HarnessRouter

Navigate HarnessRouter

Search the site

  • HarnessRouter Community EditionOpen-source agent harness infrastructure and the Unified Harness Protocol.Product
  • Harness catalogSupported harness IDs and source-backed integration references.Harnesses
  • Care Prep BenchmarkThe same task compared across Codex, Claude Code, and Hermes configurations.Benchmarks
  • Harness rankingsPublic attributed usage across reviewed agent harnesses.Product
  • ExamplesSee how agent-backed features return finished work inside a product.Product
  • PricingPlans and usage pricing for HarnessRouter.Product
  • Hermes AgentAn open-source, persistent AI agent with memory, reusable skills, built-in tools, browser automation, scheduled tasks, and subagents.Harnesses
↑↓ Navigate↵ OpenEsc Close
Sign up

Integration pattern

Authorize sessions and files in your product.

HarnessRouter returns opaque session and file IDs. Your server decides which product user or tenant may continue, cancel, preview, or download them.

Product responsibility

Before run, continue, cancel, preview, or download, derive the current user and tenant from your product's trusted session. Do not trust browser-submitted org, tenant, member, Workspace, harness, session, response, or file identifiers.

Records to keep

  • user_id or tenant principal.
  • feature_key and allowlisted harness_id.
  • session_id and response_id returned by HarnessRouter.
  • Returned file_id, path, media type, and product-visible artifact state.

Checks

  • List only sessions belonging to the current product user or tenant.
  • Continue only sessions mapped to the current user or tenant.
  • Cancel only sessions mapped to the current user or tenant.
  • Preview and download only files mapped to an authorized session.
  • Return a product-level denial when ownership cannot be proven.
Product authorization gate

Make the ownership check before every server-side HarnessRouter call that touches an existing session, response, or file. Return a product-level denial when the mapping is missing.

Open standard

Your ownership checks before continue, cancel, preview, and download extend UHP's requirement that scope be enforced on every operation, the spec counts cancel, delete, continue, and download all as object access. See object scope in UHP's Security chapter.

Create API Key

Ready to run this against a live workspace? Keys take under a minute.