What metaharness is | MetaharnessWhat metaharness is in the source-owned Metaharness documentation.Metaharnessreferencemetaharnessreferenceevaluatordeveloperresearcherrun-agents

metaharness

ReferenceMetaharness

ForEvaluator · Developer · Researcher

Source & revision

metaharness/website/docs/index.mdx · a5203290ba6f

One interface to many agent harnesses.

A harness — Claude Code, Codex, the next one — keeps its own loop, its own tools and its own credentials. metaharness drives it from outside and makes the run observable, steerable and hermetic, the same way regardless of which harness is inside.

              events out (JSONL) ─────────▶  your process / your workflow engine
metaharness
              commands in (steering) ◀─────  approve / deny a tool call, inject, halt

Two faces, one run

As a binary

metaharness run claude --hermetic -p "tidy the imports"

Events on stdout, steering on stdin. Swap claude for codex and the protocol does not change.

As a library

Metaharness::new(Kind::Claude)
    .with_hermetic(HermeticMode::Strict)
    .with_decisions(DecisionMode::Ask)
    .start(Input::FromSpec)?;

The same run, embedded, answering tool.requested events as they arrive.

The three promises

	Promise	What it means concretely
1	Unified	One event stream, one command set. Everything harness-specific lives in that harness's adapter crate and nowhere else.
2	Hermetic	A run shares credentials with the operator and nothing else — no ambient plugins, no account-level MCP servers, no inherited environment. Hermeticity is asserted from the transcript, not assumed from a directory.
3	In control at every step	Which tools the harness may call is decided per call, by the embedder, through the protocol — not once at launch.

The claim this exists to make

A frame that admitted no shell was given a prompt that asked for one.

• metaharness denied the call at the hook.
• The call did not run.
• The vendor's own terminal record listed Bash in permission_denials.

That is the one claim no free test tier can reach, and it has now been made against two vendors — Claude Code and Codex. See Status.

A principle worth stating twice

Absence of evidence is not a property.

Hermeticity, tool restriction and denial behaviour are asserted from the run's own record, never from the configuration that was supposed to produce them. A crashed check is not a passing check: a verdict of unk ("nobody found out") is its own outcome, distinct from gap.

Where it came from

Two working systems, each of which built half of this and proved it.

• AEP — hermetic headless evals, deterministic hook enforcement with 1:1 denial audits, and a transcript IR (trace-ir/1) that turns "the agent behaved" into a checked claim.
• a private agent runtime — harness adapter classes (a vendor keeps its loop; we drive its documented surface), approvals as blocking calls, steering, and the port seam that makes in-process and over-the-wire tool binding indistinguishable to the loop.

Start here

• Quickstart — a first run, with no credential and no model.
• CLI reference — every verb and flag.
• Status — what is built, what is refused, and what it is waiting for.