Everyone is making an agent harness, you should build another one (for yourself)

In February I built my own agent harness, gonk, because Claude Code's first prompt was too large for the open-weights model on my desk. Since September it has processed about 4 billion tokens, mostly on GPUs in my house, and in October it wrote most of its own code. What I built, what I use it for, the case against it, and why owning the harness matters.

The first project I shipped after Claude Opus 4.5 came out was my own agent harness.

Opus 4.5 came out on 2025-11-24. For many developers, me included, it was the point where coding agents started to work for real. Ethan Mollick had early access and posted this on launch day:

A month later, the creator of Claude Code said every line he had landed in the last thirty days came from Claude Code and Opus 4.5:

In January, Andrej Karpathy wrote that agents “have crossed some kind of threshold of coherence around December 2025 and caused a phase shift in software engineering”. Simon Willison called November 2025 an inflection point.

By February 2026 agent harnesses were already popular, and everyone was selling one. It was not clear that building my own had any value. I built one anyway, to learn how the labs think about the agent loop. I did not expect to still be adding features eight months later, or that it would do real work. Since September it has processed about 4 billion tokens.

TL;DR

• The harness is becoming the product. Agents are now part of most applications. I expect many software developers to become harness developers, “agent engineers”. Each application gets its own harness, built from a small set of shared parts.
• One agent runtime sits under every app. The labs already work this way. Their chat, coding and desktop agents increasingly run on one engine, with different tools, hooks and front ends on top.
• I don’t buy “fat model, thin harness”. The harness is how a model acts in the world. As agents take on bigger and more valuable work, the harness grows with it.
• The harness is starting to write itself. In October, gonk wrote 108 of its own 133 commits. Claude Code wrote the other 23 and filed most of the tickets. Next, Claude Code drafts the feature specs. After that, the harness decides, proposes and implements its own features.
• The real risk is not owning the harness. When a vendor owns it, their breaking changes and their roadmap set your speed. Owning the upstream, and being its only user, made maintenance routine.
• This is the tip of the iceberg. Agents change the cost of homebrew software in general. If you can get your own inference, depending on a provider can now cost more than building the thing yourself.

Why I built it

Claude Code’s first prompt was large.

Before you type anything, Claude Code loads its system prompt, its tool definitions and your project context. People who measured it found 27k to 85k tokens at startup:

• ClaudeCodeCamp measured 27,169 tokens from an empty folder.
• XDA found 51,400 tokens “already spoken for before I’d actually asked Claude to do anything”.
• How-To Geek saw 46.7k in the CLI and 84.6k in the desktop app.

My own gateway log agrees. The first real call of a Claude Code session has a median of 60.5k prompt tokens. On a subscription, every new session pays that out of the usage limit.

At the time I was testing an open-weights model on a Mac Studio with an M3 Ultra. Its prefill is slow, so a 60k-token first prompt meant a long wait before the first output token. To use local models for agent work at all, I needed a harness with a very small system prompt. gonk’s first call is still about 8k tokens at the median.

On the M3 Ultra, the hardware I own, a model prefills at about 300-800 tokens per second. At that speed a 60k-token first prompt takes one to three minutes before the first token. An 8k-token prompt takes 10 to 27 seconds. So even with prefill as the bottleneck, gonk gets a first answer back in a reasonable time.

The size of the first prompt is half of the problem. The other half is the cache. A local server skips prefill only for the part of a prompt that matches the previous request byte for byte. In early 2026 Claude Code and OpenCode both broke that match between turns:

• Claude Code put a billing header into its system prompt, and its values change with every request. A local server then reprocessed the whole prompt each time. The fix is the setting CLAUDE_CODE_ATTRIBUTION_HEADER=0.
• OpenCode dropped the model’s reasoning from earlier turns when it sent the history again. That invalidated the KV cache on local backends from that turn on.

In my runs on local models, where prefill is the bottleneck, these cache misses were a real problem. gonk keeps its prompt prefix stable, and its cache hit rate is 87% this week. Other harnesses now sell the same property. The Register wrote that Pi’s default system prompt “is short enough to keep things snappy, especially with prompt-caching enabled”.

What I built: gonk

gonk is an agent server written in Rust. It is one binary. It talks to any OpenAI-compatible endpoint and gives the model a small set of tools: bash, file read and write, find and replace, web search and fetch, and subagents.

First version: the loop. I started on 2026-02-10. The first README said “Claude Code philosophy, 10% of the code”. It had sessions over HTTP with a message queue, one SSE event stream per session, sessions saved to disk, skills and AGENTS.md read from the working folder, and parallel tool calls.

Then: copy what I need, just as I needed it. Most of gonk’s features started the same way. A lab shipped something in its own agent. I gave the release notes to Claude Code and told it to copy the feature. That is how gonk got subagents, compaction, hooks, plugins, background jobs and a cancel that reaches subagents. The rest came from asking Claude Code to read an open spec and implement it: ACP, AG-UI (GitHub), the Agent Plugins format, and A2A-style messages between my agents.

Most of it is recent. Of gonk’s 306 commits, 224 (73%) landed in the last two months.

Now: v1.1. v1.0.0 shipped on 2026-10-17. It added plugins, hooks that run as separate processes and can block a tool call, AG-UI event names, sessions that survive a hard kill, and a script tool that runs model-written TypeScript in a sandbox. src/ now has about 35,000 lines of Rust in 75 files (47,542 with blank lines and comments), with 642 tests. “10% of the code” held. The leaked Claude Code source was about 512,000 lines of TypeScript. Even with blank lines and comments, gonk is under 10% of that.

What it picked up

Each new protocol made the agent useful somewhere new, beyond coding:

• ACP, so I can drive gonk from my editor.
• AG-UI, so any AG-UI front end can show a session.
• Agent-to-agent messages, through a small switchboard that keeps receipts.
• Plugins, so new tools and front ends need no change to gonk itself.

What it dropped

• The human in the loop. In the three full weeks of October, unattended workers used 1,448M of gonk’s 2,172M prompt tokens (67%).
• Special-purpose tools. The models got better at bash, so they need fewer dedicated tools. In my office sessions, bash is 75% of the 2,272 tool calls in October, up from 65% in older sessions.

What I use it for

Unattended work, and a worker for Claude Code

gonk has two jobs:

• Unattended work. Workers pick a ticket from my board, do the work and open a pull request. Nobody watches them while they run. Each worker runs in its own Docker container with 8 GB of memory, a limit of 1,024 processes, its own network and its own git account. It can push a branch and open a pull request. I do the merging. The limits exist because in September a test run spawned about 1,400 processes and took down my browser and my editor.
• A persistent worker for Claude Code. Claude Code writes the tickets, hands them to gonk sessions and checks the results.

Claude Code is now the supervisor, and it does that job very well. It plans, reviews and checks. gonk does the bulk of the work. In the last 7 days gonk made 2.6 times as many model requests as Claude Code, and wrote 2.3 times as many output tokens:

It might seem silly. After building all of this, the most active user of gonk is not me but Claude Code. So why not just use Claude Code?

This split matters for cost, because Opus is expensive on output. I am on the $100 Claude plan. If Claude Code also did gonk’s work, I would use my weekly limit about three times over and need the $200 plan. As it is, my weekly usage stays at 30-50% of the limit. I read that from my own token dashboard.

At Opus 5.5 API list prices, one week of gonk traffic would cost about $800. That figure counts cache reads at the cached price. With the premium for cache writes it is about $910. With no caching at all it is about $3,600.

I still use gonk every day. It mostly runs short workflows, small tasks and a lot of deep research. My use of it looks more like the ChatGPT or Claude chat apps than an agent, because I built a separate set of interfaces for that purpose. Speaking of UI.

An interface that keeps changing

gonk is an API with an SSE event stream, so the front end is a separate choice. It has had four so far: Claude Code as the supervisor, ACP in my editor through my Emacs agent dashboard, a web app on my phone, and AG-UI plugins. The editor and the phone are mostly for quick chats, short check-ins and research. None of them needed a change to the agent loop.

Privacy

89% of the tokens ran on GPUs in my house. Those prompts never left my network.

Okay, what are some real use cases for these systems?

Jailbreaking my PS5

On 2026-09-29 a developer called ntfargo published Relapse, a jailbreak for PS5 and PS5 Pro consoles on firmware 7.00 to 13.60. You open an exploit page in the console’s browser, and it starts a loader that listens on the network.

I asked Claude Code to help, and it refused. So I gave the job to gonk, running GLM-5.3 Flash on my own GPU. It took about an hour. The strange part was the sound. The PS5 kept playing its notification chime while an agent installed custom firmware and apps on it and copied files over FTP, from a machine in the same house that was running the model.

My harness, my model, my network, my console. It was a surreal hour.

Decompiling a Game Boy Advance game

Since 2026-10-03 my agents have worked on a matching decompilation of Mario Kart: Super Circuit for the GBA. A matching decompilation is C source that compiles back to the exact bytes of the original ROM. The agents take one function at a time, and a byte comparison against the ROM is the only check. As of 2026-10-29 they have matched 595 of the game’s 1,482 functions (40%). Those are mostly the small functions: together they hold 16,626 of 160,772 instructions (10%). None of the 44 functions over 500 instructions has matched yet, and the last new match was on 2026-10-13. Most of the matches came from GLM-5.3 Flash on my own GPU.

One runtime under every app

The labs already run one engine under many products.

• In September 2025 Anthropic renamed the Claude Code SDK to the Claude Agent SDK. In its words, “the agent harness that powers Claude Code … can power many other types of agents, too.”
• Claude Cowork, launched in January 2026, “is built on the Claude Agent SDK” (TechCrunch). Anthropic’s help page says Cowork “uses the same agentic architecture that powers Claude Code”.
• OpenAI did the same. On 2026-07-09 the Codex app merged into the ChatGPT desktop app.

The pattern is one agent engine, with different tools, hooks, security checks, deployments and front ends on top. I would not be surprised if Anthropic moves the engine out of Claude Code completely and runs all its products on it.

gonk is a small version of the same idea. My coding agent, research agent, unattended workers, tutor, game decompiler, and the agents in my editor and on my phone are the same binary with different configuration.

The case against building your own

Look, I will be honest. This is overengineering. The case against it:

• Maintenance is on you. Nobody else fixes your bugs.
• Security is on you too. Public agent code, and the package registries and skill hubs around it, are now a target. In the Nx “s1ngularity” attack (August 2025), malware ran the victim’s own AI coding CLIs with their safety flags off to search the disk for secrets. The first malicious MCP server copied every email an agent sent to the attacker. An audit of OpenClaw’s skill hub found 341 malicious skills out of 2,857. Fake installers for OpenClaw and for the leaked Claude Code source shipped malware. Pi also installs from npm. I found no attack on Pi itself, but every npm install carries the same risk. And when you write your own harness, you also write your own holes. gonk v1.1.1 fixed one of mine: a new fallback fetch in the web tool could reach services on the host.
• You don’t get the labs’ tuning. A lab tunes its harness for its own model, including prompt caching and the guard rails in the system prompt. It cannot tune it for your use case, so this cuts both ways.

That said

These problems are getting smaller, and for me they are mostly gone:

• No breaking changes I did not choose. Popular harnesses move fast, and their users pay for it. Pi went from 1.0 to 1.4 in three weeks, and 22 of its last 100 releases have a “Breaking” section in the notes. OpenClaw ships several releases a week and has 3,223 issues labelled regression. Hermes Agent has 332 issues with “after update” in the title. gonk changes when I decide it does.
• Fixes are fast and cheap. When an agent hits a bug in gonk, an agent files the issue and an agent fixes it. Of the 59 gonk issues closed so far, 26 (44%) were closed within an hour of being opened. The median was 82 minutes. With a commercial harness, the same bug waits in a tracker with thousands of others.
• I am the only user. A fix ships the same day, to my machines. Before AI, many developers carried a set of scripts, tools and systems to every new laptop: utilities, scaffolding, glue code. This is very similar. When I see a problem that is agent-shaped (spoiler: nearly every human-shaped problem is), I can quickly build a solution that gets 80% of the way. I know it will work the way I expect, and I can iterate on it quickly.

What I learned

• The harness is now how I think about my work. I run agent jobs and maintain my homelab through it. As agents take over more of the work, the harness becomes the work.

• Every harness gets bigger. Even Pi, which built its name on being minimal. Pi 1.0 still promises “a hardened, minimal, extensible agent harness”, and it adds native MCP, deferred tool loading, cache warming and more. Two days before the release, the Pi team wrote “You Said No MCP!” to explain why something they had refused is now in the core.

  Size tells the same story. The leaked Claude Code source was about 512,000 lines of TypeScript. Its best-known Rust rewrite, claw-code, is already 106,000 lines. Hermes Agent and Codex are each about 1.4 million lines. gonk is 35,000.

• Skills that agents learn are valuable to a whole organisation. A skill is a markdown file that says how to do one thing. Agents can write and refine their own. At Nous Research, the CEO describes Teknium’s Hermes Agent development file as “like 25 pages of gold”, and says “every engineer at the company should have the same markdown file, which is basically part of our secret sauce”. Nous built a system that finds skills people have made and puts them “into like a repo that everybody’s agent has access to”. My agents share skills the same way, through one shared repository.
• The whole setup becomes more valuable to me over time. Beyond skills, smarter models can work out how to tune the system to how I work and get things done. The best way to do that is to keep the harness and the data it learns from as I work, all local.
• Aim for a cache hit rate above 95%. Agent workloads are almost entirely input. Price comparisons often assume a 3:1 input to output ratio. Artificial Analysis uses 3:1 for its price classes, and 7:2:1 (cache hit, input, output) for its blended price. My traffic does not look like either. This week 98.7% of gonk’s tokens were input, and 99.7% of Claude Code’s. The price that matters is the cached input price, and the number to watch is the cache hit rate. gonk’s is 87% this week: 94% on one GPU server and 80% on the other.
• The harness is starting to write itself. In October, gonk wrote 108 of its own 133 commits, using open models on my GPUs. Claude Code wrote 23. Claude Code also filed 49 of the 74 issues, and gonk workers filed 22.

The direction is clear to me. In the next few months, Claude Code drafts the feature specs. After that, the harness decides, proposes and implements its own features, and I review. At some point in 2027 I expect to stop reviewing. Adversarial agents will run QA and act as users, so they find most bugs before I see them. Maybe I get a release note. Maybe the system shows me a blog post and a release video about the new features.

What it could do better

• Remove features. gonk has stale features and dead code. Every call is logged, so an agent could find what nobody uses and remove it. That only works if usage is always measured and stored.
• Upgrade itself with no downtime. A gonk instance should stay up, roll out a new version of itself, and roll back on failure. In effect it should run its own bug fixes and feature proposals through CI/CD, end to end.
• Share a runtime. I now spawn many agents. They should live in one shared runtime, not each run as a standalone process in its own isolated box.
• Chaos engineering. Agents are non-deterministic, and I do not use that enough. Agents could play against the harness to find where it breaks.

What comes next for gonk

• Open source. The next step is to open source gonk.
• Durability as a first-class feature, not an add-on.
• Several agent types and deployments from one runtime.
• Permissions for tools and files, per agent.
• A nearly stateless runtime, with all state in storage outside the process.
• Any sandbox, not only Docker. There are good options now, such as Firecracker microVMs.
• A small model as a gate on tool calls. In October Cohere reported that a popular open-weights model, asked to write a detection rule, took an inventory of its machine and tried to upload a file to a cloud bucket. Its reasoning trace said it would not call any tools. Cohere’s advice is to check the actual tool call before it runs, because “a reasoning trace is not a security boundary”. My plan is a small, fast model that checks every tool call before gonk runs it.
• More than one user. I don’t yet know what access control and third-party agents look like when I am not the only human in the system.

The bigger picture

I think rolling your own agent is the tip of the iceberg. Agents change the cost and benefit of homebrew software in general. Building and maintaining your own tools used to be the expensive choice. With agents doing most of the work, it is often the cheap one, if you can get your own inference and tokens. Depending on a provider has its own costs: their prices, their limits, their refusals and their breaking changes. A SaaS provider has far more resources than you to solve the problem. But you now have a superhuman coder that does not get tired. Funnily enough, it is the exact same superhuman coder that the rich SaaS provider has access to. At that point, servicing shared software and its complex release pipelines begins to look like a Rube Goldberg machine. Why not skip all that, and let the same coder ship right on your box? On 2026-10-07 GitHub had an incident that slowed pull requests, Actions, webhooks and issues. Imagine waiting for that. I run Forgejo. If Forgejo is down, I ask my agent to bring it back up. If everything goes down, including my vibe-coded harness infrastructure, I ask Claude to bring it all back up.

There is a security side too. Security people now call this month “Black October”. AI-assisted bug hunting found serious flaws in widely used software, one after another, and attacks followed. On 2026-10-21, someone compromised the release pipeline of LiteLLM, a popular LLM gateway, and published version 1.107.0 with a credential stealer inside. It was on PyPI for about two hours. It was the project’s second supply-chain compromise this year. An LLM gateway holds every API key you have. I run my own, so that release never reached my machines. Owning your stack does not make you safe, but it lets you choose what you run.

If I were starting today

1. Get an LLM API key.
2. Point Claude Code at Pi.
3. Ask Claude Code to build a custom harness on top of Pi, with the UI, features and skills you need, based on how you actually use Claude Code.
4. Iterate. Keep evolving the agentic tool, and see where it takes you.

Coming next in this series

Things I tried that worked, and plan to write about:

• My own task board and git forge (Forgejo) as the place where my agents coordinate.
• Small tools made for agents: a switchboard for agent-to-agent messages, and one watch loop that reports only what changed.
• One gateway for every LLM call. Every number in this post comes from it. With every call in one place, I can see where to improve the system: the cache hit rate (87% for gonk this week), the size of the first call (60.5k tokens for Claude Code, about 8k for gonk), and which callers use the tokens (unattended workers used 67% of gonk’s prompt tokens in October).
• An API with SSE as the only interface, and what that makes possible for front ends.