- Published on
Agent Harness vs Agent Framework vs MCP: Which Layer Owns the Loop, State, Tools, Permissions, and Recovery
- Authors
- Name
- DeepHorus
Agent architecture discussions often conflate harnesses, frameworks, and MCP, but a new analysis argues they occupy distinct layers. Published September 14, 2026, by Michal Sutter, it asks which layer owns the execution loop, state, tools, permissions, and recovery. The answer shapes how agent systems are built.
An agent harness is the execution system that wraps a model into a working agent. OpenAI's Codex platform post from August 19, 2026 defines it as managing conversation state, streaming execution, and enforcing sandbox and approval policies. Anthropic's Claude Code documentation calls this an "agentic harness."
An agent framework is a library of primitives for composing agents, covering model clients, tool abstractions, graph orchestration, memory interfaces, and observability hooks. Examples include LangGraph, the OpenAI Agents SDK, and Microsoft Agent Framework, which reached 1.0 GA in April 2026. Frameworks provide parts and a loop skeleton, leaving policy decisions to developers.
MCP, the Model Context Protocol, is a wire protocol, not a runtime. It standardizes how an LLM application discovers and calls server capabilities using JSON-RPC 2.0 messages. Since December 2025, the Linux Foundation's Agentic AI Foundation has governed MCP. MCP owns no loop and no agent state.
The ownership matrix clarifies responsibilities. The harness owns a fixed, product-grade loop with turn limits and compaction, plus sessions, resume, fork, and file checkpointing. The framework exposes checkpointers, session stores, and thread IDs, while owning only the skeleton. MCP owns tool transport via JSON-RPC over stdio or Streamable HTTP and delegates permissions to the host.
These distinctions matter because they determine where control and safety live. A harness enforces permission modes, hooks, and sandboxes; a framework exposes guardrails, interrupts, and middleware; MCP cannot enforce permissions. The analysis notes growing overlap, but core loop and state ownership remain with harnesses and frameworks. Teams should choose based on whether they need an opinionated product or flexible primitives.
