OpenAI’s Codex as a platform post from August 19, 2026, defines an agent harness as the system that wraps a model and turns it into a working agent. This definition separates the three main layers of agent architecture: harness, framework, and the Model Context Protocol. They sit at different levels, own different responsibilities, and increasingly overlap at the edges.
The three categories
- Agent harness: The harness is the execution system that wraps a model and turns it into a working agent. OpenAI’s Codex as a platform post (August 19, 2026) defines it directly. The harness manages conversation state, streams execution, and uses tools. It also enforces sandbox and approval policies and carries work across turns. Anthropic’s Claude Code docs call the same thing an agentic harness. The Claude Agent SDK exposes ‘the same tools, agent loop, and context management that power Claude Code.’ A harness is opinionated. It ships a loop, a permission model, a sandbox, and a context strategy as one unit.
- Agent framework: A framework is a library of primitives for composing agents. It covers model clients, tool abstractions, graph orchestration, memory interfaces, and observability hooks. Examples include LangGraph, the OpenAI Agents SDK, and Microsoft Agent Framework, which reached 1.0 GA in April 2026. A framework gives you the parts and the loop skeleton. You decide the policy.
- MCP: The Model Context Protocol is a wire protocol, not a runtime. It standardizes how an LLM application (the host) discovers and calls capabilities exposed by servers: tools, resources, and prompts. MCP uses JSON-RPC 2.0 messages between hosts, clients, and servers. Since December 2025 the Linux Foundation’s Agentic AI Foundation has governed it, alongside goose, AGENTS.md, and now A2A. MCP owns no loop and no agent state. It owns the contract between the agent and its tools.
Ownership matrix
The table maps each responsibility to the layer that owns it by default. “Owns” means the layer defines and enforces the behavior. “Exposes” means the layer surfaces a hook but does not decide policy.
| Responsibility | Agent harness | Agent framework | MCP |
|---|---|---|---|
| Execution loop | Owns: Fixed, product-grade loop with turn limits and compaction. | Owns skeleton: You configure termination, handoffs, and turn caps. | None: Request/response only. |
| Agent state and memory | Owns: Sessions, resume, fork, file checkpointing. | Exposes: Checkpointers, session stores, thread IDs. | None at protocol level since 2026-07-28. |
| Tool transport | Consumes: Built-in tools plus MCP client. | Consumes: Function tools plus MCP client. | Own: JSON-RPC over stdio or Streamable HTTP. |
| Permissions and approvals | Owns: Permission modes, hooks, sandbox. | Exposes: Guardrails, interrupts, middleware. | Delegates to host: Cannot enforce. |
| Recovery | Owns: Session resume, checkpoint rewind, compaction. | Exposes: Durable execution, replay, retries. | Partial: Tasks extension for long-running calls. |
| Isolation and sandboxing | Owns: OS sandbox, worktrees, containers. | Optional: Hosted sandboxes or micro-VMs. | None. |
| Multi-agent orchestration | Owns patterns: Subagents, dynamic workflows. | Owns primitives: Graphs, handoffs, fan-out. | None: A2A covers agent-to-agent. |
The rest of this article justifies each row with sources.
Who owns the execution loop
Every agent runs a loop. Send context to the model, read the response, execute tool calls, feed results back, repeat. The harness and the framework both implement this loop. They differ in how much you control it.
- Harness loop: The Claude Agent SDK documents its loop as 5 steps. Receive prompt, evaluate and respond, execute tools, repeat, return result. Each full cycle is 1 turn, and the loop ends when Claude produces a response with no tool calls. Hooks can intercept, modify, or block tool calls before they run. The loop itself is not yours to rewrite. OpenAI’s Codex harness exposes the loop through app-server, a documented client protocol. Applications create threads, start turns, receive events, and handle approval requests.
- Framework loop: The OpenAI Agents SDK loop terminates on final output. It re-runs on handoff, or executes tool calls and continues. Exceeding max_turns raises MaxTurnsExceeded, and a guardrail tripwire raises GuardrailTripwireTriggered. In LangGraph, the loop is whatever graph you draw. Nodes, edges, and conditional routing define control flow.
- MCP: MCP has no loop. Since the 2026-07-28 specification, it does not even have a handshake. The initialize/initialized exchange and Mcp-Session-Id header were retired. Every request travels alone, carrying its protocol version and client capabilities in _meta. The host’s loop decides when to call tools/call. MCP only defines what that call looks like on the wire.
Who owns state
- Harness: State lives in the harness and persists across sessions. The Claude Agent SDK supports sessions that resume or fork later. File checkpointing restores files to any previous state. Microsoft’s harness layer ships a FileMemoryProvider for session-scoped notes and automatic context compaction that monitors token usage mid-loop. Anthropic’s long-running harness work goes further. It hands off state between context windows through artifacts on disk. Each new session begins with no memory of the last.
- Framework: Frameworks expose state primitives but do not decide the persistence policy. LangGraph’s durable execution requires you to attach a checkpointer and pass a thread ID. It offers 3 durability modes. “exit” persists only when the graph exits, “async” writes while the next step runs, and “sync” writes before each step. Pick wrong and a crash mid-run loses state. The OpenAI Agents SDK offers Sessions for automatic conversation history, with SQLite, SQLAlchemy, and encrypted backends.
- MCP: The 2026-07-28 release made the protocol core stateless. The maintainers’ guidance is explicit. If a server needs state across calls, mint a handle from a tool. The model passes it back as an argument. State is the agent’s problem, not the protocol’s.
Who owns tool transport
This is the 1 row MCP owns outright.
MCP defines 3 server-side primitives: tools (functions the model executes), resources (context and data), and prompts (templated workflows). Clients may offer elicitation, which lets a server request more input from the user. Transport is JSON-RPC 2.0 over stdio or Streamable HTTP. The 2026-07-28 revision made Mcp-Method and Mcp-Name headers mandatory on HTTP requests. Gateways and rate limiters can now route on headers without parsing bodies. It also made tools/list responses cacheable with ttlMs and cacheScope, and deprecated the legacy HTTP+SSE transport with a 12-month offramp.
Server-initiated sampling, roots, and logging are now deprecated. Their replacement is Multi Round-Trip Requests. A server returns resultType: “input_required”, and the client retries the original call with answers attached. This matters for the permissions row below.
Harnesses and frameworks both sit on top of MCP as clients. Claude Code and the Claude Agent SDK connect to MCP servers. They also let you define custom tools through an in-process MCP server. Codex connects to MCP servers, and OpenAI’s Relay sample embeds Codex beside a dashboard driven by application-owned MCP tools. Microsoft Agent Framework 1.0 ships MCP and A2A support. The protocol is the shared substrate. Adoption numbers back that up. The MCP maintainers report close to half a billion SDK downloads per month across Tier 1 SDKs. The TypeScript and Python SDKs have each passed 1 billion total downloads.
Who owns permissions
The MCP specification is unambiguous here. Hosts must obtain explicit user consent before invoking any tool. Tool descriptions and annotations should be treated as untrusted unless the server is trusted. And then the key sentence: “MCP itself cannot enforce these security principles at the protocol level”. Permissions belong to the host.
Harnesses own the permission model end to end. Claude Code ships 6 permission modes: default, acceptEdits, plan, auto, dontAsk, and bypassPermissions. D
What it means
Developers choosing a framework get flexibility but must write their own safety and recovery logic. Choosing a harness means accepting a fixed loop and sandbox in exchange for a working product. MCP remains the transport layer, handling the movement of data between agents and tools without managing the work itself.
