What it is
A harness for my own agents. It runs agent sessions against my personal and business systems, which it reaches only through MCP. Adding a system is one YAML manifest, never glue code. Each manifest labels the system’s data as personal, business or public and classifies every tool as a read, a write, a destructive action or something that leaves the system.
A policy file turns those labels into decisions. Reads flow. Writes to my own systems flow. Deleting anything, and anything that leaves the system, such as an email, an invoice or a payment, pauses for my approval. The approval shows the exact tool call with its raw arguments, never a summary, because a summary is only the model’s opinion of what it is about to do.
Safety is architecture, not a prompt
The threat I designed against is one session holding private data, untrusted content and a way out at the same time. No instruction in a prompt fixes that. Structure does:
- Taint tracking. Once a session reads content from an untrusted source, it can no longer send anything out or delete anything, and every write needs approval for the rest of that session.
- Labels can only tighten. A server may describe its own tools, but its description can only make a tool stricter, never looser.
- Budgets every turn. Tokens, dollars, tool calls and wall-clock time are checked on every iteration of the loop, not at the end.
- Other agents get the least. The harness is itself callable over MCP and A2A, but an outside caller runs read-mostly and can never touch personal data.
Decisions
The event log is the truth.
Every message, proposed call, policy decision, approval, result and budget check is a typed event in an append-only log. Sessions, the audit trail and cost roll-ups are queries over it, so any session can be replayed.
Mask, don’t summarise.
When the context gets long, old tool results are masked but stay in the log. Asking a model to summarise its own history loses exactly the detail you need later.
Every incident becomes an eval.
Scenarios replay through the real loop, against the real policy file, with fixture MCP servers and a scripted model, all offline. One of them proves that a prompt injection cannot get data out.
Where it stands
It runs on my machine against my own apps, with a command-line interface for runs, sessions, approvals and cost. It is a side project for learning how a production agent harness should be shaped. The same idea, a gate between an agent and anything it cannot take back, runs through the internal harness I built at work and through how ChiOS lets agents in.