Skip to main content
That is a user with their own sandbox, their own files and their own agent. Run it for a second user and nothing they do can reach the first.

For your users, not for you

Most agent harnesses assume the person running the harness is the user: a developer at a terminal, on their own machine. nativeharness is for developers building products, where the agent works for other people — many at once, isolated from one another, inside your app.

Your process

A library, not a service. The harness, the workspaces and the sandboxes run on your infrastructure. The only thing that leaves is what you send to the model you chose — with a local model, not even that.

Your data

Each workspace is one of your users or projects, in your storage — and exports to a portable directory you can import anywhere.

Your UI

The agent is an event stream your frontend renders. No UI is imposed.

Your users

Each gets their own sandbox, permissions, integrations and approvals.

Safe to put in front of people

  • Every command runs in a sandbox, hydrated from the workspace and thrown away after.
  • Containment is enforced in code. The agent refuses to let a model’s commands run on a provider that does not isolate — it will not construct, rather than warning.
  • Approval is on effects. The harness reviews what a command did — the files it changed, the connectors it called — and can hold that for a person before anything is committed.
  • Bash is the only tool, so there is one write path and every guard applies once.

Without a model

Harness needs no model until you ask for a turn. Sandboxed, versioned, auditable command execution is useful on its own:

Next

Quickstart

Five minutes, from install to an agent working in a workspace.

How it works

Workspace, sandbox, bash, connectors, turn — on one page.

Your users

Actors, permissions, isolation and approvals.

Your UI

The event stream, and the HTTP binding your frontend talks to.

Connectors

Reach GitHub or your own API on a user’s behalf, without the credential entering the sandbox.

Controlling the turn

Subagents, plan mode, compaction, and the ceilings that stop a stuck turn.
Early. The specs are drafts, published before the implementation so they can be argued with. The UI is the event protocol today, with reference components to come; storage ships as SQLite, one file per workspace; and the connector machinery is built and tested, but no connector ships yet.