Harnesses revisited

AI Basics lesson 3 introduced the harness as the app around the model: chat window, memory, web search, file uploads. That was enough for chatbots. For agents the harness does four more jobs, and understanding them is what lets you look at any agent product and know what you are actually buying.

The four jobs of an agent harness

Every turn of an agent, the harness does the same four things. It does them in code, deterministically, which is the point: the harness is the part of an agent that is not a guess.

• Supplies the tools. The harness owns the list of tools and writes their descriptions into what the model sees. A model with no harness has no tools. A model in a harness has exactly the tools that harness chose to list.
• Supplies the memory. The model forgets everything between calls. The harness keeps the transcript, decides how much of it to send back each turn, stores notes across sessions, and loads standing instructions (the system prompt, from the System Prompting module) at the top.
• Enforces permissions. When the model writes a tool request, the harness checks the rules from lesson 2, runs the tool or stops and asks you, and pastes the result back. The model never runs anything. Only this layer does.
• Runs the loop. The harness calls the model, reads the reply, acts on any tool requests, calls the model again, and keeps count. It decides when to stop: the model said done, or a step limit hit, or a budget ran out, or you pressed stop.

Step through one request below. Watch how many times the harness is the one doing something, and how the model only ever writes.

Why the same model behaves differently

You can chat with a model in a plain app, and you can put the very same model inside Claude Code or Codex, and you would swear they were different models. Faster, more capable, more willing to just do the thing. The model did not change. Four things around it did.

A quick way to feel this: the same person is a different worker at a desk with a phone, a filing cabinet, and a to-do list than they are sitting in an empty room answering questions through a door. Nobody would say the person got smarter when they sat down at the desk. They got equipment. The harness is the desk.

Different tools. The chat app might have web search. The coding harness has read file, edit file, run command, search the project, and plug-in connectors. Given more hands, the same brain reaches for them.

Different standing instructions. Each harness writes its own system prompt, and it is long: how to behave, what to be careful with, when to ask, how to format. Two harnesses with the same model and different system prompts feel like two different personalities. This is the same lever the System Prompting module showed you, just wielded by the vendor instead of by you.

Different memory. A harness that reloads your project notes every session feels like it knows you. One that starts blank feels forgetful. Same brain, different filing cabinet.

Different loop settings. A chat app calls the model once per message. An agent harness may call it two hundred times for one request, each call seeing the results of the last. Nothing about the model got smarter. It got more turns, and turns compound.

This is why "which model is best?" is a less useful question than it sounds. Two products on the same model can differ more from each other than two models in the same product. When you evaluate an agent, evaluate the harness: what tools, what instructions, what memory, what stops it.

MCP: the universal plug, in one paragraph

Every harness needs tools, and until recently every tool had to be custom-built for each harness: one connector for Claude to reach your calendar, a different one for ChatGPT, a third for the next app. The Model Context Protocol, or MCP, is an open standard that fixes this. Anthropic introduced it in November 2024, and in December 2025 handed it to the Agentic AI Foundation, a fund under the Linux Foundation that Anthropic, OpenAI, and Block co-founded, so no single company owns it. The common analogy is USB-C: one plug shape, any device. A business tool (your booking system, your accounting software, your email) exposes an "MCP server," which is a standard description of what it can do. Any harness that speaks MCP can plug in and offer those actions to its model as tools. For you, the practical meaning is one sentence: when a product says "supports MCP," it means the agent can be connected to other software you use without someone writing custom code for that exact pair.

Reading a product through this lens

Once you see agents as brain plus harness, product pages get easier to read. Here is the translation table for the words you will meet.

• "Connectors" or "integrations" mean tools. Ask which ones are read and which ones write.
• "Memory" or "projects" mean the harness stores something between sessions. Ask what, and whether you can see and delete it.
• "Autonomous" or "hands-off" mean the loop runs without prompts. Ask what stops it: step limit, spend limit, a list of actions that always ask.
• "Supports MCP" means the tool list can grow by plugging in standard connectors. Good sign for flexibility, and a reminder that every plug you add is a permission decision.
• "Sandbox" or "isolated environment" means the harness runs the agent inside a walled-off computer so even a bad action cannot reach your real files. This is the fence both Claude Code and Codex tell you to use before turning prompts off.

None of those words describe the model. All of them describe the harness. That is where the differences between products live, and it is where your decisions live too.

Try this yourself

You can see a harness's tool list from the inside. Open Claude Code, Codex, or any agent product you have, and ask it to describe its own harness. It will usually tell you honestly, because the tool descriptions are sitting right in front of it.

Before we do any work: list every tool you currently have available, one per line, and mark each one READ (looks at things), WRITE (changes things), or OTHER. Then tell me which of those you would need my approval to use in this session, based on your current permission settings. Finally, tell me what would make you stop working on a task: a step limit, a time limit, a rule, or only me telling you to stop.

Compare the answer to the permission sheet you wrote in lesson 2. Any WRITE tool that is on and not on your sheet is a conversation to have before the next lesson, which is about putting all of this into a real business without regretting it.