Harness, framework, and MCP get used interchangeably in agent architecture discussions. They are not the same thing. They sit at different layers, own different responsibilities, and increasingly overlap at the edges. This article separates the 3 with 1 question. Which layer owns the execution loop, state, tool transport, permissions, and recovery?

The 3 categories

• Agent harness: The harness is the execution system that wraps a model and turns it into a working agent. OpenAI’s Codex as a platform post (August 19, 2026) defines it directly. The harness manages conversation state, streams execution, and uses tools. It also enforces sandbox and approval policies and carries work across turns. Anthropic’s Claude Code docs call the same thing an agentic harness. The Claude Agent SDK exposes ‘the same tools, agent loop, and context management that power Claude Code.’ A harness is opinionated. It ships a loop, a permission model, a sandbox, and a context strategy as one unit.
• Agent framework: A framework is a library of primitives for composing agents. It covers model clients, tool abstractions, graph orchestration, memory interfaces, and observability hooks. Examples include LangGraph, the OpenAI Agents SDK, and Microsoft Agent Framework, which reached 1.0 GA in April 2026. A framework gives you the parts and the loop skeleton. You decide the policy.
• MCP: The Model Context Protocol is a wire protocol, not a runtime. It standardizes how an LLM application (the host) discovers and calls capabilities exposed by servers: tools, resources, and prompts. MCP uses JSON-RPC 2.0 messages between hosts, clients, and servers. Since December 2025 the Linux Foundation’s Agentic AI Foundation has governed it, alongside goose, AGENTS.md, and now A2A. MCP owns no loop and no agent state. It owns the contract between the agent and its tools.

Ownership matrix

The table maps each responsibility to the layer that owns it by default. “Owns” means the layer defines and enforces the behavior. “Exposes” means the layer surfaces a hook but does not decide policy.

Responsibility	Agent harness	Agent framework	MCP
Execution loop	Owns: Fixed, product-grade loop with turn limits and compaction.	Owns skeleton: You configure termination, handoffs, and turn caps.	None: Request/response only.
Agent state and memory	Owns: Sessions, resume, fork, file checkpointing.	Exposes: Checkpointers, session stores, thread IDs.	None at protocol level since 2026-07-28.
Tool transport	Consumes: Built-in tools plus MCP client.	Consumes: Function tools plus MCP client.	Own: JSON-RPC over stdio or Streamable HTTP.
Permissions and approvals	Owns: Permission modes, hooks, sandbox.	Exposes: Guardrails, interrupts, middleware.	Delegates to host: Cannot enforce.
Recovery	Owns: Session resume, checkpoint rewind, compaction.	Exposes: Durable execution, replay, retries.	Partial: Tasks extension for long-running calls.
Isolation and sandboxing	Owns: OS sandbox, worktrees, containers.	Optional: Hosted sandboxes or micro-VMs.	None.
Multi-agent orchestration	Owns patterns: Subagents, dynamic workflows.	Owns primitives: Graphs, handoffs, fan-out.	None: A2A covers agent-to-agent.

The rest of this article justifies each row with sources.

Who owns the execution loop

Every agent runs a loop. Send context to the model, read the response, execute tool calls, feed results back, repeat. The harness and the framework both implement this loop. They differ in how much you control it.

• Harness loop: The Claude Agent SDK documents its loop as 5 steps. Receive prompt, evaluate and respond, execute tools, repeat, return result. Each full cycle is 1 turn, and the loop ends when Claude produces a response with no tool calls. Hooks can intercept, modify, or block tool calls before they run. The loop itself is not yours to rewrite. OpenAI’s Codex harness exposes the loop through app-server, a documented client protocol. Applications create threads, start turns, receive events, and handle approval requests.
• Framework loop: The OpenAI Agents SDK loop terminates on final output. It re-runs on handoff, or executes tool calls and continues. Exceeding max_turns raises MaxTurnsExceeded, and a guardrail tripwire raises GuardrailTripwireTriggered. In LangGraph, the loop is whatever graph you draw. Nodes, edges, and conditional routing define control flow.
• MCP: MCP has no loop. Since the 2026-07-28 specification, it does not even have a handshake. The initialize/initialized exchange and Mcp-Session-Id header were retired. Every request travels alone, carrying its protocol version and client capabilities in _meta. The host’s loop decides when to call tools/call. MCP only defines what that call looks like on the wire.

Who owns state

• Harness: State lives in the harness and persists across sessions. The Claude Agent SDK supports sessions that resume or fork later. File checkpointing restores files to any previous state. Microsoft’s harness layer ships a FileMemoryProvider for session-scoped notes and automatic context compaction that monitors token usage mid-loop. Anthropic’s long-running harness work goes further. It hands off state between context windows through artifacts on disk. Each new session begins with no memory of the last.
• Framework: Frameworks expose state primi