Coding agent harnesses compared: 50 tools scored on architecture

Why score architecture instead of features

Almost every coding-agent comparison published in 2026 is a feature checklist: does it support MCP, does it have a plan mode, how many providers does it speak. Those tables are easy to produce and nearly useless for a purchasing decision, because they treat a checkbox in a README as equivalent to a working mechanism. Two harnesses can both claim “sandboxing” when one enforces a kernel policy and the other simply refuses to run a command if it sees a dangerous-looking string.

Architecture is what determines outcomes you actually feel: whether a half-finished multi-file edit leaves your repository in a valid state, whether an approval you granted yesterday still means something after a crash, whether the agent can run a test suite without also being able to reach the network. This report scores ten architectural dimensions, each worth ten points, and states what evidence each score rests on.

The field is large enough that a complete census is no longer possible for one team. A curated public directory tracked 110 or more terminal-native coding agents and harnesses as of 13 August 2026.^[1] This report covers the 50 that readers most often ask to compare, and it is explicitly a dated snapshot: several of these projects ship weekly.

The ten dimensions

Each dimension is scored 0 to 10. The scale is anchored: 10 means the mechanism is implemented, enforced by the system rather than requested of the model, and better than what the rest of the field ships; 5 means a working but ordinary implementation; 3 or below means the concern is handled by convention, by the model’s good behaviour, or not at all.

The full-harness scorecard

These nineteen tools are complete harnesses: they own the loop, the tools, and the safety boundary. IDE-embedded agents are scored on the agent, not on the editor around it.

Revision note. Kendr Code was scored 79 when this report was first published on 14 August 2026. A release the same day shipped a kernel sandbox, a symbol index, conversation rewind, a real tokenizer, an ACP server, a VS Code extension, a headless CI contract, and a GitHub Action — moving it to 88. Every competitor row is unchanged from the original snapshot and has not been re-verified since, so the tie at the top reflects Kendr closing its own gaps against a static comparison set, not a measured overtake of a moving field. The changes are itemised further down.

Claude Code takes the top position on breadth rather than on any single mechanism. Its documented surface list now spans terminal, VS Code, JetBrains, a desktop app, the web, and mobile, with cloud-side Routines that keep running when the machine is off, GitHub Actions and GitLab CI integration, Slack routing, subagents, hooks, skills, and an Agent SDK.^[2] Codex takes the sandboxing dimension outright: a Rust implementation with Seatbelt on macOS, Landlock and seccomp on Linux, a native Windows sandbox, and network access off by default.^[3]

Who actually leads each dimension

Totals flatten the interesting information. The dimension leaders are more useful, because a team with a hard constraint — a regulated repository, an untrusted dependency tree, a fleet of parallel agents — should choose on the dimension that binds them, not on an aggregate.

Two dimensions deserve comment. Repository retrieval is the one place where the closed IDE products are clearly ahead of the terminal-native field: Cursor and Windsurf both maintain semantic indexes over the repository, while most CLI harnesses rely on agentic search — grep, glob, and ranged reads — which is more transparent and more token-expensive.^[4] Aider is the notable open-source exception, with a tree-sitter repository map that gives the model a structural summary rather than raw file dumps.^[5]

Durability is the one place where the field is broadly weak. Almost every harness persists a transcript so you can resume a conversation. Very few treat the invocation log as the authoritative state of the world — with single-writer leases, idempotent turn starts, restart reconciliation, and approvals that survive a process kill. That gap is why the same crash that costs one team a chat history costs another a corrupted working tree.

The independent tier: 33 lesser-known harnesses

Below the well-funded tier sits a large independent field. These projects are worth reading even if you never adopt them, because their authors have to make one architectural bet each and defend it. The scores below are indicative: they are derived from published documentation and repository evidence rather than from sustained hands-on use, and they carry more uncertainty than the table above.

Three patterns recur. First, binary-size and cold-start minimalism — agentty ships a single static C++ binary with no Node or Python runtime, and Waveloom and Zap make the same bet in Go and Rust. Second, governance as the product — DvalinCode pairs an organisation policy engine with enforced network egress and a hash-chained audit trail, which is the closest independent analogue to Kendr Code’s design. Third, context efficiency as the product — Keen Code replaces raw tool traces with structured turn summaries, and Waveloom ships four-tier compaction with three distinct subagent modes.^[1]

The case against the agent loop

Agentless scores 40 on this rubric and that number is misleading, so it deserves its own paragraph. Agentless deliberately removes the agent: instead of letting a model choose actions in a loop, it runs a fixed three-phase process — hierarchically localise the fault, sample candidate patches as diffs, then validate with regression and generated reproduction tests.^[6]

It is not a harness and it should not be adopted as one. But it is the strongest published argument that a large part of what agent harnesses do is unnecessary overhead for a well-specified repair task, and every team building a loop should be able to say why their loop earns its cost against a fixed pipeline. The rubric here scores harness engineering; Agentless is a reminder that harness engineering is a means, not a goal.

Where Kendr Code lands, including where it trails

Kendr Research builds Kendr Code, so the honest thing to do is score it on the same rubric and publish the weak marks alongside the strong ones. It scored 79 at first publication. A release later the same day moved it to 88 across six dimensions. The rubric did not change; the product did. Below is exactly what shipped and exactly what is still missing.

It has led three dimensions throughout. The edit engine, because every mutation is a typed, deny-by-default tool rather than a shell string: writes are preconditioned on a content hash captured at read time, multi-file changes run as checkpointed transactions with per-file atomic replacement and compensating rollback, checkpoint blobs are content-addressed and task-isolated, and external modification is detected rather than silently overwritten. Permissions, because an approval is one conditional database transition — concurrent deciders cannot both win — and pending approvals survive a restart, carry the exact proposed arguments with an audit fingerprint, and can mint a reusable allow rule scoped to a tool, a command prefix, or a path prefix. Durability, because the invocation log is the source of truth: single-writer leases with heartbeats, an atomically claimed idempotent turn start, restart reconciliation, and a hash-chained task ledger that replays.^[7]

The six that moved are itemised in the table below. The one that did not move is the model layer, and the reason is worth stating because it contradicts the obvious assumption. Kendr Code reaches 70-plus models, but an internal transport audit published with the release found that only OpenAI, Anthropic, and Google-direct routes use native tool calling; everything else — including Bedrock, Kimi, Sarvam, and local Ollama — runs Code actions over a constrained JSON protocol. The models are real; the transport under most of them is second-class. Model breadth counted in vendors rather than model IDs is six, against OpenCode’s 75-plus, and there is no generic OpenAI-compatible endpoint to close the difference. That dimension stays at 7 until the transport work lands.

Cloud moved from 5 to 7, not higher, and the distinction matters. A documented headless execution contract, a GitHub Action, and a GitLab template mean Kendr Code now runs in CI — but the agent still executes on a machine you own. Close the laptop with no CI job running and the work stops. Claude Code’s cloud Routines and GitHub Copilot’s Actions-powered coding agent both pass that walk-away test outright.^[2][9] Surfaces moved from 6 to 8 on an ACP server and a VS Code extension, which is four surfaces against Claude Code’s ten — no web, no mobile, no chat channels.

• Isolation 8 → 9: a real kernel sandbox on the host backend. Linux Landlock plus a network namespace, verified end to end on a 5.15 kernel at ABI v1 across seven assertions. macOS Seatbelt is implemented and pinned by tests but its enforcement is unverified — no macOS hardware was available. Windows is explicitly reported as unenforced: Job Objects bound a process tree’s lifetime, not its access, and the badge says so rather than claiming a sandbox.
• Context 7 → 9: a tree-sitter symbol index persisted in SQLite, exposed as typed read-only find_symbol and find_references tools rather than silently injected into the prompt, plus a real tokenizer behind the compaction budget with a calibration pass against observed usage.
• Loop 8 → 9: conversation rewind, recorded as a durable event so the ledger hash chain stays valid rather than mutating history. Restoring the matching file checkpoint is offered separately and opt-in, because a rewind that silently reverted the workspace would be a different and more dangerous operation.
• Extensibility 8 → 9 and surfaces 6 → 8: an ACP server and a VS Code extension. The ACP implementation deliberately declines the protocol’s own file and terminal methods — routing edits through the editor would create a second, non-transactional edit path, and routing commands there would bypass the sandbox. Permission requests resolve through the engine’s existing compare-and-set, so there is no second approval path.
• Cloud 5 → 7: a frozen non-interactive execution contract with structured JSON output, a GitHub composite action, and a GitLab template. Known limits: the published CLI archive is Linux x64 only with no declared glibc floor, there is no ARM64 artifact, and the action posts a PR comment rather than check-run annotations.

Method and its limits

Scores were assigned from published documentation, source repositories, and a curated directory of the field, plus hands-on operation of a subset. They are Kendr Research judgements against a published rubric, not measurements. Nothing here is a benchmark result: no SWE-bench number, no task-success rate, and no latency figure feeds into these totals, and a harness with excellent architecture can still lose to a weaker one driven by a stronger model.

Four specific limits. The independent tier carries the most uncertainty, because those scores rest largely on documentation rather than sustained use. The dimension weights are equal, which is a choice and not a fact — a team that never leaves its laptop should weight cloud at zero and reshuffle the ranking accordingly. The vendor scoring its own product is a real conflict of interest, which is why the rubric is stated before the scores rather than after, why the Kendr Code row still publishes a 7 for its model layer, and why the revision itemises what shipped so a reader can check each claim against source.

The fourth limit is the most important one for reading the revised table. Only the Kendr Code row was re-scored. Every competitor was scored once, on 14 August 2026, and has not been re-examined since — while Claude Code, Codex, Cursor, and OpenCode all ship on a weekly-to-monthly cadence. A vendor re-scoring itself against a frozen comparison set will always look like it is gaining. The correct reading of the tie at the top is that Kendr Code closed six of its own gaps in one release; it is not evidence that the distance to Claude Code actually closed, because Claude Code was not measured again. The next revision of this report will re-score the full field or it will not claim a ranking at all.

Sources and evidence

Primary and authoritative sources used for factual claims. Company research and executive forecasts are labeled as such in the article.

1. 1
   Awesome CLI Coding Agents: 110+ terminal-native agents and harnessesbradAGI · 2026-08-13
2. 2
   Claude Code overview: surfaces, subagents, hooks, skills, RoutinesAnthropic
3. 3
   OpenAI Codex documentationOpenAI
4. 4
   Cursor documentationCursor
5. 5
   Aider repository mapAider
6. 6
   Agentless: Demystifying LLM-based Software Engineering AgentsarXiv
7. 7
   Kendr platform overviewKendr
8. 8
   Kendr developer API and model contractsKendr
9. 9
   About GitHub Copilot coding agentGitHub