Plan for 40 to 50 minutes in three parts: how coding tools got from autocomplete to orchestrators; tools and MCP; and the toolkit every major harness now shares, ending with how to choose one. The reading is module 06. If you can, keep a terminal open with a CLI agent so you can show its context breakdown live (/context in Claude Code; other harnesses have similar views).

People say "model X is bad at Y" when the cause is often the harness: the loop, the tools, the permissions, the context management, the interface. By 2026 the major harnesses had converged on the same features under slightly different names. Learn instruction files, skills, subagents, hooks, MCP, permission modes and worktrees once, and they carry over to the next tool.

On its own, a language model takes text in and predicts text out. It can't open a file, run a test, or remember yesterday's conversation. Everything that turns it into something that edits your codebase is the harness. The five parts. The agent loop calls the model, runs any tool it asks for, feeds the result back, and repeats until the model says it's done. Tools are functions the model may call, such as read_file, edit_file, bash, web_fetch and search. Permissions decide which calls run automatically, which need approval, and which are forbidden: allow npm test, ask before git push, never rm -rf. Context management decides what goes into the limited window and what gets summarized or dropped. The user interface might be a terminal, an IDE panel, a web dashboard, a desktop app, or a Slack bot. Most agents run a variant of ReAct (Yao et al., 2022): reason, act, observe.

This is the clearest recent example that the harness, not the model, can be the problem. Other harness choices change results too. On tool design, the SWE-agent paper (Yang et al., 2024) gave a model compact file viewers, a search tool, and an editor that lints on save, and the same model got much better at fixing real GitHub issues than with a raw shell. How a harness compacts history, loads instruction files and returns tool output decides what the model sees (module 07). Asking permission on every command trains you to click yes without reading, while never asking can do damage. And agentic benchmark scores depend on the scaffold (module 05). Before you switch models, check the harness version, the effort setting, recent instruction-file edits, and connected servers.

About 10 minutes on six overlapping generations of coding tools, why the terminal won in 2025, and how fast the market changes.

Examples for each row, from the module. 1. GitHub Copilot, technical preview June 29, 2021, built on OpenAI Codex. 2. ChatGPT, Claude.ai, IDE chat panels. 3. Cursor, Windsurf, Copilot agent mode, Cline. 4. Claude Code (research preview February 24, 2025), Codex CLI (April 2025), Gemini CLI (June 2025), OpenCode, Amp, Factory Droid, Cursor CLI, Copilot CLI, Crush. 5. Devin (2024), Codex cloud (May 2025), Copilot coding agent (May 19, 2025), Jules (2025), Claude Code on the web (October 20, 2025), Cursor cloud agents. 6. Conductor, T3 Code, the Codex app (February 2, 2026), the Claude desktop app, Gas Town, OpenHands Agent Canvas. Ask the room which generations they've used. Most people have used three or four, because the generations overlap.

Orchestrators like Conductor and T3 Code are not agents themselves. They drive the CLI agents you already have installed and signed into. T3 Code describes itself as an "agent harness control surface." It's MIT-licensed, comes from Theo Browne's company (the pingdotgg GitHub organization), and supports Claude Code, Codex, Cursor, OpenCode, Antigravity and others. Its README calls it "very very early." Conductor, from Melty Labs, is a Mac app that runs parallel Claude Code, Codex and Cursor agents in isolated workspaces. Gas Town (Steve Yegge, January 2026) is an orchestrator for 20 to 30 agents with named roles: a "Mayor" coordinator, "polecat" workers, and a "Refinery" merge queue. It sits at the top of Yegge's eight-stage ladder of AI coding workflows, covered in module 08.

Gemini CLI now targets enterprise Gemini Code Assist on Google Cloud. Free individual access and the Google AI Pro and Ultra plans moved to Google's Antigravity CLI, invoked as agy. With Windsurf, Google licensed its technology and hired its leaders, and that team went on to build Antigravity. Cognition, the maker of Devin, acquired the rest of the company. Codex is another kind of change. It started as a CLI (April 2025) and a cloud agent (May 2025), and by late 2026 OpenAI's docs list it across the ChatGPT desktop, web and mobile apps plus the CLI, IDE extension and cloud. Portable formats like AGENTS.md, Agent Skills and MCP make a forced switch cheaper. Discussion question 4 comes back to this.

About 15 minutes on what a tool is, what MCP standardizes, how it spread, what it costs, and when to use something else.

This example is shortened from the module's. The harness sends the model a list of tool definitions. When the model wants to act, it outputs a structured tool call. The harness checks permissions, runs the function, and puts the result back into the context. Because the model picks tools from their names and descriptions, writing a tool is writing a prompt. Anthropic's guide "Writing effective tools for agents" (September 2025) treats tool design as a core engineering task. Because definitions are sent on every call, fifty tools can eat a large share of the window before you type anything. That's why MCP can use so much context.

MCP is an open protocol that standardizes how an AI application discovers and calls external tools and data. Anthropic's analogy is a USB-C port for AI applications. Fuller timeline. March 2025: the spec adds the Streamable HTTP transport, replacing HTTP+SSE. March 26, 2025: OpenAI adds MCP to its Agents SDK and says ChatGPT desktop and the Responses API will follow. April 2025: Google DeepMind's CEO says Gemini models and SDK will support it; Gemini CLI ships with MCP in June. May 2025: Microsoft announces support across GitHub, Copilot Studio and Windows at Build. September 8, 2025: the official MCP Registry launches in preview. December 9, 2025: Anthropic donates MCP to the new Agentic AI Foundation (AAIF), alongside Block's goose and OpenAI's AGENTS.md. MCP Apps renders tool UI such as forms and dashboards in a sandboxed iframe; it launched in Claude, goose and VS Code Insiders, with ChatGPT the same week. The 2026-07-28 spec sends version and capabilities with every request and deprecates Roots, Sampling and Logging. A stateless server can sit behind an ordinary load balancer, which makes hosted MCP easier to scale. Tools, resources and prompts are unchanged.

Messages are JSON-RPC 2.0. A server is a small adapter. It says "here are my tools and their schemas," then runs calls and returns results. The harness adds those tools to the model's tool list. Configuration is a small file. In Claude Code, a project-level .mcp.json might run Playwright locally over stdio and connect to GitHub's hosted server over HTTP, with the token read from an environment variable rather than written in the file. Codex CLI uses TOML in ~/.codex/config.toml for the same idea. With the official Python SDK, a working server is about ten lines. The module shows all three. For contrast, Google's Agent2Agent (A2A) protocol, announced April 2025 and given to the Linux Foundation that June, connects one agent to another agent. In coding work you meet MCP daily and A2A rarely.

The bloat figure is Anthropic's typical five-server setup, from its advanced tool use post (November 2025): 58 tools, about 55K tokens, "before the conversation even starts." It also reported seeing 134K tokens of tool definitions internally before optimization. Large tool lists also make tool selection less accurate. On security, a malicious or compromised server can lie in its tool descriptions ("tool poisoning"), change behavior after you approve it, or exfiltrate data. Hou et al. (2025) survey the threats; module 11 covers defenses. Many community servers are thin API wrappers with poor descriptions and huge outputs. A popular server can still be unsafe. In early 2026, hundreds of malicious skills appeared on OpenClaw's public skill registry. The CLI argument is that the model already knows those tools from training, and their output can be filtered with grep or jq before it reaches the context.

Code mode means presenting tools as a code API that the model calls from a sandbox. Cloudflare's Code Mode (September 26, 2025) converts MCP tools into a TypeScript API, arguing that "LLMs are better at writing code to call MCP, than at calling MCP directly." Anthropic's "Code execution with MCP" (November 4, 2025) presents servers as code files on a filesystem that the agent browses on demand. In its example, token use dropped "from 150,000 tokens to 2,000 tokens," a 98.7% saving, because intermediate data stayed in the sandbox instead of passing through the model. It's the most token-efficient option for multi-step data work. A related trick, tool search, loads a small search tool first and fetches definitions only when needed; Anthropic reported an 85% token reduction. The 2026 trend is toward hybrids: lazy tool loading, MCP servers presented as code APIs, and skills that bundle scripts. Discussion question 2 asks the room for examples of each.

About 15 minutes on the features every major harness now has, three of them in detail, closed products, and how to choose.

Names differ slightly between products; the ideas are the same. The module uses Claude Code's terms because its docs are detailed. Codex, Cursor, OpenCode and others have close equivalents. Two more rows from the module: slash commands, saved prompts you trigger by name, which Claude Code has folded into skills; and scheduling and loops (/loop, /goal, cloud schedules), covered in module 07. They converged because features are cheap to copy, and good ideas are visible in open-source projects. Aider's repository map, the Ralph loop, worktree-per-agent orchestration and skills all spread within months. Your skills transfer between tools, and no harness keeps a feature lead for long. Durable advantages come from the model, the integration with where work already happens, and the price.

Anthropic introduced Agent Skills on October 16, 2025, published the format as an open standard at agentskills.io on December 18, 2025, and donated it to the AAIF on October 22, 2026, reporting more than 70 agent platforms had integrated it, including ChatGPT, Cursor, GitHub Copilot and VS Code. With progressive disclosure, the agent sees a one-line description of every skill and reads the full instructions only when a task calls for them, so dozens of procedures cost almost nothing until used. Skills can run code, so treat third-party skills like dependencies. For hooks, Claude Code's docs say instruction files are treated "as context, not enforced configuration." To block an action regardless of what the model decides, use a hook. The module has two examples: a PostToolUse hook that runs Prettier after every edit, and a Stop hook that blocks the agent from ending its turn while CI is still running on the branch, so it keeps working and sees the reason. Keep hooks fast; a buggy one can block everything.

Anthropic was candid that auto mode is "not a drop-in replacement for careful human review on high-stakes infrastructure." Permission modes run from plan-only, through ask-every-time and auto-accept edits, to classifier-approved auto mode and full bypass. Approval fatigue is clicking yes on the fortieth prompt without reading it. Allowlists and sandboxes keep the remaining prompts meaningful. Permissions are a security boundary, not a UX detail. An agent that can read untrusted input, access private data, and communicate externally has all three parts of Simon Willison's "lethal trifecta." Permission modes, network allowlists, credential scoping and sandboxes are how you break at least one leg. Module 11 goes further; Anthropic's "How we contain Claude across products" (May 2026) shows how one vendor layers these defenses.

Two cautions apply to all of them. Browser and computer-use agents are the riskiest category. They read untrusted web content while holding your logged-in sessions. Anthropic's Chrome launch post reported a 23.6% prompt-injection attack success rate without mitigations and 11.2% with them in its tests. Better, and still not zero. Read module 11 before pointing one at your email or bank. Bundled products change underneath you. The vendor can change the model, the prompts or the limits at any time. That's fine for prototypes. For a workflow a team depends on, prefer tools whose configuration you can see and version. If asked, Claude Design can apply a team's design system, export to Canva, PDF, PPTX or HTML, and package a handoff bundle for Claude Code. The module also lists Claude Code itself, Claude Cowork and Artifacts. Model tiers behind each product change often; see module 03.

One more question from the module: where does the work happen? Terminal, IDE, browser, GitHub issues, or Slack. Single-vendor examples: Claude Code, Codex, Antigravity. Bring-any-model examples: OpenCode, Cline, Kilo Code, Aider, Cursor. Starting points by situation, from the module: A student: one CLI agent plus its IDE extension, with approvals on, so you see every action. An engineer on a team already using an IDE: that IDE's agent mode, plus one CLI agent for bigger tasks. A team that must keep code on-premises: an open-source, model-agnostic harness with a self-hosted or local model. A lead standardizing a team: one primary harness, with shared knowledge in AGENTS.md, skills and hooks, which work across most harnesses, so a later switch is cheap. Someone running many tasks at once: a CLI agent plus a worktree-based GUI or orchestrator.

The module's list has eight steps; this folds two in. Keep AGENTS.md well under 200 lines (module 07). Good first hooks: a formatter after edits, a guard against destructive commands, and a check that tests pass before the agent says "done." Check each MCP server's context cost in your harness's context view, and prefer an existing CLI when the agent already knows it. Move repeated procedures into skills instead of pasting them into the instruction file. Checkpoints are convenient; git is the real safety net. Too many MCP servers waste context. A popular server or skill can still be unsafe. Approval fatigue, blaming the model for a harness problem, and accidental vendor lock-in cause problems too. Clean up worktrees and sandboxes after parallel work.

This is my setup and my opinion. It maps onto Part 1. T3 Code is one of the generation-6 GUIs that drive installed CLI agents, with a worktree per agent. Gas Town, Yegge's own fully orchestrated system, sits at the top of the ladder the take mentions; module 08 covers the ladder and how much autonomy works in practice. The module adds one related point. A harness's cost model matters as much as its features, and my view that subscriptions are what make heavy agentic use affordable is in module 12.

Individual steps in full. Open a small project you know and ask the agent to explain the architecture; note which tools it calls. Check the context breakdown and write down how many tokens the system prompt, tool definitions and instruction files use. Connect Playwright or GitHub over MCP and check again. Add a PostToolUse formatter hook and confirm it runs after an edit. Write a Stop hook that blocks "done" until the tests pass, give the agent a task that breaks a test, and watch the hook push it back. Finish with one paragraph: what did the harness do that the model alone couldn't? For the class version, give every group the same well-specified task, such as adding a feature with tests to a sample repository. Another group judges diff quality.

For 1, the April 2026 postmortem and module 05's harness comparisons show the harness can move results a lot. The module also argues that durable advantages come from the model, the integration with where work already happens, and the price. For 2, use the three-ways table. Building for others favors MCP; your own agent favors trying the CLI first; multi-step data work favors code in a sandbox. For 3, push toward replacements: allowlists, sandboxes, limited credentials, and hooks for hard rules, so the prompts that remain are worth reading. For 4, portable formats (AGENTS.md, Agent Skills, MCP), open licenses, foundation governance, and not locking team knowledge into one vendor's format.

The module has the full MCP config examples, the ten-line Python server, both hook examples, and the closed-products table. The MCP docs are the place to start building a server. "Code execution with MCP" explains the context-cost problem and one fix. The postmortem is a short, concrete read on how harness changes look like model regressions. Next session, module 07, covers what goes into the context window and the buzzwords around it.