Atlas / MCP servers / sblattj / agentic-coding-harness

agentic-coding-harnessBLOCK

mcp/sblattj/agentic-coding-harness

Run, watch, and meter Claude Code, Codex CLI, Gemini CLI, OpenCode, and Kiro from one CLI. Normalized events, cache-aware token usage, cost accounting verified against each agent's own records, budget caps, OpenTelemetry gen_ai spans, Langfuse traces, and a live web dashboard + MCP server.

Verdict
BLOCK
Grade
D
Trust score
62 /100
Exposed tools
9 3r · 6w · 0d
Transport
streamable-http
License
MIT
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

agentic-coding-harness — cost tracking and observability for Claude Code, Codex CLI, Gemini CLI, OpenCode, Kiro, Prime Agent, and GitHub Copilot CLI

Agents hide the burn. `ach` runs, watches, and meters Claude Code, Codex CLI, Gemini CLI, OpenCode, Kiro, Prime Agent, and GitHub Copilot CLI from one CLI — agent cost tracking whose numbers verify against each CLI's own records.

Highlights

  • One CLI, six agents (plus the Kiro IDE) — claude, opencode, kiro, codex, gemini, prime adapters (plus copilot for GitHub Copilot CLI, cursor for the Cursor CLI agent, and kiro-ide, which drives the Kiro desktop app over CDP) normalize six different transcript formats into one AgentEvent stream and one canonical token record (input, output, cache read, cache write, reasoning).
  • Cost math you can defend — cache-aware accounting verified against each CLI's own ground truth (Claude session JSONL, Kiro session files, provider-reported costUSD); LiteLLM pricing, and unpriced models are marked unavailable rather than silently assigned a price.
  • Live agent runs dashboard — ach dash redraws 2×/s in the terminal; ach web (port 8399) grids every run with a browser terminal you can type into — PTY per run, vendored xterm.js, zero CDN.
  • Terminal replay — every run renders to an a
Read from source at commit 9bef38359b12OBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add agentic-coding-harness --env AGENTIC_CODING_HARNESS_HTTP_TOKEN=${AGENTIC_CODING_HARNESS_HTTP_TOKEN} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env CLAUDE_CODE_MAX_OUTPUT_TOKENS=${CLAUDE_CODE_MAX_OUTPUT_TOKENS} --env LANGFUSE_PUBLIC_KEY=${LANGFUSE_PUBLIC_KEY} -- uvx agentic-coding-harness
claude-desktop
{
  "mcpServers": {
    "agentic-coding-harness": {
      "command": "uvx",
      "args": [
        "agentic-coding-harness"
      ],
      "env": {
        "AGENTIC_CODING_HARNESS_HTTP_TOKEN": "${AGENTIC_CODING_HARNESS_HTTP_TOKEN}",
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "CLAUDE_CODE_MAX_OUTPUT_TOKENS": "${CLAUDE_CODE_MAX_OUTPUT_TOKENS}",
        "LANGFUSE_PUBLIC_KEY": "${LANGFUSE_PUBLIC_KEY}"
      }
    }
  }
}
03

Exposed tools (9)

3 read · 6 write · 0 destructive.

ToolRiskDescription
harness_agentsreadList known harness agents with their backing CLI command, whether the binary is resolvable on PATH, and the adapter
harness_emitwriteEmit a saved run JSON to a sink: atif/otel JSON file, or POST to a Langfuse OTLP endpoint (same as
harness_kiro_preflightwritePreflight a Kiro run: verify the kiro-cli binary, auth, the native agent, that the model is offered and that session/set_model is acknowledged, plus MCP startup notices — over a real ACP handshake that sends NO prompt (no tokens spent). Returns a receipt of verified/failed/unproven checks.
harness_reportreadRender a self-contained HTML comparison report for a trial directory (same as
harness_run_asyncwriteStart a harness agent run (claude|opencode|kiro|codex|gemini|prime|kiro-ide|copilot|cursor) WITHOUT waiting for completion; returns { runId, sessionId: null, started, transcriptPath } promptly. Poll harness_run_status, page harness_run_events, or harness_run_cancel with the runId.
harness_run_cancelwriteCancel an async harness run: aborts in-process when this server owns it, else SIGTERMs the recorded pid while it is alive; reports cancelled:false for already-finished or interrupted runs.
harness_run_eventswritePage through the raw transcript events of an async harness run. cursor is a line offset (default 0); limit is events per page (default 100, max 1000). Returns { events, nextCursor, total, truncated }.
harness_run_statuswriteReport the status of an async harness run: effectiveStatus (running/interrupted/success/error/aborted), sessionId, token/cost totals, last event, timestamps, and elapsed time.
harness_statsreadAggregate token/cost stats from the harness state store (same aggregation as
04

Trust audit

BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryFAIL
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (9 observation(s))
Network
declared (6 observation(s))
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104
trials/output-guard-ab/kiro-arm-b/evidence/probe-payload-v1.json
probe-payload-v1.json
Why it matters. member named after an attack tool
Fix. remove or justify
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
src/monitors/kiro-mitm.ts:604
'/etc/ssl/cert.pem',
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
src/monitors/kiro-mitm.ts:605
'/etc/ssl/certs/ca-certificates.crt',
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
src/monitors/kiro-mitm.ts:606
'/etc/pki/tls/certs/ca-bundle.crt',
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
src/monitors/kiro-mitm.ts:607
'/etc/ssl/ca-bundle.pem',
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src/cli/import.ts:88
for (const line of text.replace(/^/, "").split("\n")) {
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src/monitors/copilot.ts:63
const shutdowns = parseCopilotShutdownEvents(text.replace(/^/, ""), (lineNo) =>
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src/monitors/cursor-dashboard.ts:26
const t = text.replace(/^/, '');
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src/monitors/cursor-dashboard.ts:45
const s = text.replace(/^/, '');
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src/monitors/cursor-dashboard.ts:123
try { events = (JSON.parse(text.replace(/^/, '')) as { usageEventsDisplay: unknown[] }).usageEventsDisplay; }
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/run-sandbox.test.ts:153
const SECRET = "ZEBRA-PROMPT-7f3a9c-do-not-leak";
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
tests/compare-repeats.test.ts:101
for (const src of scripts) assert.doesNotThrow(() => new Function(src));
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
tests/kiro-ide-cdp.test.ts:146
assert.doesNotThrow(() => new Function(`return ${js}`));
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
tests/kiro-ide-cdp.test.ts:147
assert.doesNotThrow(() => new Function(`return ${DEEP_TEXT_JS}`));
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
scripts/update-homebrew.mjs:30
assert.equal(createHash('sha1').update(tarball).digest('hex'), metadata.dist.shasum);
LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59
tests/fixtures/kiro/fake-acp-server.ts:353
const readAnswer = await ask('fs/read_text_file', { sessionId: params.sessionId, path: '/etc/hosts' });
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/helpers/fake-child.ts:4
import type { SpawnFn } from '../../src/adapters/shared.ts';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/helpers/kiro-tap-child.ts:6
import { KiroAdapter } from '../../src/adapters/kiro.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/helpers/pty-manager-probe.ts:13
import { PtyManager } from '../../src/web/pty-manager.ts';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/helpers/web-server-runner.ts:8
import { startWebServer } from '../../src/web/server.ts';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/kiro-session-store.test.ts:128
assert.equal(await locateKiroSessionStore('../../etc/passwd', { dir }), null);
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/TOOLHIVE.md:170
curl -s http://127.0.0.1:8398/health          # {"status":"ok",...}
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/TOOLHIVE.md:171
curl -s -X POST http://127.0.0.1:8398/mcp -H 'content-type: application/json' \
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
src/adapters/opencode.test.ts:331
const adapter = new OpenCodeAdapter({ fetchImpl, serverUrl: 'http://127.0.0.1:4399/' });
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
src/adapters/opencode.test.ts:339
assert.equal(calls[0]?.url, 'http://127.0.0.1:4399/session');

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 9bef38359b12full audit observations/trust-audit/mcp-server/sblattj__agentic-coding-harness.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-119bef38359b12BLOCKD62first audit
06

Questions

What is the agentic-coding-harness MCP server?

Run, watch, and meter Claude Code, Codex CLI, Gemini CLI, OpenCode, and Kiro from one CLI. Normalized events, cache-aware token usage, cost accounting verified against each agent's own records, budget caps, OpenTelemetry gen_ai spans, Langfuse traces, and a live web dashboard + MCP server.

What tools does agentic-coding-harness expose?

9 in total: 3 read-only, 6 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is agentic-coding-harness safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (62/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does agentic-coding-harness need?

It reads AGENTIC_CODING_HARNESS_HTTP_TOKEN, ANTHROPIC_API_KEY, CLAUDE_CODE_MAX_OUTPUT_TOKENS, LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does agentic-coding-harness run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as agentic-coding-harness.

How current is this page?

The grade is for one exact copy of the source (9bef38359b12), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement