Agent Harness、Framework与MCP职责边界解析
Agent Harness vs Agent Framework vs MCP: Which Layer Owns the Loop, State, Tools, Permissions, and Recovery
Agent 开发者的必读指南，清晰划定了运行时、框架层与协议层的权责边界，直接指导技术选型与架构设计。
Harness, framework, and MCP get used interchangeably in agent architecture discussions. They are not the same thing. They sit at different layers, own different responsibilities, and increasingly overlap at the edges. This article separates the 3 with 1 question. Which layer owns the execution loop, state, tool transport, permissions, and recovery?
在智能体架构讨论中，Harness（执行框架）、Framework（开发框架）和 MCP 常被混用。它们并非同一事物。它们处于不同的层级，承担不同的职责，且在边缘处日益重叠。本文通过一个核心问题将这三者区分开来：哪个层级负责执行循环、状态管理、工具传输、权限控制和恢复机制？
The 3 categories
三大类别
- Agent harness: The harness is the execution system that wraps a model and turns it into a working agent. OpenAI’s Codex as a platform post (August 19, 2026) defines it directly. The harness manages conversation state, streams execution, and uses tools. It also enforces sandbox and approval policies and carries work across turns. Anthropic’s Claude Code docs call the same thing an agentic harness. The Claude Agent SDK exposes ‘the same tools, agent loop, and context management that power Claude Code.’ A harness is opinionated. It ships a loop, a permission model, a sandbox, and a context strategy as one unit.
- Agent framework: A framework is a library of primitives for composing agents. It covers model clients, tool abstractions, graph orchestration, memory interfaces, and observability hooks. Examples include LangGraph, the OpenAI Agents SDK, and Microsoft Agent Framework, which reached 1.0 GA in April 2026. A framework gives you the parts and the loop skeleton. You decide the policy.
- MCP: The Model Context Protocol is a wire protocol, not a runtime. It standardizes how an LLM application (the host) discovers and calls capabilities exposed by servers: tools, resources, and prompts. MCP uses JSON-RPC 2.0 messages between hosts, clients, and servers. Since December 2025 the Linux Foundation’s Agentic AI Foundation has governed it, alongside goose, AGENTS.md, and now A2A. MCP owns no loop and no agent state. It owns the contract between the agent and its tools.
- Agent Harness（智能体执行框架）：Harness 是包裹模型并将其转化为可用智能体的执行系统。OpenAI 在《Codex as a Platform》一文（2026年8月19日）中对此进行了直接定义。Harness 管理对话状态、流式执行并使用工具。它还强制执行沙箱和审批策略，并在多轮交互中保持工作上下文。Anthropic 的 Claude Code 文档将同一概念称为 agentic harness。Claude Agent SDK 暴露了“驱动 Claude Code 的相同工具、智能体循环和上下文管理”。Harness 是带有明确设计倾向的（opinionated）。它将循环、权限模型、沙箱和上下文策略作为一个整体单元交付。
- Agent Framework（智能体开发框架）：Framework 是一组用于组合智能体的基础构件库。它涵盖模型客户端、工具抽象、图编排、内存接口和可观测性钩子。示例包括 LangGraph、OpenAI Agents SDK 以及于 2026 年 4 月达到 1.0 GA（通用可用性）版本的 Microsoft Agent Framework。Framework 提供组件和循环骨架。策略由你自行决定。
- MCP：模型上下文协议（Model Context Protocol）是一种有线协议，而非运行时环境。它标准化了 LLM 应用（主机）如何发现和调用服务器暴露的能力：工具、资源和提示词。MCP 使用 JSON-RPC 2.0 消息在主机、客户端和服务器之间进行通信。自 2025 年 12 月起，Linux Foundation 的 Agentic AI Foundation 与其共同治理该协议， alongside goose、AGENTS.md 以及现在的 A2A。MCP 不拥有任何循环或智能体状态。它拥有智能体与其工具之间的契约。
Ownership matrix
所有权矩阵
The table maps each responsibility to the layer that owns it by default. “Owns” means the layer defines and enforces the behavior. “Exposes” means the layer surfaces a hook but does not decide policy.
该表格将每项职责映射到默认拥有它的层级。“Owns”（拥有）意味着该层级定义并强制执行行为。“Exposes”（暴露）意味着该层级提供了一个钩子，但不决定策略。
| Responsibility | Agent harness | Agent framework | MCP |
|---|---|---|---|
| Execution loop | Owns: Fixed, product-grade loop with turn limits and compaction. | Owns skeleton: You configure termination, handoffs, and turn caps. | None: Request/response only. |
| Agent state and memory | Owns: Sessions, resume, fork, file checkpointing. | Exposes: Checkpointers, session stores, thread IDs. | None at protocol level since 2026-07-28. |
| Tool transport | Consumes: Built-in tools plus MCP client. | Consumes: Function tools plus MCP client. | Own: JSON-RPC over stdio or Streamable HTTP. |
| Permissions and approvals | Owns: Permission modes, hooks, sandbox. | Exposes: Guardrails, interrupts, middleware. | Delegates to host: Cannot enforce. |
| Recovery | Owns: Session resume, checkpoint rewind, compaction. | Exposes: Durable execution, replay, retries. | Partial: Tasks extension for long-running calls. |
| Isolation and sandboxing | Owns: OS sandbox, worktrees, containers. | Optional: Hosted sandboxes or micro-VMs. | None. |
| Multi-agent orchestration | Owns patterns: Subagents, dynamic workflows. | Owns primitives: Graphs, handoffs, fan-out. | None: A2A covers agent-to-agent. |
| 责任 | Agent harness（代理运行环境） | Agent framework（代理框架） | MCP |
|---|---|---|---|
| 执行循环 | Owns（负责）：固定、产品级循环，具备轮次限制和压缩功能。 | Owns skeleton（负责骨架）：你配置终止条件、交接逻辑和轮次上限。 | None（无）：仅请求/响应。 |
| Agent 状态与记忆 | Owns（负责）：会话、恢复、分支、文件检查点。 | Exposes（暴露）：检查点器、会话存储、线程 ID。 | 2026-07-28 起协议层面无此功能。 |
| 工具传输 | Consumes（消费）：内置工具及 MCP 客户端。 | Consumes（消费）：函数工具及 MCP 客户端。 | Own（自有）：基于 stdio 或 Streamable HTTP 的 JSON-RPC。 |
| 权限与审批 | Owns（负责）：权限模式、钩子、沙箱。 | Exposes（暴露）：护栏、中断、中间件。 | Delegates to host（委托给主机）：无法强制执行。 |
| 恢复机制 | Owns（负责）：会话恢复、检查点回滚、压缩。 | Exposes（暴露）：持久化执行、重放、重试。 | Partial（部分）：用于长调用任务的扩展。 |
| 隔离与沙箱 | Owns（负责）：OS 沙箱、工作树、容器。 | Optional（可选）：托管沙箱或微虚拟机。 | None（无）。 |
| 多 Agent 编排 | Owns patterns（负责模式）：子代理、动态工作流。 | Owns primitives（负责原语）：图、交接、扇出。 | None（无）：A2A 覆盖代理间通信。 |
The rest of this article justifies each row with sources.
本文其余部分将结合来源对每一行进行论证。
Who owns the execution loop
谁负责执行循环
Every agent runs a loop. Send context to the model, read the response, execute tool calls, feed results back, repeat. The harness and the framework both implement this loop. They differ in how much you control it.
每个代理都运行一个循环。向模型发送上下文，读取响应，执行工具调用，将结果反馈回去，然后重复。Harness 和 Framework 都实现了这个循环。它们的区别在于你能控制多少。
- Harness loop: The Claude Agent SDK documents its loop as 5 steps. Receive prompt, evaluate and respond, execute tools, repeat, return result. Each full cycle is 1 turn, and the loop ends when Claude produces a response with no tool calls. Hooks can intercept, modify, or block tool calls before they run. The loop itself is not yours to rewrite. OpenAI’s Codex harness exposes the loop through app-server, a documented client protocol. Applications create threads, start turns, receive events, and handle approval requests.
- Framework loop: The OpenAI Agents SDK loop terminates on final output. It re-runs on handoff, or executes tool calls and continues. Exceeding max_turns raises MaxTurnsExceeded, and a guardrail tripwire raises GuardrailTripwireTriggered. In LangGraph, the loop is whatever graph you draw. Nodes, edges, and conditional routing define control flow.
- MCP: MCP has no loop. Since the 2026-07-28 specification, it does not even have a handshake. The initialize/initialized exchange and Mcp-Session-Id header were retired. Every request travels alone, carrying its protocol version and client capabilities in _meta. The host’s loop decides when to call tools/call. MCP only defines what that call looks like on the wire.
- Harness 循环：Claude Agent SDK 将其循环文档化为 5 个步骤。接收提示词，评估并响应，执行工具，重复，返回结果。每个完整周期为一轮（turn），当 Claude 产生不带工具调用的响应时循环结束。Hooks 可以在工具调用运行前拦截、修改或阻止它们。循环本身不由你重写。OpenAI 的 Codex harness 通过 app-server 暴露循环，这是一个文档化的客户端协议。应用程序创建线程、开始轮次、接收事件并处理审批请求。
- Framework 循环：OpenAI Agents SDK 的循环在最终输出时终止。它在交接时重新运行，或者执行工具调用并继续。超过 max_turns 会引发 MaxTurnsExceeded 异常，触发护栏警戒线则会引发 GuardrailTripwireTriggered 异常。在 LangGraph 中，循环即是你绘制的图。节点、边和条件路由定义了控制流。
- MCP：MCP 没有循环。自 2026-07-28 规范起，它甚至不再具备握手机制。initialize/initialized 交换以及 Mcp-Session-Id 标头已被废弃。每个请求独立传输，在 _meta 中携带其协议版本和客户端能力。主机的循环决定何时调用 tools/call。MCP 仅定义了该调用在网络上的形态。
Who owns state
谁拥有状态
- Harness: State lives in the harness and persists across sessions. The Claude Agent SDK supports sessions that resume or fork later. File checkpointing restores files to any previous state. Microsoft’s harness layer ships a FileMemoryProvider for session-scoped notes and automatic context compaction that monitors token usage mid-loop. Anthropic’s long-running harness work goes further. It hands off state between context windows through artifacts on disk. Each new session begins with no memory of the last.
- Framework: Frameworks expose state primitives but do not decide the persistence policy. LangGraph’s durable execution requires you to attach a checkpointer and pass a thread ID. It offers 3 durability modes. "exit" persists only when the graph exits, "async" writes while the next step runs, and "sync" writes before each step. Pick wrong and a crash mid-run loses state. The OpenAI Agents SDK offers Sessions for automatic conversation history, with SQLite, SQLAlchemy, and encrypted backends.
- MCP: The 2026-07-28 release made the protocol core stateless. The maintainers’ guidance is explicit. If a server needs state across calls, mint a handle from a tool. The model passes it back as an argument. State is the agent’s problem, not the protocol’s.
- Harness（运行环境）：状态存储在 harness 中，并在会话之间持久化。Claude Agent SDK 支持稍后恢复或分叉的会话。文件检查点可将文件恢复到之前的任意状态。Microsoft 的 harness 层提供了 FileMemoryProvider，用于会话范围的笔记和自动上下文压缩，后者会在循环过程中监控令牌使用情况。Anthropic 的长期运行 harness 工作更进一步。它通过磁盘上的工件在上下文窗口之间移交状态。每个新会话开始时都不记得上一次的状态。
- 框架：框架暴露状态原语，但不决定持久化策略。LangGraph 的持久化执行要求你附加一个检查点器并传递线程 ID。它提供三种持久化模式。“exit”仅在图退出时持久化，“async”在下一步运行时写入，“sync”在每个步骤之前写入。选错的话，运行中途崩溃会导致状态丢失。OpenAI Agents SDK 提供 Sessions 功能以自动管理对话历史，支持 SQLite、SQLAlchemy 和加密后端。
- MCP：2026-07-28 版本使协议核心变为无状态。维护者的指导非常明确。如果服务器需要在调用之间保持状态，请从工具中生成一个句柄。模型将其作为参数传回。状态是代理的问题，而不是协议的问题。
Who owns tool transport
谁拥有工具传输
This is the 1 row MCP owns outright.
这是 MCP 完全拥有的唯一一行内容。
MCP defines 3 server-side primitives: tools (functions the model executes), resources (context and data), and prompts (templated workflows). Clients may offer elicitation, which lets a server request more input from the user. Transport is JSON-RPC 2.0 over stdio or Streamable HTTP. The 2026-07-28 revision made Mcp-Method and Mcp-Name headers mandatory on HTTP requests. Gateways and rate limiters can now route on headers without parsing bodies. It also made tools/list responses cacheable with ttlMs and cacheScope, and deprecated the legacy HTTP+SSE transport with a 12-month offramp.
MCP 定义了三个服务端原语：tools（模型执行的函数）、resources（上下文和数据）以及 prompts（模板化工作流）。客户端可提供 elicitation（信息获取），允许服务器向用户请求更多输入。传输层基于 stdio 或 Streamable HTTP 上的 JSON-RPC 2.0。2026-07-28 修订版使 HTTP 请求中的 Mcp-Method 和 Mcp-Name 标头成为强制项。网关和速率限制器现在可以根据标头进行路由，而无需解析正文。它还使 tools/list 响应可通过 ttlMs 和 cacheScope 进行缓存，并弃用了传统的 HTTP+SSE 传输方式，给予 12 个月的过渡期。
Server-initiated sampling, roots, and logging are now deprecated. Their replacement is Multi Round-Trip Requests (MRTR). A server returns resultType: "input_required", and the client retries the original call with answers attached. This matters for the permissions row below.
服务器发起的采样、根操作和日志记录现已弃用。其替代方案为多轮往返请求（MRTR）。服务器返回 resultType: "input_required"，客户端附带答案后重试原始调用。这对下文中的权限行至关重要。
Harnesses and frameworks both sit on top of MCP as clients. Claude Code and the Claude Agent SDK connect to MCP servers. They also let you define custom tools through an in-process MCP server. Codex connects to MCP servers, and OpenAI’s Relay sample embeds Codex beside a dashboard driven by application-owned MCP tools. Microsoft Agent Framework 1.0 ships MCP and A2A support. The protocol is the shared substrate. Adoption numbers back that up. The MCP maintainers report close to half a billion SDK downloads per month across Tier 1 SDKs. The TypeScript and Python SDKs have each passed 1 billion total downloads.
Harnesses 和框架均作为客户端构建于 MCP 之上。Claude Code 和 Claude Agent SDK 连接到 MCP 服务器。它们还允许您通过进程内 MCP 服务器定义自定义工具。Codex 连接到 MCP 服务器，OpenAI 的 Relay 示例将 Codex 嵌入由应用程序拥有的 MCP 工具驱动的仪表板旁。Microsoft Agent Framework 1.0 提供了 MCP 和 A2A 支持。该协议是共享的基础层。采用数据也印证了这一点。MCP 维护者报告称，一级 SDK 每月总下载量接近五亿次。TypeScript 和 Python SDK 的累计下载量均已突破十亿次。
Who owns permissions
谁拥有权限
The MCP specification is unambiguous here. Hosts must obtain explicit user consent before invoking any tool. Tool descriptions and annotations should be treated as untrusted unless the server is trusted. And then the key sentence: “MCP itself cannot enforce these security principles at the protocol level“. Permissions belong to the host.
MCP 规范在此处表述明确：主机在调用任何工具前必须获得用户的明确同意。除非服务器可信，否则应将工具描述和注解视为不可信。接着是关键句：“MCP 本身无法在协议层面强制执行这些安全原则”。权限归属于主机。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力