Awesome AI Harness 
The model is the engine. The harness is the car.
A curated list of resources on harness engineering — the discipline of building the runtime scaffolding that turns a language model into a working agent.
中文版 →
Why this list
Most "awesome agent" lists catalogue frameworks. This one is about the layer underneath: the concrete engineering decisions that determine whether an agent works or flails.
A frontier model dropped into a bad harness behaves like a bad model. It loops, forgets, calls the wrong tool, burns its context on noise, and gives up. The same model in a good harness plans, recovers from errors, and finishes. The gap between those two outcomes is harness engineering, and almost none of it is in the model weights.
The craft is young, the knowledge is scattered across engineering blogs and leaked system prompts, and there is no textbook. This is an attempt at a map.
Scope note: this list covers the inference-time harness. Harnesses that double as RL training environments (environment hubs, trajectory generation, reward design) are a sibling discipline we deliberately leave out.
What is a harness?
Everything between the user's intent and the model's next token:
flowchart TB
U([User intent]) --> H
subgraph H[The Harness]
direction TB
SP[System prompt<br/>role, rules, environment]
CTX[Context assembly<br/>budget · retrieval · compaction]
TOOL[Tool layer<br/>definitions · results · errors]
LOOP[Agent loop<br/>plan → act → observe → repeat]
MEM[Memory & state<br/>files · sessions · scratchpads]
GATE[Permissions & sandbox<br/>allowlists · HITL gates]
end
H <--> M{{Model}}
H --> W([Effects on the world])
The model is a stateless function. Every bit of statefulness, safety, memory, and competence an "agent" appears to have was engineered into the loop around it.
Contents
Foundations
Start here if you are new to the field.
- Harness Engineering for Self-Improvement — Lilian Weng. The most complete map of the discipline to date: three design patterns (workflow automation, filesystem-as-memory, sub-agents and backend jobs), a coding-agent case study, where the harness layer ends and core intelligence begins, and the case for harnesses that optimize themselves through evolutionary search. If you read one thing on this list, read this.
- Building Effective Agents — Anthropic. The canonical starting point. Argues most "agents" should be workflows, and defines the vocabulary (chaining, routing, orchestrator-workers, evaluator-optimizer) the rest of the field now uses.
- How to Build an Agent — Thorsten Ball. A working code agent in ~300 lines. The single best cure for the belief that agents are magic; it is a loop, a list of tools, and good plumbing.
- Agents — Chip Huyen. Systematic breakdown of planning, tool use, and failure modes.
- Don't Build Multi-Agents — Cognition. The dissenting case: context fragmentation across agents is the dominant failure mode. Read alongside the multi-agent section below.
- A Practical Guide to Building Agents — OpenAI (PDF).
Terminology
The field's vocabulary is still settling; these pin it down.
Design patterns & surveys
Context Engineering
The context window is the agent's entire working memory, and it is a scarce, actively-managed resource. This is where most harness quality lives.
- Context Engineering for AI Agents: Lessons from Building Manus — Manus. The most-cited practitioner text on the subject: design around the KV-cache (stable prefix, append-only history), mask tool logits instead of removing tools, use the filesystem as unbounded context, recite goals into the recency window, and keep failures in context so the model learns from them.
- Effective Context Engineering for AI Agents — Anthropic. Treats context as a finite budget; covers just-in-time retrieval, compaction, and structured note-taking.
- Context Rot: How Increasing Input Tokens Impacts LLM Performance — Chroma. The measurement study: performance degrades non-uniformly as input grows, even on trivial tasks — the empirical case for everything else in this section.
- Context Engineering — Simon Willison. Short piece that popularized the term over "prompt engineering."
- How Long Contexts Fail — Drew Breunig. Names four failure modes: poisoning, distraction, confusion, clash. Essential vocabulary.
- How to Fix Your Context — Drew Breunig. The companion remedies: RAG, tool loadout, quarantine, pruning, summarization, offloading.
- A Survey of Context Engineering for Large Language Models — The canonical academic formalization (note it defines the term far more broadly than practitioners do). 全文中文翻译 available on 知乎.
- Lost in the Middle — Why position in context matters, and why "just use a long context" fails.
- Context Engineering for Agents — LangChain. The write/select/compress/isolate taxonomy.
- The Rise of Context Engineering — LangChain.
- Context Engineering — What it is, and techniques to consider — Philipp Schmid.
- Managing Context on the Claude Developer Platform — Anthropic. Context editing and the memory tool as first-class API primitives.
- Why Cline Doesn't Index Your Codebase — Cline. The case against RAG-for-code: agentic grep + read beats embeddings on freshness, security surface, and truthfulness.
- Building a better repository map with tree-sitter — Aider. The opposite bet from Cline's: a compact, always-present structural map of the repo, built from AST symbols and ranked by graph centrality.
- AI Agent 上下文工程：LangChain & Manus 研讨会全记录 — 中文. LangChain × Manus workshop notes pairing the two teams' context strategies side by side.
Tools are the agent's API to reality. Their names, schemas, return values, and error messages are prompt engineering by another name — and the interface design is worth more than a model upgrade.
The Agent Loop
Memory, State & Session Resume
- MemGPT: Towards LLMs as Operating Systems — Virtual-memory paging applied to the context window. The paper that made "memory hierarchy" the default frame.
- Generative Agents — Memory stream with recency/importance/relevance retrieval.
- Letta — The MemGPT ideas as a working stateful-agent server.
- Mem0 — Memory layer with extraction/consolidation pipelines; the companion paper reports strong latency and benchmark numbers (self-reported — treat vendor-run memory benchmarks with appropriate skepticism, here and everywhere).
- Graphiti — Temporally-aware knowledge graphs as agent memory: facts carry validity intervals, so the memory can answer "what was true when."
- Are We Ready For An Agent-Native Memory System? — Argues bolted-on memory stores miss what agents actually need; a good map of the design space.
- Crab: A Semantics-Aware Checkpoint/Restore Runtime for Agent Sandboxes — Session resume as a systems problem: replaying chat history recovers only a fraction of crashed sessions; real resume needs runtime-level checkpointing.
Multi-Agent & Orchestration
Sandboxing & Runtime Isolation
If your harness can run commands, it can run bad commands. The 2025-26 convergence: both major labs independently arrived at the same two-plane design — filesystem isolation plus a domain-allowlist egress proxy.
- sandbox-runtime — Anthropic. The open reference implementation of that two-plane design.
- Making Claude Code more secure and autonomous through sandboxing — Anthropic. The companion post: proper sandboxing cut permission prompts by 84% — isolation buys autonomy rather than restricting it.
- How we contain Claude — Anthropic. Containment across products, one level up from a single harness.
- Codex sandboxing — OpenAI. The other lab's answer: Seatbelt on macOS, Landlock on Linux — worth reading side by side with Anthropic's.
- A deep dive on agent sandboxes — Pierce Freeman. The taxonomy of isolation technologies (containers, gVisor, Firecracker, V8 isolates) from a harness builder's seat.
- Iterating with shadow workspaces — Cursor. Isolation for a different reason: a hidden copy of the workspace where the agent can break things while getting real LSP feedback.
- E2B — Sandboxed cloud runtimes for agent-generated code.
- microsandbox — Self-hosted microVM isolation with sub-200ms boot; the middle ground between containers-too-weak and VMs-too-slow.
- Modal Sandboxes — Sandboxing as a serverless primitive; notable for making per-run isolation cheap enough to be the default.
- Cua — Sandbox-per-run for computer-use agents: ephemeral macOS/Linux/Windows VMs that reset on every run, so agents are reproducible and the host stays untouched.
- Daytona — Sandbox infrastructure purpose-built for agent workloads. Note: the open-source repo stopped receiving updates in mid-2026; evaluate accordingly.
Safety, Permissions & Human-in-the-Loop
一份关于脚手架工程（harness engineering）的精选阅读清单——指的是把原始语言模型变成可用代理的运行时脚手架（上下文管理、工具设计、代理循环、记忆、沙盒、评估），收录英文和中文资源。