agentweave-harness

module

v1.0.1 Latest Latest Go to latest Published: Oct 9, 2026 License: MIT

README ¶

agentweave-harness

An adjudication harness for MCP servers and computer-use agents.

The harness runs as a separate process that wraps a governed MCP server: it spawns the server as a child, proxies the stdio MCP transport between client and server, and owns every decision about what the server may do — policy evaluation, audit chain, rug-pull detection, rate limits, approvals, and the containment ladder. The governed server is reduced to what only it can do: host-local probes (posture, TPM, device identity) reported up a control channel, and host-local actuation (firewall, lock, shutdown, credential cleanup) executed on the harness's command.

The point is the process boundary. A server that evaluates policy in-process is its own adjudicator — local compromise defeats the controls. Moving adjudication into a wrapping process the server cannot reach is what makes the controls real.

MCP client (Claude)
   |  stdio (MCP)
   v
+---------------------+
|  agentweave-harness |   policy · audit · rug-pull · rate limits · kill decisions
+---------------------+
   |  stdio (MCP,      ^
   |  proxied)         |  control channel: signals up, actuation down
   v                   |
+---------------------+
|  governed MCP server|   tools · host probes · actuators
+---------------------+

Status

Pre-1.0, under construction. Phase 0 (this repo state) ships the CLI skeleton and the ratified design documents. The guardrails packages, proxy, and control channel land in later phases. First governed server: windows-mcp-server.

Documents

Doc	What it covers
docs/architecture.md	Topology, component placement per mode, egress placement, failure modes, phase plan, glossary
docs/wire-protocol.md	The control-channel protocol (draft until v1.0.0)
docs/scope.md	What this harness does not do, and what it never records
docs/roadmap.md	Deferred ideas and their provenance

Releases

Merges to main run release-please. Conventional fix: and feat: commits open a release PR; merge that PR to create the version tag and GitHub release. The workflow can also be started manually from GitHub Actions.

License

MIT — see LICENSE.

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
agentweave-harness command Command agentweave-harness is the adjudication harness for MCP servers and computer-use agents.	Command agentweave-harness is the adjudication harness for MCP servers and computer-use agents.
guardrails
audit Package audit is the tamper-evident record of what a session did.	Package audit is the tamper-evident record of what a session did.
contain Package contain is the response: the out-of-band kill switch and the tiered containment ladder it runs.	Package contain is the response: the out-of-band kill switch and the tiered containment ladder it runs.
egress Package egress is the device egress proxy: a loopback forward proxy that admits only the domains an operator declared, and the OS actuation that stops the named workloads going around it.	Package egress is the device egress proxy: a loopback forward proxy that admits only the domains an operator declared, and the OS actuation that stops the named workloads going around it.
enforce Package enforce is the enforcement point: the MCP middleware that asks the engine about a request and then acts on the answer.	Package enforce is the enforcement point: the MCP middleware that asks the engine about a request and then acts on the answer.
evidence Package evidence packages a session's record — its audit chain, extracted verdicts, and any recording — into one self-verifying, optionally signed archive.	Package evidence packages a session's record — its audit chain, extracted verdicts, and any recording — into one self-verifying, optionally signed archive.
export Package export ships a sealed evidence bundle off the device to cloud blob storage.	Package export ships a sealed evidence bundle off the device to cloud blob storage.
hostmatch Package hostmatch compiles an operator's egress allowlist and decides whether a requested host is on it.	Package hostmatch compiles an operator's egress allowlist and decides whether a requested host is on it.
manifest Package manifest implements the session manifest — a bounded, expiring grant for one governed session — and the narrow-only composition of the policy layers (managed → user → manifest).	Package manifest implements the session manifest — a bounded, expiring grant for one governed session — and the narrow-only composition of the policy layers (managed → user → manifest).
plan Package plan is the serialisable model of a proposed sequence of tool calls, plus the derivation and rendering that turn it into a reviewable change manifest.	Package plan is the serialisable model of a proposed sequence of tool calls, plus the derivation and rendering that turn it into a reviewable change manifest.
policy Package policy is the decision point: the policy document, the signal cache, and the engine that turns a request into a verdict.	Package policy is the decision point: the policy document, the signal cache, and the engine that turns a request into a verdict.
policy/policytest Package policytest provides reusable fixtures for exercising the policy engine without a Windows host or live device signals: a static tool index and a signal registry whose outcomes the caller sets.	Package policytest provides reusable fixtures for exercising the policy engine without a Windows host or live device signals: a static tool index and a signal registry whose outcomes the caller sets.
signals Package signals is the device-signal vocabulary and catalogue: what a signal is, how one is evaluated, and the checks this build knows how to run.	Package signals is the device-signal vocabulary and catalogue: what a signal is, how one is evaluated, and the checks this build knows how to run.
status Package status is the operator's read-only view: the loopback status endpoint and the two agent-facing tools.	Package status is the operator's read-only view: the loopback status endpoint and the two agent-facing tools.
telemetry Package telemetry exports the server's activity to an OpenTelemetry collector: one span per decidable request, and a counter of policy decisions by severity.	Package telemetry exports the server's activity to an OpenTelemetry collector: one span per decidable request, and a counter of policy decisions by severity.
watch Package watch is continuous verification: the heartbeat that proves liveness, the rug-pull detector that fingerprints the served manifests, and the monitor loop that drives both plus the background signal refresh.	Package watch is continuous verification: the heartbeat that proves liveness, the rug-pull detector that fingerprints the served manifests, and the monitor loop that drives both plus the background signal refresh.
internal
control Package control is the harness side of the control channel: it hosts the local listener the governed server's servant dials, authenticates the first message against the bootstrap token, negotiates a protocol version, and then dispatches envelopes.	Package control is the harness side of the control channel: it hosts the local listener the governed server's servant dials, authenticates the first message against the bootstrap token, negotiates a protocol version, and then dispatches envelopes.
enforce Package enforce is the harness's refusal seam: it sits on the proxy's interception hook, decides each decidable client request against the policy engine, and — on a denial — synthesizes the refusal in the exact shape the method requires, so the governed server never sees a request the harness refused.	Package enforce is the harness's refusal seam: it sits on the proxy's interception hook, decides each decidable client request against the policy engine, and — on a denial — synthesizes the refusal in the exact shape the method requires, so the governed server never sees a request the harness refused.
harness Package harness orchestrates one governed session: it hosts the control channel, spawns the governed server as a child with the bootstrap environment, pumps the MCP stdio streams through the proxy, records and fingerprints the conversation through the observer, and supervises the pieces until the session ends.	Package harness orchestrates one governed session: it hosts the control channel, spawns the governed server as a child with the bootstrap environment, pumps the MCP stdio streams through the proxy, records and fingerprints the conversation through the observer, and supervises the pieces until the session ends.
inject Package inject adds the harness's own tools to the proxied manifest and answers their calls, for a session where the governed server has shed its GuardrailStatus/Kill tools (enforce mode).	Package inject adds the harness's own tools to the proxied manifest and answers their calls, for a session where the governed server has shed its GuardrailStatus/Kill tools (enforce mode).
observe Package observe is the harness's read-only view of the proxied MCP conversation.	Package observe is the harness's read-only view of the proxied MCP conversation.
proxy Package proxy is the MCP stdio pump: it sits between an MCP client and the governed server, forwarding newline-delimited JSON-RPC frames byte-for-byte while observing them, and giving the harness two abilities the transport alone would not: injecting its own requests toward the server (with their responses routed out of band, never to the client) and — in later phases — replacing a frame with a synthesized refusal.	Package proxy is the MCP stdio pump: it sits between an MCP client and the governed server, forwarding newline-delimited JSON-RPC frames byte-for-byte while observing them, and giving the harness two abilities the transport alone would not: injecting its own requests toward the server (with their responses routed out of band, never to the client) and — in later phases — replacing a frame with a synthesized refusal.
wire Package wire is the control-channel contract between the harness and a governed server's servant: envelope shape, message-type vocabulary, payload schemas and the JSONL framing.	Package wire is the control-channel contract between the harness and a governed server's servant: envelope shape, message-type vocabulary, payload schemas and the JSONL framing.