Agent harnesses in 2026: what locks you in

The question

Choosing an agent harness reminds me of picking a code editor ten years ago. Lots of options, strong opinions, and the differences that matter are not the visible ones. The license, the models it can run, and the surface you work on are three separate decisions. I watched one open-source harness get retired in a single morning this year. This is the decision map I use now, for my solo work, for teams I advise, and for people who will never open a terminal.

What a harness is

A harness is the code around the model that turns it into an agent: the loop that keeps calling the model, the tools it may run, the sandbox, the memory that survives a restart, and the rules that decide what reaches the context window. The model reasons, the harness drives.

LangChain's anatomy writeup from March 2026: a harness is every piece of code, configuration, and execution logic that is not the model itself.

Frameworks such as LangGraph and CrewAI compose several agents. Platforms such as AQ or Poly run many harnesses across a team. The mistakes start when the layers get confused.

Three axes, not one slider

Builders choose along three separate axes. I took this framing from Stefano Pineda's comparison in July 2026, and it has held up since.

• Harness license: can you read, fork, self-host, and audit the agent loop?
• Model and API lock-in: do you need that lab's subscription or API to run it?
• Product surface: local terminal, cloud agent, IDE plugin, messaging gateway?

The failure mode I keep hitting is collapsing these into one open-versus-closed slider. Codex CLI is an open Apache-2.0 harness that by default only runs OpenAI models. Gemini CLI was open source, Apache-2.0, and Google retired it anyway. Open source and model freedom are two different promises.

The landscape in late 2026

Four groups, matching how the products get pitched and how the lock-in gets hidden.

The lab terminals. Claude Code is the strongest single-vendor coupling on this list: closed product, proprietary license, Claude models only, via API, Bedrock, or Vertex. Polished permissions.

Codex CLI is the middle case. Apache-2.0 and auditable, but the natural models are OpenAI's GPT and Codex family through ChatGPT plans. Built-in hooks for Ollama, LM Studio, and Bedrock let you point it elsewhere. The product experience is built around OpenAI.

Gemini CLI is the cautionary tale. Open source, Apache-2.0, subsidized model access. Google ended consumer access on 18 June 2026 with no grace period; CI pipelines broke that morning. Individuals were pointed at Antigravity, a closed CLI with a weekly compute cap. Grok Build went the other way in July 2026, open under Apache-2.0, though it still runs Grok models and ships with SuperGrok or X Premium Plus.

Harness	License	Models it runs	What locks you in
Claude Code	Proprietary, no OSS license	Claude family only	Full: closed harness and Claude-only
Codex CLI	Apache-2.0	GPT/Codex by default, Ollama, LM Studio, Bedrock hooks	Partial: open harness, OpenAI-centric product
Gemini CLI	Apache-2.0, archived	Gemini	Retired for consumers on 18 Jun 2026
Antigravity CLI	Closed (Go binary)	Gemini	Closed, weekly compute cap
Grok Build	Apache-2.0, open since Jul 2026	Grok, custom base_url possible	Bundled with SuperGrok and X Premium+
OpenCode	MIT	75+ providers, local Ollama	None
Pi	MIT	35+ providers, local	None
Hermes	MIT	18+ providers, 200+ via Nous Portal	None

The open model-agnostics. OpenCode, Pi, Hermes, OpenHands, Aider, Cline, Goose. All MIT or Apache-2.0, all free software with your own model key. OpenCode is the most-starred dedicated coding agent, with 75+ providers; for heavy repo work I hand off to it or to Claude Code. Pi is the minimal countertrend: tiny prompt, token-efficient, great with local models, more DIY. Aider is git-native, every edit its own commit, and entered maintenance mode in May 2026. Cline runs in the IDE with human-in-the-loop approvals. OpenHands is the reference for autonomous runs, with Docker sandboxes and headless CI. Goose is MCP-native under Linux Foundation governance.

Hermes is my daily driver, so I try to be fair. MIT by Nous Research. One agent across terminal, desktop, web dashboard, and 25+ messaging channels. 18+ first-class providers, 200+ models through the optional Nous Portal, provider swap mid-workflow. Built-in cron, memory across sessions, self-improving skills. The honest trade-off: a generalist, token-hungry next to lean tools like Pi, not the cheapest per-edit coding desk.

The closed SaaS and IDE layer. Cursor, GitHub Copilot, Windsurf, Devin, Replit Agent, Bolt.new: subscription products with curated model menus and usage credits. You can choose Claude, GPT, or Gemini inside, but the harness is a subscription you cannot fork or self-host. Cursor runs $20 to $200 a month, Copilot Pro at $10, Windsurf $15 to $30, Devin $20 to $200 with credit billing.

The ZCode trap. The model, GLM-5.3, is MIT with open weights; the harness is a proprietary paid desktop app. Many write-ups call it open source because the model is. Check the license of the harness, not the model.

Solo: the already-pay-for-it logic

Affordability and friction dominate the solo decision. Closed options bundle model and harness into one subscription; open options are free software where you pay only for the model API, or nothing for local models.

The fast route is the one you already pay for. Paying for ChatGPT? Codex CLI adds no extra bill, Plus at $20 a month. Paying for Claude? Claude Code is the natural companion: $20 a month Pro, up to $200 Max-20x, no free tier. Cursor at $20 covers IDE-native work. Fine choices that trade model variety and portability for convenience.

The open route with your own key: OpenCode for heavy repo work, Cline in the IDE, Aider when the audit trail matters, Pi for token-thrifty runs, especially with local models.

Hermes fits one person differently. I run it as one agent across my surfaces, with cron jobs that run while the laptop is closed and memory across sessions. Mine lives on a small $5 VPS. Honest trade-off: token-hungry generalist, not the leanest per-edit coding tool.

If nothing may leave the machine, point a BYOK harness at a local model; reviewers report no code leaves for Continue with Ollama, Void AI, OpenCode, and Aider.

Teams: the shared-session gap

The team gap in 2026 is not model quality. It is shared sessions, permissions, attribution, and review. Reviewers I read use a three-part test: shared presence, two people in the same live session. Shared context, they see the prompts and process, not just the diff. Shared control, more than one person can steer.

Closed products give this out of the box. Copilot has the most mature org governance: repository permissions are the authorization boundary, and Slack and Teams integrations from August 2026 let a whole channel run shared sessions with budgets, sandbox policies, and extra approval for agent PRs. Claude Code's team tier runs about $100 per seat per year, with shareable cloud workspaces that are read-only for observers. Codex ships org roles and a PR-centric workflow. Devin works a ticket and returns a reviewed PR, though autonomy is uneven and credit billing surprises.

Open source is single-player by design. Cline, Aider, Continue, Pi, and OpenHands core keep sessions on one developer's machine, so teams bolt on git, CI, and PR review themselves. The multiplayer layer is mostly new closed products wrapping any harness: AQ at about $50 per user per month, Superconductor free to four members then $128 a month, Poly with per-turn approval and attribution, Consortium self-hostable. Multi-human shared sessions are still the exception; check for them explicitly.

A March 2026 piece counted 4 to 7 agent sessions per developer as normal, recommending separate agent users with trimmed permissions, a session manager, and audit logs. Open source lets you build that runtime; closed platforms hand it over ready-made. That is the real team trade.

Hermes on teams follows the shared-assistant pattern: gateway with allowlists and DM pairing, per-profile isolation, cron shared to a channel, subagents for parallelism. Several people talking to one shared agent, not pair programming. I would not sell it as an org governance tool; review still happens through git.

The citizen layer: agents for people who do not code

The constellation that usually gets a footnote deserves a section: project managers, office workers, ops and sales people who want to automate without writing code. They build agents in plain language, let agents hand work to other agents, and put results where humans pick them up. Three sub-categories, three lock-in profiles. The promises are real. The exit costs are real too.

No-code automation platforms. Zapier is the fastest onramp: around 9,000 managed integrations and a plain-language Copilot builder. Free tier at 100 tasks a month, Pro at $19.99 for 750, Team at $69 for 2,000 and 25 users. Every action counts as a task, which gets expensive: about $2,500 a month at 50k operations. Make is the visual power-user middle: routers, branching, 1,500+ modules.

n8n 2.0, out since January 2026, is the self-hostable option: 70+ native AI nodes, persistent memory, and an orchestrator node that builds multi-agent teams with explicit handoffs in one visual workflow, plus MCP servers and human-in-the-loop nodes. Billing per execution means around $50 a month on Cloud at 50k operations. Real automation leans on code: "I'm a developer and most of my workflows have code nodes." And n8n is fair-code, Sustainable Use License, not OSI approved, community edition free to self-host.

Managed agent builders inside the work stack. Creating an agent becomes a no-code feature inside the tools people already use, and it is the strongest vendor lock-in of the whole article: agents, data, identity, and approvals in one suite.

Copilot Studio plus Agent 365 is the incumbent, 120k+ custom agents in production by Q1 2026. Low-code designer, agents grounded in SharePoint, Dataverse, and ServiceNow. Multi-agent orchestration went GA on 22 April 2026 and speaks the open A2A protocol, able to delegate to Anthropic, OpenAI, ServiceNow, or SAP agents. Agent 365, live since 1 May 2026, gives each agent an Entra identity with Defender monitoring and Purview enforcement. Billing: $200 per 25,000 messages, actions at 2 to 10 credits, reasoning models add a premium meter. Strongest governance and the strongest M365 lock-in, with a bill I would not want to forecast.

ChatGPT Workspace Agents, from 22 April 2026, is the simple one: a no-code chat builder in the ChatGPT sidebar with native integrations for Slack, Google Workspace, Salesforce, Notion, and custom MCP. Credit-priced around $60 per user per month, GPT only, best for teams already living in ChatGPT.

Claude Managed Agents, public beta since 9 April 2026, is a developer product: API plus Agent SDKs at about $0.08 per session-hour plus tokens, not a citizen builder. Gemini Enterprise runs around $30 per user per month.

Open chat gateways. For people who will never see a terminal, the open option is the messaging gateway: your agent lives in WhatsApp, Telegram, or Discord. The install still leans technical, because a gateway has to run somewhere.

OpenClaw is MIT under an independent 501(c)(3) foundation: no enterprise edition, no paid version, no telemetry beyond an optional daily version check. Around 323k stars by late 2026, 25 to 29 channels, 13k+ skills from ClawHub. Models are bring-your-own: subscription OAuth, gateways, or local. Showcase: inbox zero, calendars, flight check-ins, 14+ agent teams under one gateway.

Hermes runs the same pattern from the inside: built-in cron, persistent memory, self-improving skills, 18+ providers. Same setup hurdle; once it runs, the automation is conversational. Both are consumer-friendly on the surface, technical on the install, with no subscription, no model lock-in, and no vendor-cutoff risk, which after June 2026 is worth a lot.

The handoff pattern underneath. All three sub-categories sit on the pattern this article is really about: agents handing work to other agents, or to humans.

The workspace is the handoff contract. A Waxell walkthrough this year: Agent A writes output to a shared workspace file, a scheduled Agent B reads it, and work moves with nobody routing it by hand. When a human must be involved, the agent writes the result where a person picks it up: a channel, a ticket, a review queue.

Multi-agent setups fail at the context-transfer boundary, not inside any one agent.

Structured versions are becoming protocols. CHAP, the Collaborative Human-Agent Protocol from June 2026, defines a shared workspace with typed events for assignment, acceptance, review, approval, rejection, override, escalation, and handoff, plus an append-only evidence log. Microsoft's AG-UI and HandoffBuilder add approval interrupts to execution streams.

Escalation has two triggers. Agent-to-agent is capability routing. Agent-to-human is confidence below a threshold, high stakes, or an exhausted retry budget. The AWS Well-Architected Agentic AI Lens makes this split; mixing them causes reviewer fatigue or risky auto-approval.

Underneath: MCP for agents to tools and data, A2A for agents to agents, AG-UI for agents to UI, CHAP for the human-agent workspace.

The lock-in questions

Can I read it? Can I self-host it? Can I swap the model? Can I still run this if the vendor cuts the free tier? Gemini CLI is the strongest argument for the fourth question. Apache-2.0 license, subsidized model. When consumer access ended on 18 June 2026, the license let you keep the code, but nobody kept the endpoint. Even when you pay a model vendor, keep the harness open; the two decisions belong to different owners.

Citizen layer: can I export my agents? Does it speak MCP or A2A? Is my workflow hostage to the tenant? Copilot Studio softens the agent format with open A2A and a multi-model backend hosting GPT, Claude, Llama, and Mistral, but the platform, identity, and billing are Microsoft. Workspace Agents are GPT-only in a ChatGPT-Enterprise-only stack. Claude Managed Agents are Claude-only, self-hostable via Bedrock or Vertex. Zapier and Make let you pick the LLM per step but chain you to platform and metering. n8n is self-hostable, no model lock-in, fair-code. OpenClaw and Hermes are fully open with any model; somebody has to host the gateway.

A three-question decision lens

Where does my code and data need to live? If it is my machine or my VPC, the closed SaaS layer drops away fast.

Who else needs to see the session? If two people steer the same live session, that is a team-product question and the open field is thin there; if only the output matters, a shared channel or review queue is enough.

How portable do I want the model choice to be? If you want to ride model prices as they move, pick a harness that takes any provider.

Rough routes. Solo and paying for ChatGPT: Codex CLI at no extra cost. Solo and model-curious: an open BYOK harness like OpenCode, Pi, Cline, Aider, or Hermes. Team on GitHub: Copilot. Team with a technical person and a cost ceiling: self-hosted n8n, or an OpenHands runtime with agent users. Microsoft shop: Copilot Studio, and you are buying into the tenant. Want the automation to outlive the platform: a gateway like OpenClaw or Hermes, with a technical host.

None of these routes is a winner. They are fits, and the fit changes with your constraints.

The routine, not the pick

The harness map keeps moving. While I wrote this, DeepSeek shipped an MIT-licensed Harness in developer preview, Grok Build went open in July, and Gemini CLI retired in June. Whole categories appear in a single quarter.

That is why the decision routine is the durable thing, not the pick. License, model, surface. Shared sessions or not. Can you leave? Run the four lock-in questions against the harness you use today. If you cannot answer the free-tier one with a clear yes, you know what to explore this weekend. In a managed suite, ask the export question before you build the fiftieth agent.

For people who will never open a terminal: it is not about which platform is biggest. It is whether your agents can leave when you do.