agentweave-harness

module

v0.1.0 Latest Latest Go to latest Published: Aug 11, 2026 License: MIT

README ¶

agentweave-harness

An adjudication harness for MCP servers and computer-use agents.

The harness runs as a separate process that wraps a governed MCP server: it spawns the server as a child, proxies the stdio MCP transport between client and server, and owns every decision about what the server may do — policy evaluation, audit chain, rug-pull detection, rate limits, approvals, and the containment ladder. The governed server is reduced to what only it can do: host-local probes (posture, TPM, device identity) reported up a control channel, and host-local actuation (firewall, lock, shutdown, credential cleanup) executed on the harness's command.

The point is the process boundary. A server that evaluates policy in-process is its own adjudicator — local compromise defeats the controls. Moving adjudication into a wrapping process the server cannot reach is what makes the controls real.

MCP client (Claude)
   |  stdio (MCP)
   v
+---------------------+
|  agentweave-harness |   policy · audit · rug-pull · rate limits · kill decisions
+---------------------+
   |  stdio (MCP,      ^
   |  proxied)         |  control channel: signals up, actuation down
   v                   |
+---------------------+
|  governed MCP server|   tools · host probes · actuators
+---------------------+

Status

Pre-1.0, under construction. Phase 0 (this repo state) ships the CLI skeleton and the ratified design documents. The guardrails packages, proxy, and control channel land in later phases. First governed server: windows-mcp-server.

Documents

Doc	What it covers
docs/architecture.md	Topology, component placement per mode, egress placement, failure modes, phase plan, glossary
docs/wire-protocol.md	The control-channel protocol (draft until v1.0.0)
docs/scope.md	What this harness does not do, and what it never records
docs/roadmap.md	Deferred ideas and their provenance

License

MIT — see LICENSE.

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
agentweave-harness command Command agentweave-harness is the adjudication harness for MCP servers and computer-use agents.	Command agentweave-harness is the adjudication harness for MCP servers and computer-use agents.
guardrails
audit Package audit is the tamper-evident record of what a session did.	Package audit is the tamper-evident record of what a session did.
contain Package contain is the response: the out-of-band kill switch and the tiered containment ladder it runs.	Package contain is the response: the out-of-band kill switch and the tiered containment ladder it runs.
egress Package egress is the device egress proxy: a loopback forward proxy that admits only the domains an operator declared, and the OS actuation that stops the named workloads going around it.	Package egress is the device egress proxy: a loopback forward proxy that admits only the domains an operator declared, and the OS actuation that stops the named workloads going around it.
enforce Package enforce is the enforcement point: the MCP middleware that asks the engine about a request and then acts on the answer.	Package enforce is the enforcement point: the MCP middleware that asks the engine about a request and then acts on the answer.
evidence Package evidence packages a session's record — its audit chain, extracted verdicts, and any recording — into one self-verifying, optionally signed archive.	Package evidence packages a session's record — its audit chain, extracted verdicts, and any recording — into one self-verifying, optionally signed archive.
export Package export ships a sealed evidence bundle off the device to cloud blob storage.	Package export ships a sealed evidence bundle off the device to cloud blob storage.
hostmatch Package hostmatch compiles an operator's egress allowlist and decides whether a requested host is on it.	Package hostmatch compiles an operator's egress allowlist and decides whether a requested host is on it.
plan Package plan is the serialisable model of a proposed sequence of tool calls, plus the derivation and rendering that turn it into a reviewable change manifest.	Package plan is the serialisable model of a proposed sequence of tool calls, plus the derivation and rendering that turn it into a reviewable change manifest.
policy Package policy is the decision point: the policy document, the signal cache, and the engine that turns a request into a verdict.	Package policy is the decision point: the policy document, the signal cache, and the engine that turns a request into a verdict.
policy/policytest Package policytest provides reusable fixtures for exercising the policy engine without a Windows host or live device signals: a static tool index and a signal registry whose outcomes the caller sets.	Package policytest provides reusable fixtures for exercising the policy engine without a Windows host or live device signals: a static tool index and a signal registry whose outcomes the caller sets.
signals Package signals is the device-signal vocabulary and catalogue: what a signal is, how one is evaluated, and the checks this build knows how to run.	Package signals is the device-signal vocabulary and catalogue: what a signal is, how one is evaluated, and the checks this build knows how to run.
status Package status is the operator's read-only view: the loopback status endpoint and the two agent-facing tools.	Package status is the operator's read-only view: the loopback status endpoint and the two agent-facing tools.
telemetry Package telemetry exports the server's activity to an OpenTelemetry collector: one span per decidable request, and a counter of policy decisions by severity.	Package telemetry exports the server's activity to an OpenTelemetry collector: one span per decidable request, and a counter of policy decisions by severity.
watch Package watch is continuous verification: the heartbeat that proves liveness, the rug-pull detector that fingerprints the served manifests, and the monitor loop that drives both plus the background signal refresh.	Package watch is continuous verification: the heartbeat that proves liveness, the rug-pull detector that fingerprints the served manifests, and the monitor loop that drives both plus the background signal refresh.