|

Agent Harness vs Agent Framework vs MCP: Which Layer Owns the Loop, State, Tools, Permissions, and Recovery

ByRicardo

Harness, framework, and MCP get used interchangeably in agent structure discussions. They aren’t the similar factor. They sit at completely different layers, personal completely different obligations, and more and more overlap at the edges. This article separates the 3 with 1 query. Which layer owns the execution loop, state, instrument transport, permissions, and restoration?

The 3 classes

  • Agent harness: The harness is the execution system that wraps a mannequin and turns it right into a working agent. OpenAI’s Codex as a platform submit (August 19, 2026) defines it straight. The harness manages dialog state, streams execution, and makes use of instruments. It additionally enforces sandbox and approval insurance policies and carries work throughout turns. Anthropic’s Claude Code docs name the similar factor an agentic harness. The Claude Agent SDK exposes ‘the similar instruments, agent loop, and context administration that energy Claude Code.’ A harness is opinionated. It ships a loop, a permission mannequin, a sandbox, and a context technique as one unit.
  • Agent framework: A framework is a library of primitives for composing brokers. It covers mannequin shoppers, instrument abstractions, graph orchestration, reminiscence interfaces, and observability hooks. Examples embrace LangGraph, the OpenAI Agents SDK, and Microsoft Agent Framework, which reached 1.0 GA in April 2026. A framework provides you the components and the loop skeleton. You resolve the coverage.
  • MCP: The Model Context Protocol is a wire protocol, not a runtime. It standardizes how an LLM utility (the host) discovers and calls capabilities uncovered by servers: instruments, assets, and prompts. MCP makes use of JSON-RPC 2.0 messages between hosts, shoppers, and servers. Since December 2025 the Linux Foundation’s Agentic AI Foundation has ruled it, alongside goose, AGENTS.md, and now A2A. MCP owns no loop and no agent state. It owns the contract between the agent and its instruments.

Ownership matrix

The desk maps every accountability to the layer that owns it by default. “Owns” means the layer defines and enforces the conduct. “Exposes” means the layer surfaces a hook however doesn’t resolve coverage.

Responsibility Agent harness Agent framework MCP
Execution loop Owns: Fixed, product-grade loop with flip limits and compaction. Owns skeleton: You configure termination, handoffs, and flip caps. None: Request/response solely.
Agent state and reminiscence Owns: Sessions, resume, fork, file checkpointing. Exposes: Checkpointers, session shops, thread IDs. None at protocol degree since 2026-07-28.
Tool transport Consumes: Built-in instruments plus MCP shopper. Consumes: Function instruments plus MCP shopper. Own: JSON-RPC over stdio or Streamable HTTP.
Permissions and approvals Owns: Permission modes, hooks, sandbox. Exposes: Guardrails, interrupts, middleware. Delegates to host: Cannot implement.
Recovery Owns: Session resume, checkpoint rewind, compaction. Exposes: Durable execution, replay, retries. Partial: Tasks extension for long-running calls.
Isolation and sandboxing Owns: OS sandbox, worktrees, containers. Optional: Hosted sandboxes or micro-VMs. None.
Multi-agent orchestration Owns patterns: Subagents, dynamic workflows. Owns primitives: Graphs, handoffs, fan-out. None: A2A covers agent-to-agent.

The remainder of this text justifies every row with sources.

Who owns the execution loop

Every agent runs a loop. Send context to the mannequin, learn the response, execute instrument calls, feed outcomes again, repeat. The harness and the framework each implement this loop. They differ in how a lot you management it.

  • Harness loop: The Claude Agent SDK paperwork its loop as 5 steps. Receive immediate, consider and reply, execute instruments, repeat, return outcome. Each full cycle is 1 flip, and the loop ends when Claude produces a response with no tool calls. Hooks can intercept, modify, or block instrument calls earlier than they run. The loop itself isn’t yours to rewrite. OpenAI’s Codex harness exposes the loop by way of app-server, a documented shopper protocol. Applications create threads, begin turns, obtain occasions, and deal with approval requests.
  • Framework loop: The OpenAI Agents SDK loop terminates on last output. It re-runs on handoff, or executes instrument calls and continues. Exceeding max_turns raises MaxTurnsExceeded, and a guardrail tripwire raises GuardrailTripwireTriggered. In LangGraph, the loop is no matter graph you draw. Nodes, edges, and conditional routing outline management circulate.
  • MCP: MCP has no loop. Since the 2026-07-28 specification, it doesn’t also have a handshake. The initialize/initialized trade and Mcp-Session-Id header had been retired. Every request travels alone, carrying its protocol model and shopper capabilities in _meta. The host’s loop decides when to name instruments/name. MCP solely defines what that decision seems like on the wire.

Who owns state

  • Harness: State lives in the harness and persists throughout periods. The Claude Agent SDK helps sessions that resume or fork later. File checkpointing restores information to any earlier state. Microsoft’s harness layer ships a FileMemoryProvider for session-scoped notes and automated context compaction that monitors token usage mid-loop. Anthropic’s long-running harness work goes additional. It palms off state between context home windows by way of artifacts on disk. Each new session begins with no memory of the last.
  • Framework: Frameworks expose state primitives however don’t resolve the persistence coverage. LangGraph’s durable execution requires you to connect a checkpointer and move a thread ID. It provides 3 sturdiness modes. "exit" persists solely when the graph exits, "async" writes whereas the subsequent step runs, and "sync" writes earlier than every step. Pick incorrect and a crash mid-run loses state. The OpenAI Agents SDK provides Sessions for automated dialog historical past, with SQLite, SQLAlchemy, and encrypted backends.
  • MCP: The 2026-07-28 launch made the protocol core stateless. The maintainers’ steering is express. If a server wants state throughout calls, mint a deal with from a instrument. The model passes it back as an argument. State is the agent’s drawback, not the protocol’s.

Who owns instrument transport

This is the 1 row MCP owns outright.

MCP defines 3 server-side primitives: instruments (capabilities the mannequin executes), assets (context and knowledge), and prompts (templated workflows). Clients could provide elicitation, which lets a server request more input from the user. Transport is JSON-RPC 2.0 over stdio or Streamable HTTP. The 2026-07-28 revision made Mcp-Method and Mcp-Name headers obligatory on HTTP requests. Gateways and fee limiters can now route on headers with out parsing our bodies. It additionally made instruments/listing responses cacheable with ttlMs and cacheScope, and deprecated the legacy HTTP+SSE transport with a 12-month offramp.

Server-initiated sampling, roots, and logging at the moment are deprecated. Their substitute is Multi Round-Trip Requests (MRTR). A server returns resultType: "input_required", and the client retries the original call with answers attached. This issues for the permissions row under.

Harnesses and frameworks each sit on high of MCP as shoppers. Claude Code and the Claude Agent SDK connect with MCP servers. They additionally allow you to outline customized instruments by way of an in-process MCP server. Codex connects to MCP servers, and OpenAI’s Relay pattern embeds Codex beside a dashboard pushed by application-owned MCP instruments. Microsoft Agent Framework 1.0 ships MCP and A2A help. The protocol is the shared substrate. Adoption numbers again that up. The MCP maintainers report near half a billion SDK downloads per 30 days throughout Tier 1 SDKs. The TypeScript and Python SDKs have each passed 1 billion total downloads.

Who owns permissions

The MCP specification is unambiguous right here. Hosts should receive express person consent earlier than invoking any instrument. Tool descriptions and annotations must be handled as untrusted except the server is trusted. And then the key sentence: “MCP itself cannot enforce these security principles at the protocol level“. Permissions belong to the host.

Harness: Harnesses personal the permission mannequin finish to finish. Claude Code ships 6 permission modes: default, acceptEdits, plan, auto, dontAsk, and bypassPermissions. Deny guidelines block in each mode besides bypassPermissions, which skips the permission layer completely. auto mode routes every instrument name by way of a background classifier. Hooks add customized logic at PreToolUse and PermissionRequest points. Codex takes the similar form. The app-server can pause a flip and situation an approval request the client must answer before work continues.

Framework: Frameworks provide you with the hook, not the coverage. The OpenAI Agents SDK has enter, output, and tool guardrails, and a tripwire halts the run. LangGraph makes use of interrupt() inside a node to pause for approval and Command(resume=...) to proceed. Microsoft Agent Framework provides a ToolApprovalAgent middleware with “don’t ask once more” guidelines. In every case you write the approval logic and the UI.

MCP: MCP now carries the approval request throughout the wire by way of elicitation over MRTR. Supabase, as an example, plans to make use of it so instruments can confirm cost or a destructive query before acting. The server can ask. Only the host can resolve.

Who owns restoration

Harness: Recovery is the place harnesses earn their maintain. The Claude Agent SDK can resume a session and rewind file adjustments to a checkpoint. It compacts context when a window fills. Claude Code’s dynamic workflows resume the place they left off if a terminal is closed. Anthropic’s harness design submit (March 2026) separates a generator from an evaluator agent as a result of self-graded work skews optimistic. OpenAI’s harness submit from February 2026 studies the final result of this self-discipline. Codex produced roughly 1,500 merged pull requests in 5 months. The repository reached on the order of 1 million traces of code. The staff grew from 3 to 7 engineers, averaging 3.5 PRs per engineer per day. OpenAI additionally studies a harness impact on ARC-AGI-3. Retained reasoning and context compaction lifted GPT-5.6 Sol from 13.3% to 38.3% while cutting output tokens sixfold . Same mannequin, completely different harness, completely different rating.

Framework: LangGraph’s sturdy execution is express that restoration relies on determinism. Wrap negative effects in duties, maintain nodes idempotent, and a run can resume a week later. The OpenAI Agents SDK exposes error_handlers and preserves accomplished guardrail outcomes when a run fails. The framework replays. You make replay secure.

MCP: MCP’s reply to long-running work is the io.modelcontextprotocol/duties extension, contributed by AWS, with poll-based tasks/get and tasks/update. This covers a single lengthy instrument name. It doesn’t cowl agent-level restoration.

Architecture comparability

                    +------------------------------------------+
  Application       |  Your product: UI, information, enterprise     |
                    |  guidelines, consent flows                    |
                    +------------------------------------------+
                          |                     |
                          v                     v
  Runtime layer     +----------------+   +-----------------------+
  (choose one, or     |  AGENT HARNESS |   |  AGENT FRAMEWORK      |
   mix)         |  mounted loop    |   |  composable loop      |
                    |  periods      |   |  checkpointers        |
                    |  permissions   |   |  guardrails/interrupt |
                    |  sandbox       |   |  graphs, handoffs     |
                    |  compaction    |   |  middleware, tracing  |
                    +----------------+   +-----------------------+
                          |                     |
                          +----------+----------+
                                     v
  Transport layer   +------------------------------------------+
                    |  MCP (JSON-RPC 2.0, stdio / Streamable   |
                    |  HTTP): instruments, assets, prompts,       |
                    |  elicitation, Tasks extension            |
                    +------------------------------------------+
                                     |
                                     v
  Capability layer  +------------------------------------------+
                    |  MCP servers: GitHub, Figma, Supabase,   |
                    |  Sentry, Linear, inside APIs           |
                    +------------------------------------------+

OpenAI attracts a near-identical image for Relay. The utility owns product context, enterprise guidelines, and instruments. Codex app-server provides the agent loop and sandboxed execution.