Isolated, composable harness stacks.

One executable launches an isolated pod with your AI harness, an MCP hub, and optional shared services.

One engine, one clean-room mode.

Every stack shares the same base image, host mounts, and auth. The config layer is always assembled and isolated — never a live host bind-mount.

Isolated

clean room

Auth seeded, profile mounted, nothing from host config. Clean room with exactly what I picked.

harnessed <stack>

Two harnesses today, one canonical profile.

Claude Code format is the single source of truth. Other harnesses adapt out of it, with no re-authoring.

claude

Native. Mounts the profile directly.

omp

Via claude-hooks-bridge.

opencode

Reads .claude/skills/** natively; MCP via hatago.

antigravity

Planned — MCP via hatago.

codex

Planned — MCP via hatago.

Compose, build, run.

Step 1
Compose

Pick a harness, add recipes (MCP servers and skills). Author one stack.yaml.
Step 2
Build

harnessed build assembles a committed profile, scans the supply chain, and builds pinned images.
Step 3
Run

Launch an isolated pod: harness plus hatago plus shared services. Exactly what the stack declares, nothing more.

Security is the default, not an add-on.

Every stack runs pnpm, a build-time scan gate, an egress firewall, and secrets that never touch an image layer.

pnpm everywhere

No npm or npx. pnpm dlx replaces npx; minimumReleaseAge cooldowns and lifecycle-script default-deny ship in the base image.

Build-time scan gate

osv-scanner and pip-audit run always; snyk when a token is present. Builds fail on high severity.

Egress firewall

Per-instance iptables allow-list via NET_ADMIN. The harness reaches only what you permit.

Secrets never baked

Auth, scanner tokens, and 1Password refs reach the instance as env or read-only mounts, never an image layer or repo file.

Nightly re-scan

A systemd user timer re-scans installed images online so a CVE disclosed after build still surfaces.

One host dependency

Podman or Docker is all you need. Apple container support is a tracked follow-up.

launchable harnesses

modes

host dependency

secrets baked

Get running in a minute.

install

curl -fsSL https://raw.githubusercontent.com/drmikecrowe/harnessed/main/install.sh | bash

build an isolated stack

harnessed build tracer-time

run it

harnessed tracer-time

View on GitHub

How it compares.

Three projects solve adjacent problems. Pick the one that matches your threat model and workflow.

Project	Primary use case	Auth model	Threat model	Runtime	AI harnesses
harnessed	Power-user daily driver across multiple AI harnesses	Seamless; host credentials shared into container	Contain the AI, not the repo	Podman (rootless) or Docker	claude, omp, opencode (antigravity, codex planned)
NVIDIA OpenShell	Enterprise sandboxing with policy enforcement	Credential providers inject keys; never exposed	Full defense-in-depth	K3s inside Docker	Claude, OpenCode, Codex, Copilot
Anthropic devcontainer	VS Code team dev environments	Per-container setup	Consistent team environments	Docker / Dev Containers	Claude
Trail of Bits	Security auditing of untrusted code	Fully isolated	Malicious repos / adversarial input	Docker	Claude