An agent decides what to do — but something has to actually do it. A model on its own can't open a file, run a command, or remember what happened three steps ago. The harness is the program that wraps the model and turns its decisions into real actions.
Brain vs. body
Think of the model as a brain in a jar: brilliant at deciding, but with no hands, eyes, or memory of its own. The harness is the body. It feeds the model what it needs to see, listens for the actions it wants to take, carries them out, and reports back. Same brain, different body, and you get very different behavior.
How it works
On each turn the harness assembles the context window — the goal, history, and relevant files — and calls the model. The model replies with text or a request to use a tool. The harness executes that tool, checks permissions first, and feeds the result back into the next call. The diagram below shows the harness as the outer box driving that whole loop.
YouYou give the goal and approve risky actions. You talk to the harness, never the model directly.- HarnessThe program that runs the loop — builds context, calls the model, executes tools, enforces safety.
- Context windowThe working memory the harness assembles for each model call: goal, history, files.
- ModelThe brain. It decides; it can't touch your machine on its own.
- ToolsThe actions the harness can carry out on the model's behalf.
In our stack — Claude Code is the harness. It manages the context window, sends each turn to Anthropic's Claude model, runs the tools Claude asks for — editing files, running tests, calling MCP servers — and asks you before anything risky.
Why the harness matters
The harness decides what the agent can see and what it's allowed to touch — so it's where safety lives. Permission prompts, sandboxing, and which tools exist at all are the harness's job, not the model's. That's why the same model can feel like a careful pair-programmer in one harness and a free-roaming automaton in another.