For agents · harness

The harness.

Three small programs generated from one manifest. Each is read-only. Each verifies what it hands you. None of them need a key, an account, or a network the moment a local copy exists.

Three layers, one contract

Client — packages/harness/client/index.mjs (and a Python twin). Generated from /agents/tools.json; one function per tool; verify() recomputes SHA-256 in-process.
Daemon — harnessd. Binds 127.0.0.0/8 on port 1611 and answers quartet addresses. Same JSON, same hashes, same Merkle root as the hosted API.
MCP server — stdio JSON-RPC exposing the same tools to Claude Desktop, Cursor, or any MCP host. Marks every result verified: true|false.

Because all three are generated from the same manifest, they cannot drift. The build fails if tools.json and the client disagree.

The client

npx harness-talk            # fetch + verify the export, start harnessd on 127.x.x.x:1611
npx harness-talk mcp        # the same, as a stdio MCP server (what agent hosts spawn)
npx harness-talk config cursor   # print the MCP config for cursor | claude | claude-code | windsurf | vscode

Resolution order: local daemon if reachable in 300 ms, otherwise the hosted API. Set preferLocal: false to skip the probe. Errors are RFC 9457 problem objects surfaced as HarnessError with .code and .status.

harnessd — the loopback fabric

Loopback is the whole 127.0.0.0/8 block, sixteen million addresses that every machine already owns. The daemon maps them: 127.BOOK.CHAPTER.VERSE. Genesis is 1, Revelation is 66. Verse 0 means the chapter; chapter 0 means the book; 127.0.0.1 is the index.

curl 127.43.3.16:1611
# For God so loved the world, ...

curl -H 'Accept: application/json' 127.19.23.1:1611
# {"scope":"verse","ref":"ps.23.1","sha256":"...","text":"The LORD is my shepherd; ..."}

curl 127.0.0.1:1611          # corpus index + merkleRoot
curl -i 127.70.1.1:1611      # 404 application/problem+json

The daemon loads the signed export (kjv.jsonl.gz) and recomputes the Merkle root on start. If the root it computes does not match the one embedded in the export, it refuses to serve.

On Linux the whole block is routable by default. On macOS run sudo ifconfig lo0 alias 127.43.3.16 per address you need, or use the hosted resolve endpoint.

MCP server

{
  "mcpServers": {
    "harness": {
      "command": "node",
      "args": ["/path/to/harness/packages/harness/mcp/server.mjs"],
      "env": { "HARNESS_BASE_URL": "https://harness.talk" }
    }
  }
}

Tools: listBooks, getBook, getChapter, getVerse, search, resolveQuartet, listSources, getAnnotations. Nothing writes. See the MCP page for hosts and prompts.

Verification

Every verse carries sha256 = SHA-256(ref + "\n" + text). Leaves are hashed pairwise (raw bytes, odd node paired with itself) to a corpus root published at /.well-known/harness.json. verify() recomputes the leaf. A mismatch means the text was altered in transit or the copy is not this corpus.

What is real today

Live hosted API, tools.json, OpenAPI, llms.txt
Live client (JS + Python), verify(), problem+json errors
Live harnessd on 127.x.x.x:1611 — parity tested against hosted
Live MCP stdio server
Specification · not yet live signed releases, npm/PyPI packages, Homebrew tap