Build your own harness

A harness is everything around the model. Built bottom-up, it has eight layers. You rarely write any of them from scratch: each has open-source pieces in this directory, and the Skills, Plugins & Mods section collects the add-ons for the middle layers.

Skill, plugin and mod are the words this directory uses for layers 2 to 4 and 8. A skill is instructions the agent loads (usually a SKILL.md folder). A plugin is installed through a harness's own plugin system or marketplace. A mod changes how the harness itself behaves: hook packs, workflow layers, config packs, routers.

Start with a loop you can read. If you want to understand the loop before you depend on one, learn-claude-code builds a nano harness from zero. Pi is the minimal end of the real ones; Armin Ronacher notes it "only has four tools: Read, Write, Edit, Bash." Deep Agents is the batteries-included end. Most DIY builders keep a stock agent loop and customise the layers above it.

Add skills before you add code. The Agent Skills format is a folder with a SKILL.md (name, description, instructions) plus optional scripts and assets. Agents load it by progressive disclosure: only names and descriptions at startup, the full file when a task matches. That is why skills are the cheapest layer to try. The skills CLI (npx skills add owner/repo) installs them into the project or globally for the agents you pick, and AGENTS.md is the matching standard for repository-wide instructions.

Use hooks for rules that must hold. A rule in a prompt can be ignored; a hook runs every time. TDD Guard enforces test-first work through Claude Code hooks, and CC Safety Net and Destructive Command Guard block destructive git and filesystem commands before they run. Claude Code Hooks Mastery is a reference for the hook lifecycle. Package what works as a plugin, as Compound Engineering and wshobson/agents do across several harnesses.

Treat context as a budget. Context Mode keeps raw tool output out of the window (its README cites 315 KB reduced to 5.4 KB). planning-with-files keeps the plan on disk so it survives compaction, and claude-mem or agentmemory carry decisions across sessions.

Connect tools over MCP, narrowly. The Model Context Protocol is the default tool bus. Prefer servers with a deliberately small tool surface, and load tool definitions on demand where your client supports it (see §5).

Put the whole thing in a box, then measure it. Pick a sandbox (E2B, container-use, or your harness's own, such as the Claude Code sandbox), trace runs with Langfuse or Phoenix, and keep a small eval set in promptfoo or Inspect. ccusage reads Claude Code and Codex logs for token use and cost, which is the fastest way to see what a new plugin really costs.

Orchestrate last. Once one agent works, Claude Squad runs several in isolated git workspaces, Claude Code Router gives them one local endpoint with fallback models, and oh-my-claudecode or oh-my-codex add team workflows on top of a single harness.

These are starting points, not endorsements. Swap any piece for one from the same layer on Skills, Plugins & Mods.

A skill is text your agent will follow and often scripts it will run; a plugin can add hooks that execute on every tool call. Both run with your agent's access. Before installing anything third-party:

1. Pin it. Install a tagged release or a commit SHA, never a moving branch, and re-review on every bump. Big harnesses ship several releases a week (see the best-practices guide); add-ons move just as fast.
2. Read the SKILL.md and every script. Look for instructions to fetch URLs, read dotfiles, disable confirmations or run bundled binaries. A plugin's hooks are shell commands: read them like a postinstall script.
3. Scan it. SkillSpector checks skills for 71 vulnerability patterns across 17 categories, including prompt injection, exfiltration and supply-chain risks, and outputs SARIF for CI. Snyk Agent Scan covers agents, MCP servers and skills.
4. Allowlist sources. Install only from repos or registries you have approved; a self-hosted registry such as SkillHub adds RBAC and audit logs. Public marketplaces have shipped malicious skills: secondary coverage reported 341 on ClawHub in early 2026 (counts unverified).
5. Sandbox the agent, not just the tool. In Claude Code's sandbox, file tools, MCP servers and hooks run outside the boundary, so a plugin's hook is not confined by it. Hermes' security policy says its terminal backend does not confine code running in the agent's own process, including skills and plugins.
6. Keep secrets out of context. Deny reads of ~/.ssh, cloud credentials and .env files, pass tokens through the environment of the tool that needs them, and prefer memory plugins that scrub secrets, as agentmemory does.
7. Assume prompt injection. Skill text, tool descriptions and tool output are all model input. An agent with private data, untrusted content and a way to send data out is Simon Willison's "lethal trifecta"; remove one leg. MCP tool metadata can hide instructions too (tool poisoning).
8. Give each add-on the least it needs. Narrow MCP servers over a raw shell, read-only scopes over write, and ask-rules (for example on git push) that prompt even inside the sandbox.
9. Measure the cost. Note what a skill pack or plugin adds to every prompt before you keep it (see §5), and drop what you don't use.

From the sourced "What the community says" notes on the project pages. These are user reports, not our measurements.

Add-ons change weekly. Sort Skills, Plugins & Mods by recent updates to see what moved, and filter by the harness you run. Harness Hub's own discovery job searches GitHub every day for new skills, plugins and mods and queues them for human review; nothing is listed until someone has checked it. Know one we missed? Suggest it.

When you update, re-run the checklist in §4 on the diff, and re-run your eval set before and after. If a plugin doesn't move your numbers, it's only adding context.