Coding Agent Harness

A language model by itself only does one thing: given some text, it produces more text. Everything else that makes a "coding agent" actually able to read files, run shell commands, edit code, and loop until a task is done is handled by software wrapped around the model — commonly called the harness.

The harness is responsible for the parts of the system that aren't the model's reasoning: building the context sent to the model on each call (see context-engineering), parsing the model's output into an actual tool call, executing that tool call against the real environment (a file system, a shell, a sandbox), and feeding the result back in as the next turn's context. The same underlying model can behave very differently depending on the harness around it — what tools it's given, how permissions are enforced, and how errors are surfaced back to it.

The term is used loosely across the industry (there's no single official definition), but in practice it refers to this layer of orchestration code, as distinct from the model weights and from any single tool definition.

How it works

On each turn, the harness typically: assembles the current context (system instructions, relevant file contents, conversation/tool-call history) within whatever context budget is available; sends that to the model and receives back either a text response or a structured tool call; if it's a tool call, executes it — often inside some form of sandbox or permission boundary that limits what the agent can actually touch — and captures the result; and appends that result to the history for the next turn. This loop repeats until the model signals the task is done or a limit (steps, time, cost) is reached.

Example

Two different harnesses running the exact same underlying model could produce very different results on the same coding task — one that gives the model a well-scoped set of tools, clear error messages, and a sandboxed execution environment will generally perform more reliably than one that hands back raw, unfiltered errors and lets the agent run commands with no isolation.

How it differs

Common misconceptions

FAQ