Everyone is building with agents.
Almost nobody talks about what is actually inside one.
Not the model. The harness around it.
I spent the last few months building one from scratch in Python every component, no framework shortcuts. A streamed agent loop, typed tool calls, approval gates, prompt-injection boundaries, context compaction, MCP integration, subagents, persistence, and a full test suite.
The project is called AgentForge.
It is open source, installable, and running right now on my machine.
→ GitHub: MohitGoyal09/AgentForge
→ PyPI: agentforge-harness
→ Install: pip install agentforge-harness
→ PyPI: agentforge-harness
→ Install: pip install agentforge-harness
This article is not a launch post.
It is everything building AgentForge taught me about what agents actually are and why using frameworks without building one first leaves a dangerous gap in your understanding.
The core lesson came early and changed everything after it:
An agent is not a model. An agent is a runtime that controls how a model sees, acts, retries, remembers, and stops.
The model is maybe 20% of the engineering.
The other 80% is what wraps it: the action space, the approval policy, the observation format, the context budget, the recovery paths, the persistence layer.
I built all of it. Here is what each part taught me.
---
## The Whole Harness In One Table
This is what I ended up building, and what each part taught me:
| Component | File | What It Taught Me |
| --- | --- | --- |
| Session runtime | `agentforge_harness/agent/session.py` | Chat history is not enough. An agent needs a real runtime container. |
| Agent loop | `agentforge_harness/agent/agent.py` | The loop is a control system, not a `while tool_calls` toy. |
| Provider adapter | `agentforge_harness/client/llm_client.py` | Normalize model providers at the edge. |
| Tool contract | `agentforge_harness/tools/base.py` | Tool output quality controls recovery quality. |
| Tool registry | `agentforge_harness/tools/registry.py` | Every action should pass through validation, policy, cleanup, and hooks. |
| File tools | `agentforge_harness/tools/builtin/` | Small metadata details change model behavior. |
| Approval layer | `agentforge_harness/safety/approval.py` | Safety has to be enforced outside the prompt. |
| Prompt-injection boundary | `agentforge_harness/safety/prompt_injection.py` | Tool output is data, not instruction. |
| Context manager | `agentforge_harness/context/manager.py` | Forgetting is an engineering problem. |
| Skills | `agentforge_harness/skills/manager.py` | Load guidance when needed, not all the time. |
| MCP | `agentforge_harness/tools/mcp/mcp_manager.py` | External tools need namespacing and trust boundaries. |
| Subagents | `agentforge_harness/tools/subagents.py` | Delegation should start bounded and scoped. |
| Persistence | `agentforge_harness/agent/persistence.py` | If you cannot inspect the run, you cannot improve the agent. |This table is the real article.
Generated by Thread Navigator
Press ⌘ + S to quick-export