dsh-relay
Harness Relay MCP lets an MCP agent delegate, monitor, steer, and resume long-running DeepSeek Harness tasks through native Harness sessions, with permission presets and durable recovery.
Inspect health and setup:
doctor,setup_plan, andsetup_doctorcheck the Host, Relay endpoint, workspace policy, and client configuration without writing files.Discover workspaces and capabilities:
list_workspacesshows the native Harness workspace registry;list_workspaces_sessionslists reusable sessions;list_capabilitiesexposes providers, models, reasoning efforts, agent presets, and permission presets.Attach to Harness:
start_serviceandopen_serviceattach/open authorized workspaces;list_serviceslists restored attachments;stop_servicedetaches without stopping Harness.Start tasks:
start_runandstart_reviewdispatch tracked tasks with path-reference-only prompts, optional text/image content, model selection, idempotency keys, and permission presets (read-only,workspace-write,danger-full-access).Monitor runs:
get_run,get_run_summary,wait_run,list_runs, andstatus_run(deprecated alias) report status, progress, elapsed time, permissions, and next actions;read_notificationsreplays in-process notifications.Steer and correct:
steer_runinserts corrections into an active run;reply_runcontinues a completed session as a new tracked run.Cancel and reopen:
cancel_runrequests native cancellation;open_runopens the Harness Web session URL.Recover and reconcile:
get_operation,reconcile_operation, andreconcile_permissionsresolve uncertain operations and restore permission leases without duplicate submissions or lost work.Guard against misuse: prompts must reference only paths and scope—never source bodies, diffs, or archives—and the server enforces read-only review or explicit write-permission delegation.
References the Codex guide and dsh-mcp-codex README for documenting the workflow and setup instructions.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@dsh-relayrun relay_doctor and then relay_write_mcp_config for codex"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Harness Relay MCP
English | 简体中文
Delegate and monitor DeepSeek Harness work from any MCP agent.
Delegate long-running work to DeepSeek Harness from any MCP-capable agent—and monitor it to completion.
Harness Relay MCP connects MCP clients to the native DeepSeek Harness session and event model. Its recommended form is a tree-external Harness bundle; it does not wrap the CLI, patch Harness source, or own the Harness process.
MCP agent
│
├─ start_run ── provider / model / reasoning / preset / permission
│
├─ status_run / wait_run / steer_run / cancel_run
│
└─ durable result + native Harness Web session URLPositioning: Harness control plane, not a model wrapper
Harness Relay MCP is an independent third-party project. It is not developed, endorsed, or supported by DeepSeek AI.
This is not a DeepSeek model wrapper. It is the MCP control plane for DeepSeek Harness.
Do not confuse three different integration directions:
The official DeepSeek Harness repository currently documents
mcp-client, which lets Harness consume external MCP servers. It is the opposite direction from exposing Harness as an MCP-controlled worker.Direct DeepSeek MCP servers call a model API and return model output. They do not enter the native Harness session, plugin, workspace, permission, or event lifecycle.
Harness Relay MCP attaches to an existing official Harness Host and exposes that Host's native capabilities to external MCP agents.
As of 2026-08-20, the official dsh launcher source provides profile boot and plugin management but no documented outbound dsh mcp server command. DeepSeek Harness is a developer preview, so re-check the official repository before relying on this comparison.
Comparison last verified: 2026-08-20.
Capability | Official Harness today | Direct DeepSeek MCP | Harness Relay MCP |
Primary direction | Harness consumes MCP tools | MCP client calls a DeepSeek model | MCP client controls a running Harness Host |
Native Harness sessions/events | Native internally, not exported by a documented MCP server | No | Yes |
Harness plugins, tools, and sandbox | Native internally | No | Executed by Harness |
Provider/model/reasoning/preset selection | Available in Harness UI and APIs | Usually a small fixed model surface | Discovered from and selected through the Host |
Native permission presets | Internal Harness behavior | No workspace permission model |
|
Long-running lifecycle | Operated inside Harness | Usually one request/response | Start, status, wait, steer, reply, cancel, reopen |
Durable monitoring and recovery | Harness-owned session history | Usually none | Relay identities, idempotency, reconciliation, and restart recovery |
Harness Web session link | Native UI | No | Returned and verifiable |
Setup and maintenance | Lowest when using Harness directly | Simplest MCP option | More components and ongoing Harness compatibility work |
Choose the right tool
Use a direct DeepSeek MCP server for bounded classification, extraction, summarization, or a quick second opinion where plain model output is enough.
Use Harness Relay MCP when the task must run inside DeepSeek Harness and needs its registered workspaces, tools, plugins, provider catalog, native permissions, persistent sessions, long-running monitoring, recovery, or Web inspection.
Do not install Relay only to replace one ordinary chat-completions request; the additional Host, state, authentication, and proxy layers would add complexity without providing useful control-plane value.
Related MCP server: dsh-codex-mcp
Highlights
Native Harness sessions and durable events instead of CLI output parsing.
Complete asynchronous lifecycle: start, status, wait, steer, reply, cancel, and reopen.
Provider, model, reasoning effort, agent preset, and native permission selection before the first task prompt.
Direct support for
read-only,workspace-write, anddanger-full-accessHarness permissions.Ordered text and inline image prompts with bounded base64 validation.
Persistent run identities and recovery after the MCP server restarts.
Stable Harness Web session links, with explicit visible-page verification in the bundled Skill.
Compatible with Codex, Claude Code, OpenCode, Cursor, and other standards-compliant MCP clients.
The internal bundle uses Harness 0.1.2's direct Typert Gateway and native permission service; external agents connect through authenticated HTTP or the stateless stdio proxy.
The standalone
dsh-relaymode remains available for older Harness versions and explicit rollback.
Requirements
Node.js
^22.19or>=24.Internal mode requires DeepSeek Harness
>=0.1.3-alpha.2 <0.2.0, thewebprofile, and a127.0.0.1bind. This floor includes the upstream Windows background-child fix, so model-drivenrgand other ordinary CLI calls do not open transient console windows. Relay 0.2.6 and earlier target the removed rc.7 ApiProxy surface and do not load in this Harness line.Standalone compatibility mode requires a running DeepSeek Harness Web Host on loopback HTTP.
The target workspace must already be registered by Harness or be inside an explicitly configured allowed root.
The default Host is:
http://127.0.0.1:3080/Installation
Install as a Harness bundle (recommended)
Install the published package from npm with the official profile command, inspect the composed configuration, and then start the profile:
dsh plugin --profile web add harness-relay-mcp
dsh --profile web --dump-config
dsh --profile webFor an offline or pinned-file installation, download the release tarball and replace harness-relay-mcp in the first command with its local .tgz path.
The dump must contain id: harness-relay-mcp and name: 'harness-relay-mcp', so the Harness inventory shows the slash-free name harness-relay-mcp. If dsh web is already running, restart that Host after an install or upgrade so it loads the new bundle. Once started, the bundle continues to publish its non-secret descriptor at the backward-compatible path $DSH_HOME/plugins/dsh-relay/web/relay-endpoint.json; its Bearer token lives separately in the Host-specific state directory.
Uninstalling infrastructure does not cancel submitted Harness work:
dsh plugin --profile web remove harness-relay-mcpDo not configure Relay into the same Harness MCP client, which would create a Harness → Relay → Harness recursion.
Install the Codex plugin
The Codex plugin is an external caller layer; it does not replace the Harness bundle above. First confirm that dsh --profile web has loaded harness-relay-mcp, then install the Codex plugin from this repository's marketplace:
codex plugin marketplace add tonytanglab/deepseek-harness-relay-mcp
codex plugin add deepseek-harness-relay@harness-relay
codex plugin listThe first command registers this project's GitHub marketplace. The second fetches the same-version plugin package from npm and loads its .mcp.json plus the delegate-to-deepseek-harness Skill in Codex. The Codex layer starts only the stateless dist/dsh-relay-proxy.mjs, which discovers and connects to the running Harness bundle through its endpoint descriptor. It does not modify DeepSeek Harness source, the internal bundle configuration of the web profile, or cordis.patch.yml.
If an update leaves native tools missing and Codex reports connection closed: initialize response, check whether the cache directory referenced by the task still contains dist/dsh-relay-proxy.mjs. A newer cache directory alone does not prove that the running host uses it. Reinstall from the confirmed marketplace with the Codex CLI used by the desktop app; after saving active work, restart the app if a new task still references the removed cache. Verify native doctor and the tool catalog before declaring recovery. Do not substitute a temporary Relay client.
When a personal Marketplace points at a local source checkout, the Codex installer copies the files that already exist; it does not run the TypeScript/esbuild build. After every source pull, run pnpm run prepare:codex-local in that checkout before generating a cachebuster and running codex plugin add. The command builds and verifies all three dist entry points, their embedded version, and the proxy's stable full tool catalog. Skipping it can produce a false upgrade where the manifest and install record are new but the MCP process still executes an old bundle. Prefer the repository Marketplace/npm path above for normal installations.
Codex built-in MCP generation contract
The Codex plugin manifest must reference both the packaged Skill and MCP declaration:
{
"skills": "./skills/",
"mcpServers": "./.mcp.json"
}The packaged .mcp.json must use the plugin-relative proxy entrypoint:
{
"mcpServers": {
"harness-relay-mcp": {
"command": "node",
"args": ["./dist/dsh-relay-proxy.mjs"],
"cwd": "."
}
}
}Codex resolves cwd: "." against the installed plugin version root. Do not hard-code a development checkout or a versioned %USERPROFILE%\.codex\plugins\cache\... path, and do not register a duplicate server in user config.toml. Codex must start only dsh-relay-proxy.mjs: never point it at dsh-relay-harness.mjs (the internal Harness bundle), dsh-relay.mjs (a separate standalone control plane), or manually start another Harness Web. The proxy discovers the authority through $DSH_HOME/plugins/dsh-relay/web/relay-endpoint.json. When the recorded owner is provably dead and the loopback port is confirmed free, Relay 0.2.8+ can safely restart the exact launcher contract published by the previous embedded Host; an occupied or unprobeable port still fails closed. Client configuration never stores the bearer token.
In a new Codex task, use doctor → list_workspaces → list_capabilities, then start_review for analysis or start_run with workspace-write when the user explicitly delegates implementation. Keep calling wait_run to a terminal state, consume assistantText, and verify the result. Invoke those operations only as native MCP tool calls from the installed plugin. Never generate a temporary .tmp/harness-*-call.mjs client or call/poll Relay through node, PowerShell, Python, or another shell: that bypasses managed background transport and can open visible console windows on Windows. If the tools are unavailable, repair or reinstall the plugin and start a new Codex task instead of using a shell fallback. When a user explicitly selects Harness or a Harness model to review or modify the current or named registered workspace, Harness is authorized to read that in-scope workspace itself. The calling task sends only the workspace, file/directory locations, review or implementation scope, acceptance criteria, and routing/permission metadata. Harness reads the named files from the authorized workspace. Both read-only and workspace-write forbid embedding source bodies, diffs, file dumps, encoded source, or repository archives in task, text content, steer_run, or reply_run arguments. Write permission changes what Harness may do, not how source is transferred. This does not authorize credentials, secrets, or unrelated paths.
Restart Codex after installation and start a new Codex task so the new task loads the MCP server and Skill. In that task, ask:
Call Harness Relay doctor and list_workspaces in read-only mode to verify the Harness Host, Relay endpoint, and workspace registry.To refresh the repository marketplace and reinstall the Codex plugin:
codex plugin marketplace upgrade harness-relay
codex plugin add deepseek-harness-relay@harness-relayRestart Codex and create another new task after the upgrade. Never configure Relay as an MCP client of the same Harness instance. Codex connects to the Relay proxy, while Harness continues to manage its internal bundle through dsh plugin --profile web add harness-relay-mcp. See the OpenAI plugin packaging documentation for the official marketplace format and commands.
Ask AI to analyze and assist with installation
Before the plugin is installed, users can give the following prompt to Codex with terminal access. The AI should inspect the environment read-only, explain the proposed changes, and obtain confirmation before installing. It must not modify the DeepSeek Harness product source or configure Relay back into the Harness MCP client:
Read the Installation section at https://github.com/tonytanglab/deepseek-harness-relay-mcp/blob/main/README.md and help me install Harness Relay MCP.
First inspect the operating system, Node.js version, dsh, Codex CLI, Harness web profile, and 127.0.0.1:3080 without modifying files.
Report the checks, missing dependencies, exact commands, and impact. Wait for my confirmation before making changes.
On the Harness side, install the internal bundle only with dsh plugin --profile web add harness-relay-mcp. Do not modify DeepSeek Harness source and do not add Relay as a Harness MCP client.
On the Codex side, add the tonytanglab/deepseek-harness-relay-mcp repository marketplace and install deepseek-harness-relay@harness-relay.
The Codex manifest must reference the packaged .mcp.json, which must run node ./dist/dsh-relay-proxy.mjs with cwd ".". Do not point it at dsh-relay-harness.mjs or dsh-relay.mjs, duplicate it in user config.toml, or manually start a second Harness Web. Let the proxy perform its guarded single-instance recovery when the recorded owner is dead.
When I explicitly select Harness or a Harness model to review or modify the current or named registered workspace, let Harness read within that scope itself. Send only the workspace, file/directory locations, review or implementation scope, acceptance criteria, model, permission, and idempotency metadata. For both read-only and workspace-write, never place source bodies, diffs, file dumps, encoded source, or repository archives in task/content/steer_run/reply_run arguments. Use start_run + workspace-write only when I explicitly ask Harness to modify code; use start_review for ordinary review.
After installation, verify dsh --profile web --dump-config and codex plugin list, then remind me to restart Codex, create a new task, and run doctor and list_workspaces.
If any command fails, stop and report the original error. Do not broaden permissions or delete existing configuration.Local development
pnpm install
pnpm run buildAfter the internal bundle starts, point MCP clients at the universal stdio proxy:
{
"mcpServers": {
"harness-relay-mcp": {
"command": "node",
"args": ["C:/Users/you/plugins/deepseek-harness-relay-mcp/dist/dsh-relay-proxy.mjs"],
"env": {
"DSH_RELAY_CLIENT_PRINCIPAL_ID": "cursor:project"
}
}
}
}The proxy defaults to $DSH_HOME/plugins/dsh-relay/web/relay-endpoint.json; when DSH_HOME is unset it consistently falls back to .dsh under the user home, and a blank DSH_PROFILE falls back to web. Set DSH_RELAY_ENDPOINT_DESCRIPTOR when using a custom state directory. Client configuration never stores the token. The harness-relay-mcp package root is the Harness bundle and ships harness-relay-mcp plus harness-relay-mcp-proxy; the old dsh-relay commands remain compatibility aliases.
Starting with 0.2.3, the internal bundle atomically publishes a credential-free relay-status.json beside the endpoint descriptor. The stdio proxy starts its local MCP surface first. tools/list and the local doctor never wait for remote connection or Harness auto-start. The proxy generates the complete product tool catalog from the same registrations as the embedded Relay, so Codex discovers list_capabilities, start_review, wait_run, and the other native tools even while recovery is pending. If the endpoint is missing, startup failed, owner epochs disagree, the token is unreadable, or POST returns 401/404/405/503, calls other than doctor return RELAY_ROUTE_UNAVAILABLE until the route recovers. The same proxy reconnects after Host recovery and emits tools/list_changed so clients can refresh any remote metadata changes.
Quick start
First discover the native Harness workspace registry instead of treating the Host process directory as an authorization list:
{
"tool": "list_workspaces",
"arguments": {}
}Then discover the Host capabilities instead of guessing route names:
{
"tool": "list_capabilities",
"arguments": {}
}Then dispatch a read-only Kimi K3/MAX review:
{
"tool": "start_review",
"arguments": {
"workspace": "D:/work/project",
"task": "Read README.md, skills/delegate-to-deepseek-harness, and src/mcp-server; review the task contract and permission boundary and return reproducible findings only.",
"provider": "kimi-coding",
"model": "k3",
"reasoningEffort": "max",
"agentPreset": "standard",
"idempotencyKey": "review-2026-08-19-001"
}
}Store the returned runId, sessionId, and webUrl. Keep calling wait_run until a terminal status. Each call waits at most 30 seconds; a timeout with status: running is a slice, not completion. If hostPollContract.hostMustCallWaitRunAgain is true, call wait_run again immediately. Sharing webUrl is not completion:
{
"tool": "wait_run",
"arguments": {
"runId": "<run-id>",
"timeoutMs": 30000
}
}For an active correction, use steer_run. After a run reaches a terminal state, use reply_run to continue the same native Harness session.
Omitting both sessionId and sessionMode creates a fresh session inside the selected Harness workspace. To continue an existing project conversation, call list_workspace_sessions first and pass its idle sessionId, or pass sessionMode: "latest-idle" to reuse the newest nonblank, idle, unarchived session. An explicit sessionId cannot be combined with sessionMode.
Run lifecycle
start_run
│
├─ reserve the session
├─ select model and native permission preset
├─ persist runId + prompt rpcId
├─ submit session.prompt
└─ reconcile durable history
running ── status/wait/steer/cancel ──> succeeded | incomplete | failed | cancelled | needs_attention
│
└─ terminal ── reply_run ──> a new run in the same sessionpromptAdmission reports the prompt admission state:
Value | Meaning |
| The run identity is durable, but prompt submission has not completed. |
| Harness accepted the prompt or its durable message was observed. |
| The transport response was unavailable; reconcile by |
| Harness did not persist or accept the prompt. |
start_run parameters
Parameter | Required | Description |
| Yes | Absolute workspace path allowed by Relay policy. |
| One prompt form | Plain text containing only file/directory locations, review or implementation scope, and acceptance criteria. Source bodies, diffs, file dumps, encoded source, and repository archives are forbidden. Mutually exclusive with |
| One prompt form | Ordered text/image blocks under the same path-and-scope-only contract. Images are for task-required non-workspace evidence, not a substitute for Harness reading workspace source. Mutually exclusive with |
| No | Reuse an idle session in the selected workspace. |
| No |
|
| With | Exact provider ID returned by |
| With | Exact model ID returned by |
| No | Adapter-supported effort such as |
| No | Harness agent preset; selectable only for a fresh session. |
| No | Native permission preset; defaults to |
| For full access | Must be |
| Recommended | Stable caller key; a retry with the same request returns the original operation instead of resubmitting. |
| No | Keep |
Image prompts
Use canonical base64 without a data: URL prefix:
{
"workspace": "D:/work/project",
"content": [
{ "type": "text", "text": "Review this screenshot." },
{
"type": "image",
"mediaType": "image/png",
"data": "<canonical-base64>",
"name": "screen.png"
}
]
}Supported media types are PNG, JPEG, WebP, and GIF. Image bytes are forwarded to Harness but are not retained in Relay run snapshots or state files.
Native permission presets
Preset | Intended use |
| Review, diagnosis, research, comparison, and planning; task arguments contain only locations and scope. |
| Implementation restricted to authorized workspace write paths; task arguments still contain only locations and scope, never source bodies. |
| Full Harness access; use only when the caller intentionally authorizes it. |
In embedded mode, DSH Relay activates the addressed Session when necessary, calls the native permission service directly, and confirms the resulting preset before submitting the first task prompt. A textual instruction is never treated as a permission boundary, and a permission preset never relaxes the path-reference-only task-transfer contract.
start_review, start_run, and reply_run accept a structured scope declaration: reviewTargets identifies the subjects, contextReadScope identifies supporting locations Harness may search and read, excludedPaths identifies exclusions, and writeScope identifies writable locations. When reviewing a plan, the target file is not a read whitelist; include the authorized repository or relevant subtrees in contextReadScope unless the user explicitly requests a target-only review. Relay adds these fields to the Harness prompt and preserves them across reply_run, but they are not per-path filesystem enforcement. Native Harness permissions control the broad read/write mode. The selected model may still process read content through its configured provider; a loopback Relay connection does not mean all model processing is local.
When the current conversation explicitly asks to use Harness, the caller may pass authorizationBasis: explicit-user-request to record that existing choice for Codex approval review. The field does not broaden the workspace, context, permission, model provider, or allowed external actions, and it does not guarantee automatic approval. Callers should prefer the exact provider and model returned by list_capabilities so the content-processing destination is identifiable.
MCP tools
Tool | Purpose |
| Check the Relay package, Host connection, workspace policy, and persistent state. |
| Generate a validated, no-write client configuration patch. |
| Evaluate a setup plan and caller-supplied probes as a machine-readable report. |
| Attach an authorized workspace to Harness; the proxy first performs guarded Host recovery when needed. |
| Open the Host root URL. |
| List restored workspace attachments. |
| List the native Harness workspace registry used for routing. |
| List direct sessions in one registered workspace without reading conversation content. |
| Detach Relay state without stopping Harness. |
| List provider/model/reasoning and agent preset choices plus native permission modes. |
| Create or reuse a session and submit a tracked task. |
| Submit a native |
| Insert a correction into an active run. |
| Read and reconcile one run; the preferred run-status entry point. |
| Project a run into stable status, model, permission, elapsed-time, and next-action fields. |
| Deprecated compatibility alias; migrate to |
| Open the native Harness Web session URL. |
| Wait up to 30 seconds for progress. A timeout is a slice; if |
| Reconcile and list persisted runs. |
| Read one durable idempotent start, reply, steer, or cancel operation. |
| Resolve an uncertain operation from durable Harness events without duplicate submission. |
| Retry restoration of expired or interrupted native permission leases. |
| Continue a completed session as a new tracked run. |
| Request native Harness cancellation. |
| Replay the bounded in-process notification projection after a cursor. |
Client setup and monitoring projection
setup_plan supports Codex, Claude Code, Cursor, and the explicitly versioned OpenCode V2 layout. It accepts already-resolved absolute Node and Relay entry paths and returns only a structured minimal patch; it never edits a client configuration. The launcher platform must match the configuration platform, and package-manager shims such as pnpm.exe or pnpm.cmd are rejected as Node runtimes.
setup_doctor is also side-effect free. Filesystem, Broker, Host, workspace, model, and permission facts must be supplied by an authorized caller; omitted probes are reported as skipped instead of being guessed.
get_run_summary consumes the authoritative Relay run snapshot and exposes the versioned monitoring projection. read_notifications replays notifications retained by the current MCP server process and returns explicit cursor-gap metadata. Native run-notification transport is not enabled yet, so clients must treat an empty buffer as normal and fall back to get_run_summary, wait_run, or get_run polling.
Persistence and recovery
The default state file is:
%LOCALAPPDATA%/dsh-relay/state.jsonState is schema-validated, locked across processes with owner-verified leases, and written through atomic replacement with restrictive file permissions where supported. Stale writers cannot regress stopped services, terminal runs, attention states, operations, or permission leases. Invalid files are quarantined rather than overwritten. By default, prompt text and image bytes are not persisted. After a Relay restart, run and operation identities are restored and reconciled with native Harness history. Assistant text from the reconciled turn is retained in event order instead of returning only the final assistant message. A run that produces no durable progress for the configured interval enters needs_attention with attentionReason: run_stalled; later progress automatically returns it to running.
The embedded Host also publishes a credential-free launcher contract containing only the absolute Node/dsh entry, the official Node loader arguments required by a source launch, profile, working directory, and Relay runtime paths. A built lib/bin.js entry uses plain Node; an apps/cli/src/bin.ts entry must retain the exact tsx ESM loader vector, and raw Node source launchers are rejected. On OWNER_DEAD or a cleanly stopped Host, the stdio proxy takes a cross-process start lock, rechecks status, confirms the recorded loopback port is free, validates the launcher shape and files, and starts Harness hidden with --no-open. Concurrent clients converge on one launch. Missing or invalid launchers, unknown owner state, occupied ports, and startup failures remain explicit fail-closed diagnostics.
Multiple local MCP server processes may share one state file; writes are serialized and merged by stable identifiers. An abandoned lock fails closed instead of being deleted by age. Use separate DSH_RELAY_STATE_FILE paths when clients require operational isolation.
Session links
Each run returns a native URL in this form:
http://127.0.0.1:3080/?sessionId=<session-id>An HTTP 200 response proves only that the Host answered; it does not prove that a very large live transcript finished rendering. The bundled Skill keeps Harness headless and shares the returned session URL as a clickable link. It calls open_run and verifies the visible workspace and session only when the user explicitly asks to open or show the page. Harness may normalize the address bar back to the Host root while retaining the selected session.
Configuration
Environment variable | Default | Purpose |
|
| Loopback Harness Host URL. |
|
| Allow the stdio proxy to restart the previously recorded Harness Web launcher after safe owner and port checks. |
|
| Maximum time to wait for guarded Host recovery to publish a ready Relay endpoint. |
| Harness workspace registry | OS-delimited list of additional authorized absolute roots. Without it, Relay accepts only workspaces already registered by Harness. |
|
| Persistent Relay state location. |
|
| Persist prompt summaries when explicitly acceptable. |
|
| Stable local caller identity used with idempotency keys. |
|
| Maximum lifetime recorded for a reused-session permission lease. |
|
| Host RPC timeout. |
|
| Active-run polling interval. |
|
| Maximum durable-history pages read during one reconciliation. |
|
| No-progress interval before an active run is marked |
|
| Maximum text characters in one prompt. |
|
| Maximum returned assistant-text tail. |
|
| Maximum decoded bytes per image. |
|
| Maximum images per message. |
|
| Maximum decoded image bytes per message. |
Only loopback HTTP Hosts are accepted. Workspace paths are resolved through the filesystem before containment is checked.
Security model
Harness Relay MCP does not read or store Harness credentials.
The existing Harness Host remains authoritative for models, permissions, sessions, attachments, and task execution.
The default permission preset is
read-only.Without explicit roots, the Harness workspace registry is the routing authority; configured roots remain a stricter local boundary when present.
stop_servicenever stops Harness or deletes a session.Harness findings are evidence; the calling agent remains responsible for final verification and high-stakes decisions.
Relay cannot guarantee whether Codex or another MCP client will request approval or run auto-review; those decisions remain governed by the client, its policy, and the requested operation.
Standards boundary
Harness Relay MCP uses a dual-layer compatibility design. The harness-relay-mcp package root is an out-of-tree, in-process bundle that follows the Harness/Cordis contract, exports Config/apply(ctx), and installs through dsh.bundle plus cordis.patch.yml. Version 0.2.9 binds to the 0.1.2 Host services (typertGateway, Session/Workspace/Settings controllers, Agent Presets, WebServer, and Permission Presets), translates session.follow/page and workspace.follow into Relay's semantic gateway, and keeps durable polling authoritative when the removed rc.8 mux streams are unavailable. External agents use the same internal authority through authenticated HTTP or the stateless proxy; the standalone entry remains a compatibility and rollback path. No Harness product source is copied or modified.
See the official DeepSeek Harness documentation for creating a Harness plugin and publishing bundles.
Development and validation
version.json is the only editable version source. A build synchronizes package and Codex manifests before emitting the self-contained MCP bundle.
pnpm run test
pnpm run build
pnpm run test:mcp
pnpm run check:package
pnpm pack --dry-runprepack performs strict TypeScript checking, builds the bundle, and validates the explicit publication whitelist. Sensitive/runtime-generated directories and files are rejected, symbolic links are rejected, and the default expanded-file budget is 8 MiB. Release automation may lower or raise that gate with DSH_RELAY_PACKAGE_MAX_BYTES; raising it should be reviewed rather than used to bypass unexpected package growth. test:mcp always rebuilds before starting the stdio smoke test.
Identity
Surface | Name |
Product | Harness Relay MCP |
Repository |
|
Codex plugin ID |
|
npm package |
|
MCP server ID |
|
Skill |
|
License
MIT
Available Tools
25 toolscancel_runCancel a Harness runCDestructiveIdempotent
Request cancellation through the public Host API.
| Name | Required | Description | Default |
|---|---|---|---|
| runId | Yes | ||
| idempotencyKey | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true, readOnlyHint=false, and idempotentHint=true. The description adds the subtle behavioral trait that this is a 'request' for cancellation rather than an immediate cancel, but it does not explain what happens to the run, whether cancellation is reversible, or any downstream effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no filler or repetition. It is front-loaded and easy to parse, though it is arguably too brief to carry the behavioral and usage context needed for a destructive operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation tool with no output schema and no usage guidance, the description is underspecified. It omits cancellation semantics, prerequisites, effects on the run, and any indication of what the agent should expect after invoking it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no meaning about runId or idempotencyKey. The schema itself defines formats and constraints, but the description does not explain the purpose of either parameter, when idempotencyKey should be used, or how runId relates to a cancellation flow.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear action ('Request cancellation') and a clear resource ('a Harness run'), which matches the title and tool name. It is distinguishable from siblings like 'start_run' and 'steer_run', though it does not explicitly differentiate itself from them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no when-to-use or when-not-to-use guidance and does not mention alternatives. An agent is not told when cancellation is appropriate, what conditions are required (e.g., run must be active), or how this differs from related operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
doctorCheck Harness Relay MCP and HarnessARead-onlyIdempotent
Check the external Harness Host and relay policy without reading credentials.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is well covered. The description adds meaningful behavioral context beyond annotations, especially that it operates 'without reading credentials,' which is important for security-conscious agents. This extra disclosure makes the behavior more transparent than the schema alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single focused sentence that front-loads the tool's purpose and includes the most critical security-related caveat ('without reading credentials'). Every word earns its place, and the title provides useful additional framing without bloating the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only tool, the description is mostly adequate and the annotations carry the safety context. However, there is no output schema and the description does not indicate what the return payload looks like, whether it is a simple status, a policy report, or a boolean pass/fail. This missing expected-output information leaves an agent slightly uncertain about how to interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and required parameters are zero, so the schema has 100% coverage trivially. There are no parameter semantics to document, and the description correctly avoids inventing meaningless parameter details. Baseline of 4 is appropriate for a no-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Check') and identifies a clear resource ('external Harness Host and relay policy'). It also distinguishes itself from sibling setup_doctor by framing this as a verification action rather than a setup action. It loses one point because it does not state what a successful check returns or what exact conditions are being validated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for verifying external Harness connectivity and relay policy, and the sibling name setup_doctor suggests an alternative for installation/configuration. However, there is no explicit when-to-use versus when-not-to-use guidance, and no mention of when to prefer sibling tools such as status_run or get_operation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_operationRead a relay operationARead-onlyIdempotent
Read the durable idempotent operation record for a start, reply, steer, or cancel request.
| Name | Required | Description | Default |
|---|---|---|---|
| operationId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds the 'durable' qualifier and the request-scope, but does not disclose behavior like not-found handling or the exact response shape. It contributes some context beyond annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler. The verb and object appear first, the scoping qualifiers follow, and every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with readOnly and idempotent annotations and no output schema, the description is nearly complete: it names the resource and the exact request types it covers. It stops short of describing response contents, but 'Read the ... operation record' sufficiently implies the return value for this simple read operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the undocumented operationId parameter. It partially does by indicating that the ID refers to a durable operation record for start/reply/steer/cancel requests. However, it does not explain where the operationId comes from or otherwise enrich the parameter meaning much beyond the schema's name and uuid format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and a specific resource ('durable idempotent operation record'), and narrows the scope by enumerating the request types: start, reply, steer, or cancel. This makes the tool easy to distinguish from run-focused siblings like get_run or status_run.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when to use this tool: when you need the operation record for a start, reply, steer, or cancel request. It does not explicitly name alternatives or state when not to use it, but the request-type enumeration is strong contextual guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_runRead a Harness runARead-onlyIdempotent
Preferred tool to reconcile and return one run snapshot; replaces the deprecated status_run alias. If status is running or unknown, hostPollContract.hostMustCallWaitRunAgain is true and the host must not conclude.
| Name | Required | Description | Default |
|---|---|---|---|
| runId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description's job is to add context beyond those. It does so well by disclosing the polling contract: a non-terminal status forces hostMustCallWaitRunAgain=true and forbids conclusion. It also notes the deprecation of status_run, which helps an agent understand expected behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The first sentence establishes purpose and preference, and the second delivers the critical behavioral contract. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read tool, the description covers the essential safety and polling behavior. It lacks an explicit return-value description and does not explain runId, but the 'run snapshot' phrase plus the schema's strongly typed runId keep the definition mostly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description should compensate by explaining the runId parameter or how it is used. It never mentions runId, format expectations, or how the run snapshot is selected. The schema itself is self-descriptive with a UUID pattern, but the description adds no parameter-level meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'reconcile and return one run snapshot' and notes it replaces the deprecated status_run alias. It identifies a specific resource (a Harness run) and a read operation, though it does not explicitly distinguish itself from siblings like get_run_summary or open_run.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It frames get_run as the 'Preferred tool' for this task and calls out the deprecated status_run alternative. It also gives a concrete post-call condition: if status is running or unknown, the host must not conclude and must call wait_run again. It lacks explicit exclusions for other sibling tools, but the context is fairly clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_run_summaryGet a structured Harness run summaryBRead-onlyIdempotent
Project the current durable run snapshot into stable status, model, permission, elapsed time, and next-action fields.
| Name | Required | Description | Default |
|---|---|---|---|
| runId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| model | No | |
| runId | Yes | |
| usage | No | |
| status | Yes | |
| progress | No | |
| provider | No | |
| attention | No | |
| elapsedMs | No | |
| startedAt | Yes | |
| updatedAt | Yes | |
| finishedAt | No | |
| nextAction | Yes | |
| permissionMode | Yes | |
| reasoningEffort | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotenceHint=true, so the safety profile is clear. The description adds the context that the summary is projected from a durable snapshot into stable fields, but it does not disclose edge behaviors such as errors, missing runs, or staleness. This is acceptable given the annotations but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler. It is compact and places the core action first. However, words like 'Project' and 'durable run snapshot' are slightly jargon-heavy, which reduces immediate readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has a single parameter, generous annotations, and an output schema, so return values need not be explained. Still, the description leaves gaps around when to select this tool over closely related run tools, and it provides no context about how the summary relates to the live run state.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not mention the runId parameter at all. The parameter name and UUID format are somewhat self-explanatory, but the description does not compensate for the total lack of schema-level description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Project') and a specific resource ('current durable run snapshot'), and lists the stable output fields. It is clear about what the tool does, but it does not explicitly distinguish itself from the sibling get_run, which could also plausibly return run information.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus get_run, status_run, open_run, or wait_run. The phrase 'durable run snapshot' hints at a read-oriented summary, but there is no explicit when-to-use, alternative, or exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_capabilitiesList Harness run optionsARead-onlyIdempotent
List native Provider/model/reasoning, agent preset, and permission preset options without guessing names.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent, and non-destructive behavior, so the bar for extra disclosure is lower. The description adds that the tool returns canonical option names rather than guesses, which is useful, but it does not describe output format, ordering, or any environment-specific behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the verb and object, lists the option categories compactly, and closes with a meaningful behavioral qualifier. Every word adds value and nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only discovery tool, the description is complete: it names exactly what the agent will learn and gives no ambiguous invocation requirements. No output schema is present, but the description adequately conveys the return concept — available option names.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the input schema is intentionally empty and there is no parameter burden to document. Baseline for zero-parameter tools is 4; the description adds relevant semantic context by naming the categories of values the tool exposes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List'), resource (native Provider/model/reasoning, agent preset, and permission preset options), and a clear purpose ('without guessing names'). It distinguishes this tool from sibling list tools like list_services, list_workspaces, and list_runs by naming the exact option categories it covers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'without guessing names' implies this tool should be used when the agent needs authoritative option values before configuring or running something. It provides clear context for when to call it, though it does not explicitly name alternative tools or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_runsList Harness runsCRead-onlyIdempotent
Reconcile and list runs restored from durable relay state.
| Name | Required | Description | Default |
|---|---|---|---|
| serviceId | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this read-only, idempotent, and non-destructive, so the description need not restate that. It adds a data-source context ('restored from durable relay state') but does not clarify what 'reconcile' does or how it relates to the read-only guarantee.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The one-sentence description is efficiently front-loaded and contains no filler. However, its brevity comes at the cost of clarity around 'reconcile'.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should indicate what a caller receives (a list of runs) and whether serviceId filters results; neither is stated. The tool's role relative to other run tools is also underspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter serviceId is not mentioned in the description at all, and schema coverage is 0%. Since the schema only provides a UUID format, the description fails to explain the parameter's role (e.g., filtering runs by service) or its optionality.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The title and description clearly identify a list operation for runs. The phrase 'reconcile and list' adds ambiguity, and the description doesn't explicitly distinguish this from siblings like get_run or status_run, so it stops short of a top score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to choose list_runs over the many run-related siblings (get_run, get_run_summary, status_run, open_run, wait_run). There is also no mention of whether the optional serviceId should be used to scope the list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_servicesList Harness attachmentsBRead-onlyIdempotent
List Host attachments restored from durable relay state.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide the safety profile (readOnly, idempotent, non-destructive), so the description only needs to add extra behavioral context. It adds an origin detail ('restored from durable relay state') but does not explain what restoration means for the returned data or what behaviors to expect. There is no contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no filler. It loses a point because the 'Host' vs 'Harness' terminology inconsistency and the obscure 'durable relay state' phrase reduce clarity despite the brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only list tool with rich annotations, the description is close to sufficient, but it leaves the relationship between 'services', 'Host attachments', and 'durable relay state' unexplained. Without an output schema or return-value details, an agent may still be unsure what exactly will be listed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is 100%, so the baseline is 4. The description adds no parameter-specific meaning because there are no parameters to describe, and none are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action and resource ('List Host attachments'), but the resource is ambiguous and inconsistent with the tool name ('list_services') and title ('List Harness attachments'). It is not a tautology, but the meaning of 'Host attachments restored from durable relay state' is vague for an agent deciding what this tool returns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives like list_workspaces or list_capabilities. The description does not mention any conditions, exclusions, or sibling tools, leaving the agent to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workspacesList Harness workspacesARead-onlyIdempotent
List the native Harness workspace registry used by Relay routing.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| mode | Yes | |
| roots | Yes | |
| workspaces | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds no additional behavioral details beyond the fact that it lists something, and it does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that leads with the action and resource, then adds the relevant routing context. It contains no redundant wording and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple zero-parameter list operation with no nested objects, a well-defined output schema, and annotations that cover idempotence and safety. The description is sufficient for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so there is nothing to document. A baseline score of 4 is appropriate because the description cannot add parameter meaning that does not exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List'), a clear resource ('native Harness workspace registry'), and a context qualifier ('used by Relay routing'). It is clearly about listing workspaces, not workspace sessions or services, though it does not explicitly name a sibling for contrast.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'used by Relay routing' gives some contextual hint about when this tool is relevant, but the description does not explicitly state when to prefer this tool over alternatives like list_workspace_sessions or list_services. The usage guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workspace_sessionsList sessions in a Harness workspaceARead-onlyIdempotent
List reusable native sessions accounted to one registered Harness workspace without reading conversation content.
| Name | Required | Description | Default |
|---|---|---|---|
| workspace | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| sessions | Yes | |
| workspace | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint=true, idempotentHint=true, destructiveHint=false), so the bar is lower. The description adds genuine value by disclosing that the tool deliberately avoids reading conversation content, which is a meaningful behavioral boundary not present in annotations. No contradiction found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tightly worded sentence front-loaded with the action verb. Every phrase earns its place: reusable, native, registered, and without reading conversation content each add a distinct qualifier with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, read-only list tool with a rich annotation set and an output schema, the description is largely sufficient. The minor gaps are the absence of ordering or pagination notes and no explicit alternative routing, but these are mitigated by the output schema and the simplicity of the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does add meaning beyond the bare string schema by specifying that the workspace parameter must reference a 'registered Harness workspace,' but it doesn't explain how to obtain or format the identifier. The compensation is partial.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (List), a precise resource (reusable native sessions), a scope (one registered Harness workspace), and a meaningful constraint (without reading conversation content). It is clearly distinct from sibling tools that list services, workspaces, runs, or capabilities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'one registered Harness workspace' qualifier implies the precondition that the workspace must already be registered, and the 'without reading conversation content' phrasing hints at a non-content-oriented use case. However, no explicit when-to-use or when-not-to-use guidance is given, and no sibling alternatives are named, so routing relies on inference from resource names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_runOpen a Harness runAIdempotent
Open the native Harness Web session in the operating system default browser. Call only when the user explicitly asks to open or show the Harness page.
| Name | Required | Description | Default |
|---|---|---|---|
| runId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
It adds an observable external behavior beyond the structured hints: a browser session is opened in the OS default browser. It also communicates that this is user-visible, not a background/API-only action, and gives an explicit guardrail for when it should be invoked.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description uses two short sentences with no filler: one sentence states the action and the other states the when-condition. Every clause contributes to correct tool invocation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter, side-effect tool, this is nearly complete: the agent knows the behavior, the trigger condition, and the schema supplies the required runId. It misses only the parameter-level explanation, which prevents a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain that the required runId is the run whose Harness Web page should be opened. Although the parameter name and schema format communicate part of the meaning, the description itself adds no semantic value for the one parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the precise behavior: opening a native Harness Web session in the operating system default browser. It distinguishes this from run execution, status, or service tools by naming the exact launch mechanism and target.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description sets an explicit trigger condition: only call when the user explicitly asks to open or show the Harness page. It does not name alternative sibling tools, but the gate is narrow enough for correct selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_serviceOpen DeepSeek HarnessBIdempotent
Open the stable loopback Harness page for an attached service.
| Name | Required | Description | Default |
|---|---|---|---|
| serviceId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already indicate this is not read-only and operates in an open world, yet the description does not disclose what state change or external effect occurs when the page is opened. It adds no behavioral context beyond the basic action name, and there is no contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler, redundant examples, or restatement of the schema. Every word contributes to identifying the target resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool with one parameter and annotations, this is minimally viable: it names the action, target, and precondition. Clear gaps remain—'Harness page', 'stable loopback', and 'attached' are domain terms not explained, and no sibling differentiation is provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides only the type and UUID format for serviceId, so the description's 'attached service' wording supplies minimal semantic meaning: the ID must refer to an attached service. It does not explain how to resolve the ID or what happens for invalid service IDs, but for a single self-named parameter this is marginally adequate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Open') and a specific resource ('the stable loopback Harness page') scoped to an attached service, making the tool's core function clear. It does not explicitly contrast with sibling open_run, but the service-vs-run target makes the distinction reasonably clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool over alternatives such as open_run, start_service, or list_services. The phrase 'attached service' implies a precondition but does not state it as a requirement or explain how to confirm attachment.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_notificationsReplay retained DSH Relay notificationsARead-onlyIdempotent
Read the bounded in-process notification projection after a cursor; cursor gaps return explicit resynchronization metadata.
| Name | Required | Description | Default |
|---|---|---|---|
| cursor | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| nextCursor | Yes | |
| notifications | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly and idempotent annotations, the description discloses meaningful behavior: the projection is bounded and in-process, and cursor gaps produce explicit resynchronization metadata. This adds substantive context without contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence front-loads the action and resource, then adds the key behavioral nuance. Every clause contributes semantic value with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema covers return shape, annotations cover safety, and the description explains the main cursor behavior. The only notable gap is the behavior when cursor is omitted, which is not addressed in the description or schema descriptions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry cursor meaning. It does so by explaining that reads happen 'after a cursor' and that gaps trigger resynchronization metadata. It does not explain initial-cursor omission behavior, but the single optional parameter is otherwise well contextualized.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and a specific resource ('bounded in-process notification projection'), and clearly scopes the operation with cursor semantics. This distinguishes it from the unrelated sibling tools and from any generic 'list notifications' operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the usage context clear: read notifications after a cursor, with specific resynchronization behavior on cursor gaps. It does not explicitly enumerate when-not-to-use or alternatives, but no close sibling alternative exists among the provided tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reconcile_operationReconcile a relay operationARead-onlyIdempotent
Compare an uncertain operation with durable Harness events without submitting a duplicate request.
| Name | Required | Description | Default |
|---|---|---|---|
| operationId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, and the description reinforces this by promising no duplicate request. It adds useful context by specifying reconciliation against 'durable Harness events', which tells the agent this is an event-based check rather than a live query.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single 14-word sentence that front-loads the verb and object, then packs the crucial side-effect guarantee at the end. There is no fluff, no repetition of the title, and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, annotation-rich tool, the description covers the core purpose, the source of truth, and the safety guarantee. It does not describe the return value or how to interpret the comparison result, and no output schema exists to fill that gap, so a small completeness gap remains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter operationId is not described in the schema (0% coverage), and the description only refers to 'an uncertain operation' without explicitly mapping it to the required parameter. It adds the qualitative notion of uncertainty, but leaves the parameter semantics largely implicit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description opens with a specific verb 'Compare' and identifies the resource ('uncertain operation') and the reference data ('durable Harness events'). The phrase 'without submitting a duplicate request' distinguishes it from retry or creation tools, and it is clearly differentiated from siblings like get_operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'uncertain operation' signals the intended use case: when an operation's outcome is ambiguous and the agent needs to verify against durable events. It does not explicitly name alternatives such as get_operation or status_run, nor does it state when not to use it, so some inference remains.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reconcile_permissionsRestore a Harness session permission leaseBIdempotent
Retry restoration of the previous native permission preset for a session that requires attention.
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide idempotentHint=true, destructiveHint=false, and readOnlyHint=false, so the safety profile is covered. The description adds the useful fact that it restores the previous native preset rather than setting arbitrary permissions, but it does not disclose side effects such as overwriting current custom permissions or any prerequisites.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with the key action and object front-loaded, and it avoids repeating the title verbatim. 'That requires attention' is somewhat vague but does not add significant bloat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, idempotent restoration tool, the description plus annotations give a minimally workable picture. However, with no output schema, it does not say what a successful restoration returns, what signals that attention is required, or what state the session should be in before calling this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never explains sessionId, where to get it, or how it relates to the restore operation. The tool mentions 'session' generally, which weakly implies the parameter identifies the affected session, but the description does not compensate for the schema's lack of parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retry restoration') and a specific resource ('previous native permission preset for a session'), making the tool's action clear. It does not explicitly differentiate from siblings like reconcile_operation or setup_doctor, but the permission-restoration purpose is identifiable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for a session that requires attention' implies this is a corrective or retry operation, but it never explicitly states when to use it versus alternatives such as reconcile_operation or setup_doctor. There is no when-not-to-use guidance or mention of alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reply_runContinue a Harness sessionADestructive
Submit a new queued turn to the completed run session, optionally selecting a different model, and track it as a new run. Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address.
| Name | Required | Description | Default |
|---|---|---|---|
| task | No | Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address. | |
| model | No | ||
| runId | Yes | ||
| content | No | Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address. | |
| provider | No | ||
| writeScope | No | Paths Harness may modify. Must be empty for read-only runs; this is an instruction declaration in addition to native permissions. | |
| openBrowser | No | Keep false unless the user explicitly asks to open the Harness page in the OS browser. | |
| excludedPaths | No | Paths excluded from contextual reading. This is an instruction declaration, not filesystem enforcement. | |
| reviewTargets | No | Subjects to assess. This is not a read whitelist; supply together with contextReadScope. | |
| idempotencyKey | No | ||
| reasoningEffort | No | ||
| contextReadScope | No | Workspace paths Harness may search and read for evidence. Use only the targets when the user explicitly requests a target-only review. | |
| permissionPreset | No | ||
| authorizationBasis | No | Truthful evidence that the user explicitly selected Harness to inspect this workspace. Set only when the current conversation contains that instruction. This records evidence and does not expand permissions or guarantee approval. | |
| confirmedDangerousPermission | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate a non-read-only, destructive, open-world operation, but the description adds valuable behavioral context: it discloses that the selected model may send content to its provider, clarifies that path fields are 'instructions, not enforced per-path filesystem isolation,' and notes that the run is tracked as a new run. This goes beyond the annotations and helps set expectations for side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is relatively long but each sentence carries important information: the primary action in the first sentence, then critical usage constraints and a privacy note. It is front-loaded and structured logically, though it could be tightened by merging related points. The verbosity is justified by the complexity of the tool's requirements.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 15 parameters and no output schema, the description covers the core purpose and a few critical constraints, but it omits guidance on many parameters (e.g., model, provider, permissionPreset, confirmedDangerousPermission). While the schema provides some descriptions, the tool is complex enough that an agent would need more explicit guidance on how to set these fields and interpret the result. The description is not fully complete for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 53%, so the description must add meaning. It does explain key fields like reviewTargets ('not a read whitelist') and contextReadScope, adding semantic clarity. However, many parameters (model, provider, permissionPreset, idempotencyKey, reasoningEffort, etc.) are not mentioned in the description, leaving gaps that the schema only partially fills. The description helps but does not fully compensate for the lower schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a precise action: 'Submit a new queued turn to the completed run session, optionally selecting a different model, and track it as a new run.' This combines a specific verb, resource, and outcome, clearly distinguishing it from siblings like start_run or steer_run by emphasizing continuation of a completed session and creation of a new run record.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates the tool is for continuing a completed run session, which implies when to use it, but it does not explicitly mention alternatives or conditions when this tool should not be used. It provides extensive instructions on how to structure task parameters, which is useful, but lacks explicit 'use X instead' guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
setup_doctorDiagnose a Harness Relay MCP client setup planARead-onlyIdempotent
Return a machine-readable setup report from explicitly supplied probes without reading or modifying client configuration.
| Name | Required | Description | Default |
|---|---|---|---|
| facts | No | ||
| scope | Yes | ||
| client | Yes | ||
| platform | Yes | ||
| relayEntry | Yes | ||
| environment | No | ||
| homeDirectory | Yes | ||
| nodeExecutable | Yes | ||
| endpointDescriptor | Yes | ||
| workspaceDirectory | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| plan | Yes | |
| scope | Yes | |
| checks | Yes | |
| client | Yes | |
| status | Yes | |
| planReady | Yes | |
| schemaVersion | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds a useful behavioral guarantee: it does not read or modify client configuration. It also clarifies the operational mode, 'from explicitly supplied probes', and the output style, 'machine-readable setup report', providing context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tightly written sentence that fronts the core purpose and the highest-value constraint upfront. Every word earns its place; there is no fluff or repetition of schema information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with ten parameters, seven required, and a nested facts object, yet the description gives no guidance on how to assemble or interpret those parameters. Even though output schema and annotations exist, an agent would likely struggle to call this tool correctly without understanding what 'probes' are and how the required strings relate to the diagnostic process.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden of explaining parameters, but it only alludes to 'explicitly supplied probes' without detailing any of the ten parameters. It does not explain what 'facts' means, how the booleans should be set, or what values like relayEntry or endpointDescriptor represent, leaving the agent to infer entirely from names and enums.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a precise verb ('Return'), a concrete resource ('a machine-readable setup report'), and a distinctive scope condition ('from explicitly supplied probes without reading or modifying client configuration'). This clearly differentiates it from sibling diagnostic or planning tools like doctor or setup_plan by emphasizing that no client configuration is read or changed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: when a non-invasive, probe-based setup report is needed and no configuration access is desired. However, it does not explicitly name an alternative, state when NOT to use this tool, or explain how it contrasts with sibling tools such as setup_plan or doctor.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
setup_planPlan Harness Relay MCP client setupBRead-onlyIdempotent
Generate a validated, no-write MCP configuration patch for Codex, Claude Code, Cursor, or OpenCode V2.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | Yes | ||
| client | Yes | ||
| platform | Yes | ||
| relayEntry | Yes | ||
| environment | No | ||
| homeDirectory | Yes | ||
| nodeExecutable | Yes | ||
| endpointDescriptor | Yes | ||
| workspaceDirectory | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| patch | No | |
| ready | Yes | |
| issues | Yes | |
| actions | Yes | |
| launcher | No | |
| detection | Yes | |
| writeAuthorized | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds 'no-write' and 'validated,' which are consistent with the annotations but do not provide rich behavioral detail such as how validation works or what the patch contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tightly written sentence with no filler. It front-loads the core action and deliverable while naming the supported targets, making it easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 9 parameters, 7 required, 0% schema documentation, and many sibling tools, the description is too minimal. It explains what the tool produces but not where it fits in a setup workflow, what inputs are needed, or how to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% while there are 9 parameters, including 7 required ones. The description does not explain any parameter meaning, relationships, or expected values, so an agent cannot infer how to fill in fields like endpointDescriptor, relayEntry, or scope.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Generate'), a specific deliverable ('validated, no-write MCP configuration patch'), and the target clients (Codex, Claude Code, Cursor, OpenCode V2). This clearly distinguishes setup_plan from the sibling setup_doctor and other operational tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for planning a client setup without applying changes, but it gives no explicit when-to-use guidance, prerequisites, or alternatives. With sibling tools like setup_doctor and doctor present, an agent is not told how to choose between them.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_reviewDispatch a read-only Harness reviewA
Create or reuse a native Harness session with the permission preset fixed to read-only, then return a stable session link. Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address. After start succeeds, share webUrl and keep wait_run until succeeded/failed/cancelled/needs_attention. The calling agent MUST read assistantText before claiming the review is done. If the parent user asked to review then fix, apply accepted findings only after the run is terminal; do not treat a still-running review as finished.
| Name | Required | Description | Default |
|---|---|---|---|
| task | No | Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address. | |
| model | No | ||
| content | No | Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address. | |
| provider | No | ||
| sessionId | No | ||
| workspace | Yes | Authorized absolute Harness workspace root; Harness reads named in-scope files from here. | |
| writeScope | No | Paths Harness may modify. Must be empty for read-only runs; this is an instruction declaration in addition to native permissions. | |
| agentPreset | No | ||
| openBrowser | No | Keep false unless the user explicitly asks to open the Harness page in the OS browser. | |
| sessionMode | No | ||
| excludedPaths | No | Paths excluded from contextual reading. This is an instruction declaration, not filesystem enforcement. | |
| reviewTargets | No | Subjects to assess. This is not a read whitelist; supply together with contextReadScope. | |
| idempotencyKey | No | ||
| reasoningEffort | No | ||
| contextReadScope | No | Workspace paths Harness may search and read for evidence. Use only the targets when the user explicitly requests a target-only review. | |
| authorizationBasis | No | Truthful evidence that the user explicitly selected Harness to inspect this workspace. Set only when the current conversation contains that instruction. This records evidence and does not expand permissions or guarantee approval. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes beyond annotations by disclosing that the Harness model may send content to its configured provider despite Relay using a loopback address. It also clarifies that the task fields are 'task instructions, not enforced per-path filesystem isolation,' which is a significant behavioral caveat. This is valuable context that annotations (openWorldHint, destructiveHint) do not cover. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is comprehensive but quite long and repetitive. It repeats the same 'path-reference-only' guidance multiple times and includes schema-like details that are already in the input schema. While it's structured with clear points, it could be more concise by not duplicating parameter descriptions that are already present in the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (16 parameters, high-stakes review workflow), the description covers all critical aspects: what to provide, how to handle results, and caveats about read-only and data transmission. It explains the full lifecycle from starting the review to waiting for completion and handling fixes. No output schema exists, so the description's emphasis on sharing webUrl and reading assistantText fills that gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description and schema already provide extensive parameter documentation for reviewTargets, contextReadScope, excludedPaths, and writeScope. The description reinforces that reviewTargets is not a read whitelist and that contextReadScope declares where Harness can search. Many parameters (model, provider, sessionMode, reasoningEffort, agentPreset) have no description in the schema, but the description covers the critical ones for correct usage, so it compensates for the 56% coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates or reuses a native Harness session with read-only permissions and returns a session link. It distinguishes itself from siblings like start_run (generic runs) and start_service (start a service) by focusing on reviews. However, it could more explicitly contrast with start_run to clarify when a review session differs from a generic run.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool (for read-only reviews), how to structure the task parameters (path-reference-only), and what not to do (never embed source text). It also states that after starting, the agent must share webUrl and keep wait_run until terminal, and must read assistantText before claiming completion. It even addresses the 'review then fix' scenario, instructing to apply findings only after the run is terminal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_runDispatch a Harness runADestructive
Create or reuse a native Harness session, select provider/model/reasoning, agent preset, and native permission preset, then submit the first task and return a stable session link. Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address. Sharing webUrl is not completion: keep wait_run until a terminal status, then consume assistantText.
| Name | Required | Description | Default |
|---|---|---|---|
| task | No | Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address. | |
| model | No | ||
| content | No | Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address. | |
| provider | No | ||
| sessionId | No | ||
| workspace | Yes | Authorized absolute Harness workspace root; Harness reads named in-scope files from here. | |
| writeScope | No | Paths Harness may modify. Must be empty for read-only runs; this is an instruction declaration in addition to native permissions. | |
| agentPreset | No | ||
| openBrowser | No | Keep false unless the user explicitly asks to open the Harness page in the OS browser. | |
| sessionMode | No | ||
| excludedPaths | No | Paths excluded from contextual reading. This is an instruction declaration, not filesystem enforcement. | |
| reviewTargets | No | Subjects to assess. This is not a read whitelist; supply together with contextReadScope. | |
| idempotencyKey | No | ||
| reasoningEffort | No | ||
| contextReadScope | No | Workspace paths Harness may search and read for evidence. Use only the targets when the user explicitly requests a target-only review. | |
| permissionPreset | No | ||
| authorizationBasis | No | Truthful evidence that the user explicitly selected Harness to inspect this workspace. Set only when the current conversation contains that instruction. This records evidence and does not expand permissions or guarantee approval. | |
| confirmedDangerousPermission | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description discloses consequential behaviors: task fields are instructions not filesystem enforcement, the selected model may send read content to its provider despite Relay's loopback, and webUrl sharing does not mean completion. It also clarifies that sessions can be created or reused, matching the destructiveHint while adding privacy-relevant detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The primary action is front-loaded and each sentence carries a distinct safety or lifecycle instruction; no filler. It is long, but the density is justified by the tool's destructive/open-world nature and the need to prevent source embedding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains the output at a high level (stable session link), tells the caller to continue with wait_run, and covers the main behavioral caveats. It does not spell out return shape or the meaning of some parameters, but it is largely sufficient for a complex, 18-parameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema coverage around 50%, the description adds real semantics for the key task parameters: reviewTargets is not a read whitelist, contextReadScope declares where Harness may search, and writeScope/excludedPaths are instruction declarations rather than enforcement. It leaves some parameters (provider, model, reasoningEffort, idempotencyKey, confirmedDangerousPermission) without richer meaning, so it is strong but not exhaustive.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly names the operation: create or reuse a native Harness session, select provider/model/reasoning and presets, submit the first task, and return a stable session link. This identifies the resource and action well, but it never contrasts with the sibling start_review, so an agent must infer the boundary between them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives strong operational guidance (path-reference-only task text, avoid embedding source, keep wait_run until terminal status), which clarifies how to invoke it. However, it does not state when to choose start_run over start_review or other siblings, leaving selection partly implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_serviceAttach to DeepSeek HarnessAIdempotent
Attach an authorized workspace to the existing Harness Host. This never starts or modifies Harness.
| Name | Required | Description | Default |
|---|---|---|---|
| workspace | Yes | ||
| openBrowser | No | Keep false unless the user explicitly asks to open the Harness page in the OS browser. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true and destructiveHint=false, covering non-destructive behavior. The description adds the 'never starts or modifies Harness' clarification, which reinforces but does not significantly extend those hints. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the primary action and a clear exclusion. Every sentence earns its place with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool with no output schema, the description captures core behavior and notes the prerequisite 'authorized workspace'. However, it does not mention return values, error conditions, or the impact of openBrowser beyond the schema description, leaving some operational gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%: openBrowser has a description, but workspace does not. The tool description does not add any parameter-level detail (e.g., what constitutes a valid workspace identity). It fails to compensate for the missing workspace documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('attach') and resource ('authorized workspace to the existing Harness Host'), and explicitly clarifies it does not start or modify Harness. This distinguishes it from siblings like start_run and start_review without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (to attach an authorized workspace to an existing host) and clarifies what it does not do (never starts or modifies Harness), but does not explicitly name alternative tools or provide conditions for choosing among related siblings. It relies on inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
status_runDeprecated: get Harness run statusARead-onlyIdempotent
Deprecated compatibility alias; use get_run. Scheduled for removal in 0.3.0.
| Name | Required | Description | Default |
|---|---|---|---|
| runId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint true, and the description adds meaningful behavioral context by disclosing deprecation and the removal schedule. As a compatibility alias, failing to describe output details is acceptable since expected behavior is get_run's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short clauses with no wasted words; the deprecation and replacement are front-loaded. It earns every word it uses.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple deprecated one-parameter read-only alias, the description provides essential routing and lifecycle information, and the schema fully constrains runId. It is adequate for an agent to invoke correctly, though output shape is left to get_run.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description provides no parameter information, and schema description coverage is 0%. The single runId parameter is well-constrained by the schema's UUID format and pattern, reducing risk, but the description fails to compensate for the lack of schema descriptions as required at low coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The title clearly identifies the tool as 'get Harness run status' and the description explains it is a deprecated compatibility alias, so the action and resource are clear. It does not restate the behavior fully, but it differentiates itself from get_run by pointing to it as the replacement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly instructs 'use get_run' and warns 'Scheduled for removal in 0.3.0', giving the agent a clear directive to choose the alternative over this deprecated tool. This is a precise when-not-to-use instruction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
steer_runSteer a Harness runADestructive
Durably insert a correction into an active run. Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address.
| Name | Required | Description | Default |
|---|---|---|---|
| task | No | Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address. | |
| runId | Yes | ||
| content | No | Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address. | |
| idempotencyKey | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial behavioral detail beyond the annotations: task parameters are path-reference-only, no source text may be embedded, Harness reads named files itself, fields are not enforced filesystem isolation, and the model may send read content to its configured provider despite Relay's loopback address. These are meaningful privacy and execution-model disclosures that a caller needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the essential purpose and then provides dense, valuable warnings. Each sentence adds a distinct constraint or behavioral fact; the only redundancy is that the same text appears verbatim in the schema's parameter descriptions, but the tool description itself is not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent mutation on an active run, the description covers the critical safety and privacy aspects, including what must not be included in the payload and how Harness accesses files. It does not explain the return value or success/error behavior, but with no output schema and a clear purpose this is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50%: runId and idempotencyKey have no schema descriptions, and the tool description does not compensate for those. However, the description does clarify the task/content parameter semantics thoroughly, explaining path-reference usage, reviewTargets, contextReadScope, and the prohibition on embedding source material, so it partially makes up for the gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening clause, 'Durably insert a correction into an active run,' uses a specific verb, resource, and state ('active run'), which clearly distinguishes it from siblings like start_run, reply_run, and cancel_run. It also names the core operation type ('correction') rather than merely restating the tool's name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: it is for inserting a correction into an already active run, which implies it should not be used for starting, stopping, or merely observing runs. It does not explicitly name alternatives or exclusion conditions, so it misses the top score, but the context is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stop_serviceDetach from DeepSeek HarnessAIdempotent
Forget one relay attachment without stopping or changing the external Harness Host.
| Name | Required | Description | Default |
|---|---|---|---|
| serviceId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover idempotency, non-readonly, and non-destructive intent. The description adds value beyond this by scoping the mutation precisely: exactly one relay attachment is affected, and the external Harness Host's state is preserved. This boundary disclosure is genuinely useful, though it stops short of describing the observable post-forget state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single 12-word sentence with zero waste: the action verb leads, followed by scope and the key exclusion. Every word earns its place and the critical 'does not stop the host' clarification is included without bloat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is low-complexity (one parameter, no output schema), so the description covers the core semantics adequately. However, domain terms like 'relay attachment' and 'Harness Host' are unexplained, and the lifecycle relationship to siblings (how attachments are created via start_service/open_service) is missing, which could leave an agent unsure of prerequisites.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must compensate for the single serviceId parameter. It partially does by tying the operation to 'one relay attachment,' implying serviceId selects the attachment. However, it never explicitly states that serviceId identifies which relay attachment to forget, leaving some ambiguity given the tool name says 'service' while the description says 'attachment.'
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('forget') and resource ('one relay attachment') and adds a clarifying boundary ('without stopping or changing the external Harness Host'), which usefully corrects the misleading 'stop_service' name. It implicitly distinguishes itself from stop-like operations, though it does not explicitly name a sibling to differentiate from.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: use this when you want to detach/forget a single relay attachment while leaving the host untouched. However, no explicit when-to-use or when-not-to-use guidance is given, and no alternative tools are named (e.g., what to use if you actually need to stop the host or cancel an ongoing run).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wait_runWait for Harness progressARead-onlyIdempotent
Poll durable Host history for at most 30 seconds and return the latest snapshot plus hostPollContract. Call this native MCP tool directly; never poll through a temporary Node, PowerShell, Python, or shell client. A timeout is a slice, not completion. If hostPollContract.hostMustCallWaitRunAgain is true, you MUST call wait_run again immediately. Do not send a final user answer, mark the delegated task complete, or skip consuming assistantText while the run is still running. Unrelated shell or background-task notifications are not authorization to stop polling.
| Name | Required | Description | Default |
|---|---|---|---|
| runId | Yes | ||
| timeoutMs | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/idempotent annotations, the description reveals that a timeout is only a slice not completion, that the caller must re-invoke wait_run when hostMustCallWaitRunAgain is true, and that unrelated notifications do not authorize stopping. This is exactly the kind of behavioral context annotations cannot express.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence carries a distinct requirement or correction, from avoiding temporary poll clients to the prohibition on final answers during a running job. The key purpose is front-loaded, and the length is justified by the number of critical behavioral rules.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the polling protocol, return payload headline, and termination conditions well enough to call the tool correctly. It doesn's specify snapshot fields or hostPollContract structure, but no output schema is declared and the contract field is named, which is sufficient for a wait/loop tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no descriptions for runId or timeoutMs, so the description must compensate. It adds meaning to timeoutMs ('at most 30 seconds', 'timeout is a slice'), but says nothing about runId beyond the schema us type/format, leaving an agent to infer it identifies the run.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Poll') and resource ('durable Host history'), and names the deliverable ('latest snapshot plus hostPollContract'). This clearly differentiates wait_run from siblings like get_run or status_run, which are single-shot reads without a polling contract.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly instructs agents to call this native MCP tool directly rather than writing temporary poll clients, and it gives concrete loop rules: if hostMustCallWaitRunAgain is true, call again immediately, and do not finalize while the run is active. It doesn't name sibling alternatives, but the polling context and stop conditions provide enough usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.2.13- Changed
reply_run9 fields changed- added
Input schema / properties / authorizationBasisAdded value: +{ + "const": "explicit-user-request", + "description": "Truthful evidence that the user explicitly selected Harness to inspect this workspace. Set only when the current conversation contains that instruction. This records evidence and does not expand permissions or guarantee approval.", + "type": "string" +} - changed
Input schema / properties / content / descriptionPrevious value: -"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions."New value: +"Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address." - changed
Input schema / properties / content / items / oneOfPrevious value: -[ - { - "properties": { - "text": { - "description": "Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions.", - "maxLength": 100000, - "type": "string" - }, - "type": { - "const": "text", - "type": "string" - } - }, - "required": [ - "type", - "text" - ], - "type": "object" - }, - { - "properties": { - "data": { - "minLength": 1, - "type": "string" - }, - "mediaType": { - "enum": [ - "image/png", - "image/jpeg", - "image/webp", - "image/gif" - ], - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "const": "image", - "type": "string" - } - }, - "required": [ - "type", - "mediaType", - "data" - ], - "type": "object" - } -]New value: +[ + { + "properties": { + "text": { + "description": "Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address.", + "maxLength": 100000, + "type": "string" + }, + "type": { + "const": "text", + "type": "string" + } + }, + "required": [ + "type", + "text" + ], + "type": "object" + }, + { + "properties": { + "data": { + "minLength": 1, + "type": "string" + }, + "mediaType": { + "enum": [ + "image/png", + "image/jpeg", + "image/webp", + "image/gif" + ], + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "const": "image", + "type": "string" + } + }, + "required": [ + "type", + "mediaType", + "data" + ], + "type": "object" + } +] - added
Input schema / properties / contextReadScopeAdded value: +{ + "description": "Workspace paths Harness may search and read for evidence. Use only the targets when the user explicitly requests a target-only review.", + "items": { + "description": "Workspace-relative path, or an absolute path contained by the authorized workspace.", + "minLength": 1, + "type": "string" + }, + "minItems": 1, + "type": "array" +} - added
Input schema / properties / excludedPathsAdded value: +{ + "description": "Paths excluded from contextual reading. This is an instruction declaration, not filesystem enforcement.", + "items": { + "description": "Workspace-relative path, or an absolute path contained by the authorized workspace.", + "minLength": 1, + "type": "string" + }, + "type": "array" +} - added
Input schema / properties / openBrowser / descriptionAdded value: +"Keep false unless the user explicitly asks to open the Harness page in the OS browser." - added
Input schema / properties / reviewTargetsAdded value: +{ + "description": "Subjects to assess. This is not a read whitelist; supply together with contextReadScope.", + "items": { + "description": "Workspace-relative path, or an absolute path contained by the authorized workspace.", + "minLength": 1, + "type": "string" + }, + "minItems": 1, + "type": "array" +} - changed
Input schema / properties / task / descriptionPrevious value: -"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions."New value: +"Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address." - added
Input schema / properties / writeScopeAdded value: +{ + "description": "Paths Harness may modify. Must be empty for read-only runs; this is an instruction declaration in addition to native permissions.", + "items": { + "description": "Workspace-relative path, or an absolute path contained by the authorized workspace.", + "minLength": 1, + "type": "string" + }, + "type": "array" +}
- Changed
start_review9 fields changed- added
Input schema / properties / authorizationBasisAdded value: +{ + "const": "explicit-user-request", + "description": "Truthful evidence that the user explicitly selected Harness to inspect this workspace. Set only when the current conversation contains that instruction. This records evidence and does not expand permissions or guarantee approval.", + "type": "string" +} - changed
Input schema / properties / content / descriptionPrevious value: -"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions."New value: +"Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address." - changed
Input schema / properties / content / items / oneOfPrevious value: -[ - { - "properties": { - "text": { - "description": "Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions.", - "maxLength": 100000, - "type": "string" - }, - "type": { - "const": "text", - "type": "string" - } - }, - "required": [ - "type", - "text" - ], - "type": "object" - }, - { - "properties": { - "data": { - "minLength": 1, - "type": "string" - }, - "mediaType": { - "enum": [ - "image/png", - "image/jpeg", - "image/webp", - "image/gif" - ], - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "const": "image", - "type": "string" - } - }, - "required": [ - "type", - "mediaType", - "data" - ], - "type": "object" - } -]New value: +[ + { + "properties": { + "text": { + "description": "Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address.", + "maxLength": 100000, + "type": "string" + }, + "type": { + "const": "text", + "type": "string" + } + }, + "required": [ + "type", + "text" + ], + "type": "object" + }, + { + "properties": { + "data": { + "minLength": 1, + "type": "string" + }, + "mediaType": { + "enum": [ + "image/png", + "image/jpeg", + "image/webp", + "image/gif" + ], + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "const": "image", + "type": "string" + } + }, + "required": [ + "type", + "mediaType", + "data" + ], + "type": "object" + } +] - added
Input schema / properties / contextReadScopeAdded value: +{ + "description": "Workspace paths Harness may search and read for evidence. Use only the targets when the user explicitly requests a target-only review.", + "items": { + "description": "Workspace-relative path, or an absolute path contained by the authorized workspace.", + "minLength": 1, + "type": "string" + }, + "minItems": 1, + "type": "array" +} - added
Input schema / properties / excludedPathsAdded value: +{ + "description": "Paths excluded from contextual reading. This is an instruction declaration, not filesystem enforcement.", + "items": { + "description": "Workspace-relative path, or an absolute path contained by the authorized workspace.", + "minLength": 1, + "type": "string" + }, + "type": "array" +} - added
Input schema / properties / openBrowser / descriptionAdded value: +"Keep false unless the user explicitly asks to open the Harness page in the OS browser." - added
Input schema / properties / reviewTargetsAdded value: +{ + "description": "Subjects to assess. This is not a read whitelist; supply together with contextReadScope.", + "items": { + "description": "Workspace-relative path, or an absolute path contained by the authorized workspace.", + "minLength": 1, + "type": "string" + }, + "minItems": 1, + "type": "array" +} - changed
Input schema / properties / task / descriptionPrevious value: -"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions."New value: +"Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address." - added
Input schema / properties / writeScopeAdded value: +{ + "description": "Paths Harness may modify. Must be empty for read-only runs; this is an instruction declaration in addition to native permissions.", + "items": { + "description": "Workspace-relative path, or an absolute path contained by the authorized workspace.", + "minLength": 1, + "type": "string" + }, + "type": "array" +}
- Changed
start_run9 fields changed- added
Input schema / properties / authorizationBasisAdded value: +{ + "const": "explicit-user-request", + "description": "Truthful evidence that the user explicitly selected Harness to inspect this workspace. Set only when the current conversation contains that instruction. This records evidence and does not expand permissions or guarantee approval.", + "type": "string" +} - changed
Input schema / properties / content / descriptionPrevious value: -"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions."New value: +"Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address." - changed
Input schema / properties / content / items / oneOfPrevious value: -[ - { - "properties": { - "text": { - "description": "Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions.", - "maxLength": 100000, - "type": "string" - }, - "type": { - "const": "text", - "type": "string" - } - }, - "required": [ - "type", - "text" - ], - "type": "object" - }, - { - "properties": { - "data": { - "minLength": 1, - "type": "string" - }, - "mediaType": { - "enum": [ - "image/png", - "image/jpeg", - "image/webp", - "image/gif" - ], - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "const": "image", - "type": "string" - } - }, - "required": [ - "type", - "mediaType", - "data" - ], - "type": "object" - } -]New value: +[ + { + "properties": { + "text": { + "description": "Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address.", + "maxLength": 100000, + "type": "string" + }, + "type": { + "const": "text", + "type": "string" + } + }, + "required": [ + "type", + "text" + ], + "type": "object" + }, + { + "properties": { + "data": { + "minLength": 1, + "type": "string" + }, + "mediaType": { + "enum": [ + "image/png", + "image/jpeg", + "image/webp", + "image/gif" + ], + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "const": "image", + "type": "string" + } + }, + "required": [ + "type", + "mediaType", + "data" + ], + "type": "object" + } +] - added
Input schema / properties / contextReadScopeAdded value: +{ + "description": "Workspace paths Harness may search and read for evidence. Use only the targets when the user explicitly requests a target-only review.", + "items": { + "description": "Workspace-relative path, or an absolute path contained by the authorized workspace.", + "minLength": 1, + "type": "string" + }, + "minItems": 1, + "type": "array" +} - added
Input schema / properties / excludedPathsAdded value: +{ + "description": "Paths excluded from contextual reading. This is an instruction declaration, not filesystem enforcement.", + "items": { + "description": "Workspace-relative path, or an absolute path contained by the authorized workspace.", + "minLength": 1, + "type": "string" + }, + "type": "array" +} - added
Input schema / properties / openBrowser / descriptionAdded value: +"Keep false unless the user explicitly asks to open the Harness page in the OS browser." - added
Input schema / properties / reviewTargetsAdded value: +{ + "description": "Subjects to assess. This is not a read whitelist; supply together with contextReadScope.", + "items": { + "description": "Workspace-relative path, or an absolute path contained by the authorized workspace.", + "minLength": 1, + "type": "string" + }, + "minItems": 1, + "type": "array" +} - changed
Input schema / properties / task / descriptionPrevious value: -"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions."New value: +"Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address." - added
Input schema / properties / writeScopeAdded value: +{ + "description": "Paths Harness may modify. Must be empty for read-only runs; this is an instruction declaration in addition to native permissions.", + "items": { + "description": "Workspace-relative path, or an absolute path contained by the authorized workspace.", + "minLength": 1, + "type": "string" + }, + "type": "array" +}
- Changed
start_service1 field changed- added
Input schema / properties / openBrowser / descriptionAdded value: +"Keep false unless the user explicitly asks to open the Harness page in the OS browser."
- Changed
steer_run3 fields changed- changed
Input schema / properties / content / descriptionPrevious value: -"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions."New value: +"Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address." - changed
Input schema / properties / content / items / oneOfPrevious value: -[ - { - "properties": { - "text": { - "description": "Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions.", - "maxLength": 100000, - "type": "string" - }, - "type": { - "const": "text", - "type": "string" - } - }, - "required": [ - "type", - "text" - ], - "type": "object" - }, - { - "properties": { - "data": { - "minLength": 1, - "type": "string" - }, - "mediaType": { - "enum": [ - "image/png", - "image/jpeg", - "image/webp", - "image/gif" - ], - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "const": "image", - "type": "string" - } - }, - "required": [ - "type", - "mediaType", - "data" - ], - "type": "object" - } -]New value: +[ + { + "properties": { + "text": { + "description": "Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address.", + "maxLength": 100000, + "type": "string" + }, + "type": { + "const": "text", + "type": "string" + } + }, + "required": [ + "type", + "text" + ], + "type": "object" + }, + { + "properties": { + "data": { + "minLength": 1, + "type": "string" + }, + "mediaType": { + "enum": [ + "image/png", + "image/jpeg", + "image/webp", + "image/gif" + ], + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "const": "image", + "type": "string" + } + }, + "required": [ + "type", + "mediaType", + "data" + ], + "type": "object" + } +] - changed
Input schema / properties / task / descriptionPrevious value: -"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions."New value: +"Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address."
4 tool updates
v0.2.9- Changed
reply_run3 fields changed- added
Input schema / properties / content / descriptionAdded value: +"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions." - changed
Input schema / properties / content / items / oneOfPrevious value: -[ - { - "properties": { - "text": { - "maxLength": 100000, - "type": "string" - }, - "type": { - "const": "text", - "type": "string" - } - }, - "required": [ - "type", - "text" - ], - "type": "object" - }, - { - "properties": { - "data": { - "minLength": 1, - "type": "string" - }, - "mediaType": { - "enum": [ - "image/png", - "image/jpeg", - "image/webp", - "image/gif" - ], - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "const": "image", - "type": "string" - } - }, - "required": [ - "type", - "mediaType", - "data" - ], - "type": "object" - } -]New value: +[ + { + "properties": { + "text": { + "description": "Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions.", + "maxLength": 100000, + "type": "string" + }, + "type": { + "const": "text", + "type": "string" + } + }, + "required": [ + "type", + "text" + ], + "type": "object" + }, + { + "properties": { + "data": { + "minLength": 1, + "type": "string" + }, + "mediaType": { + "enum": [ + "image/png", + "image/jpeg", + "image/webp", + "image/gif" + ], + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "const": "image", + "type": "string" + } + }, + "required": [ + "type", + "mediaType", + "data" + ], + "type": "object" + } +] - added
Input schema / properties / task / descriptionAdded value: +"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions."
- Changed
start_review4 fields changed- added
Input schema / properties / content / descriptionAdded value: +"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions." - changed
Input schema / properties / content / items / oneOfPrevious value: -[ - { - "properties": { - "text": { - "maxLength": 100000, - "type": "string" - }, - "type": { - "const": "text", - "type": "string" - } - }, - "required": [ - "type", - "text" - ], - "type": "object" - }, - { - "properties": { - "data": { - "minLength": 1, - "type": "string" - }, - "mediaType": { - "enum": [ - "image/png", - "image/jpeg", - "image/webp", - "image/gif" - ], - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "const": "image", - "type": "string" - } - }, - "required": [ - "type", - "mediaType", - "data" - ], - "type": "object" - } -]New value: +[ + { + "properties": { + "text": { + "description": "Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions.", + "maxLength": 100000, + "type": "string" + }, + "type": { + "const": "text", + "type": "string" + } + }, + "required": [ + "type", + "text" + ], + "type": "object" + }, + { + "properties": { + "data": { + "minLength": 1, + "type": "string" + }, + "mediaType": { + "enum": [ + "image/png", + "image/jpeg", + "image/webp", + "image/gif" + ], + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "const": "image", + "type": "string" + } + }, + "required": [ + "type", + "mediaType", + "data" + ], + "type": "object" + } +] - added
Input schema / properties / task / descriptionAdded value: +"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions." - added
Input schema / properties / workspace / descriptionAdded value: +"Authorized absolute Harness workspace root; Harness reads named in-scope files from here."
- Changed
start_run4 fields changed- added
Input schema / properties / content / descriptionAdded value: +"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions." - changed
Input schema / properties / content / items / oneOfPrevious value: -[ - { - "properties": { - "text": { - "maxLength": 100000, - "type": "string" - }, - "type": { - "const": "text", - "type": "string" - } - }, - "required": [ - "type", - "text" - ], - "type": "object" - }, - { - "properties": { - "data": { - "minLength": 1, - "type": "string" - }, - "mediaType": { - "enum": [ - "image/png", - "image/jpeg", - "image/webp", - "image/gif" - ], - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "const": "image", - "type": "string" - } - }, - "required": [ - "type", - "mediaType", - "data" - ], - "type": "object" - } -]New value: +[ + { + "properties": { + "text": { + "description": "Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions.", + "maxLength": 100000, + "type": "string" + }, + "type": { + "const": "text", + "type": "string" + } + }, + "required": [ + "type", + "text" + ], + "type": "object" + }, + { + "properties": { + "data": { + "minLength": 1, + "type": "string" + }, + "mediaType": { + "enum": [ + "image/png", + "image/jpeg", + "image/webp", + "image/gif" + ], + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "const": "image", + "type": "string" + } + }, + "required": [ + "type", + "mediaType", + "data" + ], + "type": "object" + } +] - added
Input schema / properties / task / descriptionAdded value: +"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions." - added
Input schema / properties / workspace / descriptionAdded value: +"Authorized absolute Harness workspace root; Harness reads named in-scope files from here."
- Changed
steer_run3 fields changed- added
Input schema / properties / content / descriptionAdded value: +"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions." - changed
Input schema / properties / content / items / oneOfPrevious value: -[ - { - "properties": { - "text": { - "maxLength": 100000, - "type": "string" - }, - "type": { - "const": "text", - "type": "string" - } - }, - "required": [ - "type", - "text" - ], - "type": "object" - }, - { - "properties": { - "data": { - "minLength": 1, - "type": "string" - }, - "mediaType": { - "enum": [ - "image/png", - "image/jpeg", - "image/webp", - "image/gif" - ], - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "const": "image", - "type": "string" - } - }, - "required": [ - "type", - "mediaType", - "data" - ], - "type": "object" - } -]New value: +[ + { + "properties": { + "text": { + "description": "Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions.", + "maxLength": 100000, + "type": "string" + }, + "type": { + "const": "text", + "type": "string" + } + }, + "required": [ + "type", + "text" + ], + "type": "object" + }, + { + "properties": { + "data": { + "minLength": 1, + "type": "string" + }, + "mediaType": { + "enum": [ + "image/png", + "image/jpeg", + "image/webp", + "image/gif" + ], + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "const": "image", + "type": "string" + } + }, + "required": [ + "type", + "mediaType", + "data" + ], + "type": "object" + } +] - added
Input schema / properties / task / descriptionAdded value: +"Task parameters are path-reference-only: provide the authorized workspace, file or directory locations, scope, and acceptance criteria. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. This rule is identical for read-only and write-capable permissions."
25 tool updates
v0.2.6- First observed
cancel_run - First observed
doctor - First observed
get_operation - First observed
get_run - First observed
get_run_summary - First observed
list_capabilities - First observed
list_runs - First observed
list_services - First observed
list_workspace_sessions - First observed
list_workspaces - First observed
open_run - First observed
open_service - First observed
read_notifications - First observed
reconcile_operation - First observed
reconcile_permissions - First observed
reply_run - First observed
setup_doctor - First observed
setup_plan - First observed
start_review - First observed
start_run - First observed
start_service - First observed
status_run - First observed
steer_run - First observed
stop_service - First observed
wait_run
TDQS
Scored across 25 tools
Several tools overlap in function or intent: get_run, get_run_summary, wait_run, status_run (deprecated), and list_runs all touch run state; doctor and setup_doctor also overlap. The detailed descriptions help, but agents must read carefully to pick correctly.
Most tools follow a clear verb_noun snake_case pattern (start_, stop_, list_, get_, setup_). Minor inconsistencies: bare 'doctor' vs 'setup_doctor', 'status_run' for a deprecated alias, and 'reconcile_operation' vs 'get_operation'.
25 tools is large for a relay/session manager. The lifecycle coverage is broadaa but there is redundancy (get_run/get_run_summary/status_run/wait_run all surface run state) and a deprecated tool included in the active set, so it feels heavier than necessary.
The set covers the full run lifecycle (start, reply, steer, cancel, wait, get, list), workspace/service management, diagnostics, setup, and notifications. No obvious missing operations for the described domain.
Maintenance
Related MCP Connectors
Enable secure connectivity between Sentry issues and debugging data, and LLM clients, using a Model Context Protocol (MCP) server.
MCP server (stdio): lint OpenAPI specs with Spectral via the AgentForge API
Check if your MCP server is ready to publish on the MCP Registry, Smithery, or npm.
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceProvides a read-only MCP tool to diagnose zoxide installation and shell setup, returning a JSON report with setup and troubleshooting guides.28 npmMIT
- AlicenseNot gradedqualityCmaintenanceLaunches the official Codex CLI as a persistent MCP server so DeepSeek Harness can invoke Codex models without storing or transmitting ChatGPT credentials to third parties.MIT
- AlicenseNot gradedqualityBmaintenanceEnables Claude Code to delegate bounded, read-only analysis and isolated patch proposals to the locally installed Codex CLI over MCP, with sanitized live status, revision-aware polling, and reviewable results.1MIT
- AlicenseNot gradedqualityAmaintenanceEnables ChatGPT Web or another MCP client to inspect and develop a local workspace, read local Codex task history, and use the complete installed XcodeBuildMCP catalog through a small set of stable tools.MIT