agentic-coding-harnessBLOCK
Run, watch, and meter Claude Code, Codex CLI, Gemini CLI, OpenCode, and Kiro from one CLI. Normalized events, cache-aware token usage, cost accounting verified against each agent's own records, budget caps, OpenTelemetry gen_ai spans, Langfuse traces, and a live web dashboard + MCP server.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
agentic-coding-harness — cost tracking and observability for Claude Code, Codex CLI, Gemini CLI, OpenCode, Kiro, Prime Agent, and GitHub Copilot CLI
Agents hide the burn. `ach` runs, watches, and meters Claude Code, Codex CLI, Gemini CLI, OpenCode, Kiro, Prime Agent, and GitHub Copilot CLI from one CLI — agent cost tracking whose numbers verify against each CLI's own records.
Highlights
- One CLI, six agents (plus the Kiro IDE) —
claude,opencode,kiro,codex,gemini,primeadapters (pluscopilotfor GitHub Copilot CLI,cursorfor the Cursor CLI agent, andkiro-ide, which drives the Kiro desktop app over CDP) normalize six different transcript formats into oneAgentEventstream and one canonical token record (input, output, cache read, cache write, reasoning). - Cost math you can defend — cache-aware accounting verified against each CLI's own ground truth (Claude session JSONL, Kiro session files, provider-reported
costUSD); LiteLLM pricing, and unpriced models are marked unavailable rather than silently assigned a price. - Live agent runs dashboard —
ach dashredraws 2×/s in the terminal;ach web(port 8399) grids every run with a browser terminal you can type into — PTY per run, vendored xterm.js, zero CDN. - Terminal replay — every run renders to an a
9bef38359b12OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add agentic-coding-harness --env AGENTIC_CODING_HARNESS_HTTP_TOKEN=${AGENTIC_CODING_HARNESS_HTTP_TOKEN} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env CLAUDE_CODE_MAX_OUTPUT_TOKENS=${CLAUDE_CODE_MAX_OUTPUT_TOKENS} --env LANGFUSE_PUBLIC_KEY=${LANGFUSE_PUBLIC_KEY} -- uvx agentic-coding-harness{
"mcpServers": {
"agentic-coding-harness": {
"command": "uvx",
"args": [
"agentic-coding-harness"
],
"env": {
"AGENTIC_CODING_HARNESS_HTTP_TOKEN": "${AGENTIC_CODING_HARNESS_HTTP_TOKEN}",
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"CLAUDE_CODE_MAX_OUTPUT_TOKENS": "${CLAUDE_CODE_MAX_OUTPUT_TOKENS}",
"LANGFUSE_PUBLIC_KEY": "${LANGFUSE_PUBLIC_KEY}"
}
}
}
}Exposed tools (9)
3 read · 6 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
harness_agents | read | List known harness agents with their backing CLI command, whether the binary is resolvable on PATH, and the adapter |
harness_emit | write | Emit a saved run JSON to a sink: atif/otel JSON file, or POST to a Langfuse OTLP endpoint (same as |
harness_kiro_preflight | write | Preflight a Kiro run: verify the kiro-cli binary, auth, the native agent, that the model is offered and that session/set_model is acknowledged, plus MCP startup notices — over a real ACP handshake that sends NO prompt (no tokens spent). Returns a receipt of verified/failed/unproven checks. |
harness_report | read | Render a self-contained HTML comparison report for a trial directory (same as |
harness_run_async | write | Start a harness agent run (claude|opencode|kiro|codex|gemini|prime|kiro-ide|copilot|cursor) WITHOUT waiting for completion; returns { runId, sessionId: null, started, transcriptPath } promptly. Poll harness_run_status, page harness_run_events, or harness_run_cancel with the runId. |
harness_run_cancel | write | Cancel an async harness run: aborts in-process when this server owns it, else SIGTERMs the recorded pid while it is alive; reports cancelled:false for already-finished or interrupted runs. |
harness_run_events | write | Page through the raw transcript events of an async harness run. cursor is a line offset (default 0); limit is events per page (default 100, max 1000). Returns { events, nextCursor, total, truncated }. |
harness_run_status | write | Report the status of an async harness run: effectiveStatus (running/interrupted/success/error/aborted), sessionId, token/cost totals, last event, timestamps, and elapsed time. |
harness_stats | read | Aggregate token/cost stats from the harness state store (same aggregation as |
Trust audit
BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (9 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
probe-payload-v1.json
'/etc/ssl/cert.pem',
'/etc/ssl/certs/ca-certificates.crt',
'/etc/pki/tls/certs/ca-bundle.crt',
'/etc/ssl/ca-bundle.pem',
for (const line of text.replace(/^/, "").split("\n")) {const shutdowns = parseCopilotShutdownEvents(text.replace(/^/, ""), (lineNo) =>
const t = text.replace(/^/, '');
const s = text.replace(/^/, '');
try { events = (JSON.parse(text.replace(/^/, '')) as { usageEventsDisplay: unknown[] }).usageEventsDisplay; }const SECRET = "ZEBRA-PROMPT-7f3a9c-do-not-leak";
for (const src of scripts) assert.doesNotThrow(() => new Function(src));
assert.doesNotThrow(() => new Function(`return ${js}`));assert.doesNotThrow(() => new Function(`return ${DEEP_TEXT_JS}`));assert.equal(createHash('sha1').update(tarball).digest('hex'), metadata.dist.shasum);const readAnswer = await ask('fs/read_text_file', { sessionId: params.sessionId, path: '/etc/hosts' });import type { SpawnFn } from '../../src/adapters/shared.ts';import { KiroAdapter } from '../../src/adapters/kiro.js';import { PtyManager } from '../../src/web/pty-manager.ts';import { startWebServer } from '../../src/web/server.ts';assert.equal(await locateKiroSessionStore('../../etc/passwd', { dir }), null);curl -s http://127.0.0.1:8398/health # {"status":"ok",...}curl -s -X POST http://127.0.0.1:8398/mcp -H 'content-type: application/json' \
const adapter = new OpenCodeAdapter({ fetchImpl, serverUrl: 'http://127.0.0.1:4399/' });assert.equal(calls[0]?.url, 'http://127.0.0.1:4399/session');
Gates applied: no_behavioural_pass.
9bef38359b12full audit observations/trust-audit/mcp-server/sblattj__agentic-coding-harness.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 9bef38359b12 | BLOCK | D | 62 | first audit |
Questions
What is the agentic-coding-harness MCP server?
Run, watch, and meter Claude Code, Codex CLI, Gemini CLI, OpenCode, and Kiro from one CLI. Normalized events, cache-aware token usage, cost accounting verified against each agent's own records, budget caps, OpenTelemetry gen_ai spans, Langfuse traces, and a live web dashboard + MCP server.
What tools does agentic-coding-harness expose?
9 in total: 3 read-only, 6 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is agentic-coding-harness safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (62/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does agentic-coding-harness need?
It reads AGENTIC_CODING_HARNESS_HTTP_TOKEN, ANTHROPIC_API_KEY, CLAUDE_CODE_MAX_OUTPUT_TOKENS, LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does agentic-coding-harness run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as agentic-coding-harness.
How current is this page?
The grade is for one exact copy of the source (9bef38359b12), read on 2026-10-11. The repository is watched and re-audited when it changes.