Agent Harness vs Framework vs MCP: Who Owns the Loop?
An in-depth look at how Agent Harness, Agent Framework, and MCP handle execution loops, permissions, and system recovery.
Stock photo for illustration only, not from the actual event
- Every agent operates on a loop: context delivery, response reading, and tool execution
- MCP serves as the foundational bridge utilizing the JSON-RPC 2.0 protocol
- Harnesses manage end-to-end permissions while frameworks handle error recovery
Agent execution fundamentally relies on a repeating loop: sending context to the model, reading responses, triggering tool calls, and feeding results back. Both agent harnesses and frameworks implement this loop, differing primarily in the level of developer control and customization they provide. The underlying substrate connecting these layers is the Model Context Protocol (MCP).
MCP defines three server-side primitives: tools, resources, and prompts. The July 28, 2026 revision mandated Mcp-Method and Mcp-Name headers on HTTP requests, allowing gateways and rate limiters to route traffic without parsing payloads. Additionally, the legacy HTTP+SSE transport was deprecated with a 12-month migration window.
Adoption metrics underscore this protocol's prevalence, with maintainers reporting nearly half a billion SDK downloads per month across Tier 1 packages. Both the TypeScript and Python SDKs have surpassed one billion total downloads, establishing MCP as a shared substrate for systems like Claude Code, Codex, and the Microsoft Agent Framework 1.0.
Stock photo for illustration only, not from the actual event
Recognizing the boundaries among harnesses, frameworks, and MCP is crucial for modern developers. Each layer addresses a distinct architectural concern, and misapplying them can complicate security models and error handling pipelines.
Regarding security, MCP specifications state explicitly that the protocol itself cannot enforce security principles at the protocol layer; permission management belongs to the host. For example, Claude Code features six distinct permission modes—default, acceptEdits, plan, auto, dontAsk, and bypassPermissions—where denial rules apply universally except in the bypass mode.
"MCP itself cannot enforce these security principles at the protocol level. Permissions belong to the host."
MarkTechPost
For long-running tasks and system recovery, frameworks like LangGraph rely on determinism by wrapping side effects in tasks to enable resumption days later. Meanwhile, MCP addresses long-running operations via the io.modelcontextprotocol/tasks extension contributed by AWS, offering polling-based task management.
Source: MarkTechPost
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment