agents built in AI Agent Studio, all running on the Now Platform with native access to its data and the ability to execute multi-step processes . Microsoft's , built into its applications, reaches each application's own internal surfaces rather than whatever an MCP server happens to expose. Qlik is doing the analogous thing inside , where its agentic experience went generally available in February 2026 as a portfolio of specialized agents (Answers, Discovery, Predict, Automate, and Analytics, plus data-engineering agents), and the platform also exposes an MCP server for outside agents to call . The detail that matters for anyone working in is that the associative engine underneath preserves the business logic across a multi-step reasoning chain, so an agent asking a question receives a governed calculation rather than a speculative join. These are meta-harnesses: the vendor's own product becomes the scaffolding, with privileges and context no external tool gets, and governance the can audit.
The harness is also the attack surface
An autonomous agent reachable across your apps is exactly the thing an attacker wants. OpenClaw absorbed nine CVEs in four days in March 2026, one of them (CVE-2026-32922) rated 9.9, and audits of its community skill marketplace flagged hundreds of entries carrying malware . Prompt injection is not solved by anyone. The Hermes security policy spells out the uncomfortable part: the only real boundary against an adversarial model is the operating system. The more capable the harness, the more it can do when something goes wrong.
What comes next
A few directions look reasonably clear.
The editor is being rebuilt around the agent. Cursor treats the AI as the product and the editor as the for it. , from the team behind Devin, pairs an editor with its own fast agent model. took the harder path and wrote a new editor from scratch in , then made it model-agnostic and connected it to outside agents through the . Even now ships an agent mode through Copilot. The shape that won is an editor that assumes an agent is doing much of the typing.
The command line is quietly returning. When an agent does the heavy lifting, a fast text interface beats a heavy graphical one, and the human's job shifts toward directing and reviewing rather than typing. The terminal turned out to be an excellent operating surface for agents, which is why the two leading tools are both terminal-first.
The human is becoming a manager of work rather than the one performing every keystroke.
Model routing is the development I would watch most closely. The harness increasingly sits in front of many models, from nearly free to very expensive, with wildly different capability, and picks the right one per task. OpenRouter exposes an auto route that selects a model for each request. Cursor's auto-routing chooses a model per query. Zed lets you favorite models across providers and route through OpenRouter. The logical endpoint is a harness that sends a documentation tweak to a cheap small model and a thorny architectural change to a frontier model, optimizing cost and capability without the human choosing each time. The model becomes a fungible resource the harness allocates.
The model as a commodity input
When several labs ship comparable frontier models within weeks of each other, and a harness can route between them by task, the competitive ground shifts from which model you chose to how well your scaffolding uses whatever models it can reach. That is the bet behind every model-agnostic harness shipping today.
The harness is the story
A harness is the software that turns a language model's raw capability into directed, dependable work: the loop, the tools, the shell access, the context management, the skills, the sub-agents, the memory, and the guardrails. The agentic boom of late 2025 and early 2026 was mostly a harness story. Models improved, but the leap from plausible answers to finished tasks came from the scaffolding maturing.
Three things follow. A better harness lets a smaller or local model do real work, which pushes capable agents down the cost curve and out to people without frontier-API budgets. The harness is also the security boundary, and a more capable one fails harder when it fails. And as models converge and routing improves, the model is becoming an input the harness selects, while the harness itself becomes the thing worth understanding, building well, and arguing about.
A medieval collar took the strength a horse already had and put it against the plough. That was the whole of the invention. These models are strong enough today; the harness is what turns that strength into finished work.
Final thought
The horse supplies the power. The harness decides where the cart goes.
What Is a Harness? · June 2026 · A technical explainer on the role of the harness in agentic AI. Benchmark figures reflect model and harness combined and are drawn from public roundups; treat exact percentages as point-in-time estimates. Full source records are in the References section above.
References20
- 1Anthropic, "Introducing the Model Context Protocol", November 2024. anthropic.com ↗
- 2Linux Foundation, "Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF)… including Model Context Protocol", December 9, 2025. linuxfoundation.org ↗
- 3MindStudio (citing SemiAnalysis), "Claude Code Is Doing $2.5B in Annualized Revenue" (≈$2.5B ARR by February 2026, up ~2.5x in three months). mindstudio.ai ↗
- 4J. Jimenez et al., "SWE-bench: Can Language Models Resolve Real-World GitHub Issues?", arXiv:2310.06770, 2023, and the SWE-bench Verified leaderboard. arxiv.org ↗ · swebench.com ↗
- 5M. Chen et al., "Evaluating Large Language Models Trained on Code" (HumanEval), arXiv:2107.03374, 2021. arxiv.org ↗
- 6Hugging Face, "Agents Course" (scaffolding vs. agent loop terminology). huggingface.co ↗ Accessed 2026-06-13
- 7Stable Diffusion (released August 2022); AUTOMATIC1111 web UI and ComfyUI ecosystem. en.wikipedia.org ↗ Accessed 2026-06-13
- 8L. Zhang, A. Rao, M. Agrawala, "Adding Conditional Control to Text-to-Image Diffusion Models" (ControlNet), arXiv:2302.05543, February 2023. arxiv.org ↗
- 9OpenAI, "Function calling and other API updates", June 2023. openai.com ↗
- 10OpenAI, "Introducing Structured Outputs in the API", August 2024. openai.com ↗
- 11AutoGPT / BabyAGI (autonomous-loop experiments, 2023). en.wikipedia.org ↗ Accessed 2026-06-13
- 12J. Yang et al., "SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering", arXiv:2405.15793, 2024. arxiv.org ↗
- 13Cognition, "Introducing Devin, the first AI software engineer", March 2024. cognition.ai ↗
- 14Anthropic, "Claude 3.7 Sonnet and Claude Code", February 2025. anthropic.com ↗
- 15Salesforce, Agentforce and the Atlas Reasoning Engine (Agent Script; swappable models). salesforce.com ↗ Accessed 2026-06-13
- 16ServiceNow Newsroom, "ServiceNow's latest platform release adds… AI Agent Orchestrator and AI Agent Studio" (GA March 12, 2025). newsroom.servicenow.com ↗
- 17Qlik, "Qlik Extends Analytics from Answers to Agentic Action" (agentic experience GA February 2026; Answers, Discovery, Predict, Automate, Analytics; MCP server). qlik.com ↗
- 18ARMO, "CVE-2026-32922: Critical Privilege Escalation in OpenClaw" (nine CVEs in March 2026; one CVSS 9.9; malicious community skills). armosec.io ↗
- 19"Horse collar", history of the throat-and-girth versus collar harness and its agricultural impact (effect scale debated). en.wikipedia.org ↗ Accessed 2026-06-13
- 20Project sites and repositories for the harnesses compared: Claude Code (https://www.anthropic.com/claude-code), OpenAI Codex (https://openai.com/codex/), OpenCode (https://github.com/sst/opencode), Cursor (https://cursor.com), Kilo (https://kilo.ai), and Pi (by Mario Zechner). Accessed 2026-06-13