Four open source agent harnesses compared on what survives the session
Four open source agent harnesses compared on the one fact that outlives the session: where the agent’s state lives. Kortix is the open-source AI Operating System: your agents, their skills, your company memory, and every connector in one git repo you own, with the agents working on real cloud computers.
In the repo
A harness whose settings are files
# agents/<name>.md one file per agent (`agents.<name>.file`) # skills/<name>/SKILL.md skills, loaded by every harness # memory/ the project brain (the `kortix-memory` skill) # harnesses/opencode/ files only OpenCode reads (`opencode.config_dir`) # harnesses/pi/ files only pi reads (`pi.config_dir`); create it when needed kortix_version: 2
Six lines from the starter manifest, sitting in the project repo beside the agent files themselves.
Four runtimes
Four runtimes on the facts an audit turns on
Every cell comes from the project’s own repository or docs, and each source is linked in the prose.
| Criteria | Kortix | Codex | OpenCode | TrueForge |
|---|---|---|---|---|
| Open source | Yes | Yes | Yes | Yes |
| Where it runs | Kortix Cloud, your VPC, or your own on-prem network | Your computer, an IDE, the desktop app | A terminal or the desktop app | One local process, or hosted with Postgres |
| Approves a tool call | Approval gates you set. Off until you set them. | Sandbox and approval policies in its config | Plan agent denies edits; bash follows your permission config | Human checkpoints in the chat |
| Session state survives in | An ephemeral branch of your repo; committed work | Conversation state the harness carries across turns | Local session history on your machine | SQLite locally, Postgres when hosted |
| Agent config lives in | agents/, skills/, memory/, one kortix.yaml | Instruction files in your project, settings in its config | opencode.json at the project root | YAML catalogs loaded at setup |
| Fits | Teams that audit work in a repo they own | Coding work in OpenAI’s app, CLI or IDE | A coding agent you drive from a terminal | Embedding an agent inside your product |
What a harness owns, stated three ways
Microsoft's agent framework documentation puts it plainly: "An agent harness, sometimes called an AI harness, is the runtime scaffolding that turns a language model into an agent that can perform work." LangChain reduces the idea to a formula, "Agent = Model + Harness," and then lists what sits on the harness side. System prompts. Tools, skills and the descriptions that let a model choose them. A filesystem, a sandbox, a browser. Orchestration logic that spawns subagents and routes between models. Hooks that compact context or lint what the agent just wrote. Anthropic's version names the same parts in one line: the loop, tools, context management and guardrails around a model.
None of those definitions settles where a harness stops being a library and starts being infrastructure. Dr Phil Winder's four-layer stack is the cleanest way to place the nine projects discussed here. The model reasons, the harness runs one agent, the framework composes several. Then a fourth layer runs many harnesses for a team, over months. Codex, OpenCode, Aider and Pi sit in the second layer and arrive as a tool you install. Deep Agents and TrueForge straddle the line, because both are built to be embedded in something else. Kortix is that layer, and the layer question decides nearly every difference worth caring about.
Four facts that outlast the model list
Where does it run? Who approves a tool call? What does the session leave behind? Is the agent's configuration a file you can review in a pull request?
Those four questions separate these projects more sharply than any model list, and for a simple reason. Model choice is a setting, and teams change it in an afternoon. Where the state lands is a decision you live with for as long as the work exists.
The harness also changes the output on a fixed model. OpenAI reports that retained reasoning and context compaction raised a model's ARC-AGI-3 score from 13.3% to 38.3% while cutting output tokens sixfold. Same weights, different harness, roughly triple the score.
Where each project keeps its state
The Codex harness is the easiest to inspect of the group, because OpenAI published the loop. It is open source and "powers all these experiences": the app, the CLI, the IDE extensions and third-party clients. It manages conversation state, streams execution, uses tools, enforces the sandbox and approval policies someone configured, and carries work across turns. The latest tag, rust-v0.164.0, landed on 2026-10-23.
OpenCode is the coding agent you drive from a terminal or its desktop app, and its configuration is a file in your project. opencode.json sits at the project root, and the docs describe it as safe to be checked into Git. Its built-in plan agent denies file edits and patches by default, and does not restrict bash: commands follow the permission config, which starts permissive. Version v1.19.4 landed on 2026-10-22. Session history, though, lives in OpenCode's own local data directory, so a teammate who clones the repo gets the configuration and not the conversation.
OpenHands released v1.34.0 on 2026-10-27 and describes its work as AI-driven development. Goose, at v1.56.0 on 2026-10-23, calls itself "an open source, extensible AI agent that goes beyond code suggestions." Aider still answers to "AI pair programming in your terminal," with v0.86.0 from 2025-08-09 and its repository last pushed on 2026-05-22. Deep Agents, LangChain's "batteries-included agent harness," ships as a Python package, deepagents==0.7.32 as of 2026-10-23, and is meant to live inside an application you write. Pi is an open-source coding agent published as @earendil-works/pi-coding-agent, at 1.4.0; the older badlogic/pi-mono address redirects there.
TrueForge is the closest thing to a harness sold as a component. It runs the execution loop, MCP tools, skills, sandboxing, approvals, context management and session state. Then it exposes all of that three ways: a chat UI, an HTTP API with a TypeScript SDK, and an embeddable UI SDK. Local mode is one process with SQLite on your machine. Hosted mode swaps in Postgres and Redis, and its session view lists past runs with every turn, tool call, subagent, token count and timing. Its models, MCP servers and skills come from YAML catalogs you customize at setup.
The session closes, and the state has to land somewhere
Three placements show up across these projects, and they explain what you can audit a month later.
On your machine, as with OpenCode's local store or a Codex CLI session, the record is a file or a database on the laptop that produced it. Fine while you work alone; invisible to whoever picks up the repo next.
In a service's database, as with TrueForge hosted, the record is durable and shared, and your access to it depends on the deployment you bought and the retention its operator sets.
In a repository you own, the record is a commit, and the diff is the audit.
Kortix takes the third route, and its own agent file says so: a session is an ephemeral branch of the repo, and only what you commit and push survives. One isolated sandbox per session. Each session has its own isolated machine and branch. An experiment that goes wrong is a branch you drop rather than a change you unwind. Session work reaches main through a change request. Merge is default-deny for agents. And the manifest that governs the whole thing declares connectors, secrets, permissions and skills only.
That combination is the one a security reviewer can follow. A permission change is a line in a diff. A tool call is a line in a transcript attached to a branch. The rollback path is a git operation your own team already knows.
How to choose in one pass
One coding agent on your own machine? Codex, OpenCode, Aider and Pi are all defensible. The choice comes down to the editor you live in and the provider you already pay. If you are building a product that needs an agent inside it, Deep Agents and TrueForge hand you a loop, a session store and a UI to embed.
Suppose the harness has to serve a team, keep its configuration under review and leave an audit trail you control. Then the shortlist narrows to projects whose configuration and session state are files in a repository you own. That is a much shorter list, and it is where the choice actually gets made.
Questions
Questions people ask before picking a harness
Can I run these harnesses self-hosted?
Yes, for every project in this comparison that publishes its source, and that is all of them. Run it on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free.
Which harness keeps the agent configuration in my repo?
Kortix does: your agents, their skills, your company memory and every connector are files in one git repo you own, with the manifest beside them holding governance only. Codex and OpenCode keep part of it, Codex through instruction files in the project and its sandbox policy, OpenCode through opencode.json at the project root. TrueForge loads models, MCP servers and skills from catalogs at setup, which is state in its database rather than a file you review.
Does a harness change which model I can use?
It sets how the model is called, not which models exist. Most of these projects can be pointed at more than one provider, so switching model is often a config change; a harness tied to one lab is the exception and its docs say so early. Kortix is not tied to one lab.
Run the harness whose state you keep
One repo for the agents, the permissions and the history.