# omniharness / sandbox
Agent harness · Open source
OmniHarness
A self-extending agent platform that builds, registers and verifies its own capabilities.
- Long-horizon tasks that take minutes to hours, inside per-thread Docker sandboxes
- Self-verifying live preview: the agent can't declare victory while the build is broken
- Subagents, persistent memory, hot-loaded skills, MCP client with OAuth
can't say “done” while the build is red
- Long-horizon tasks that take minutes to hours, inside per-thread Docker sandboxes
- Self-verifying live preview: the agent can't declare victory while the build is broken
- Subagents, persistent memory, hot-loaded skills, MCP client with OAuth
- Multi-channel gateway: Slack, Telegram and the web UI
The bet
OmniHarness exists to remove the human from the inner loop. The agent doesn't just write code and stop — it runs the result, sees what breaks, fixes it, and confirms it's clean before handing anything back. And instead of you hand-wiring connectors and restarting the stack, the agent builds and registers new capabilities at runtime.
Self-verifying live preview
When the agent produces a web artifact, a preview auto-starts inside the sandbox and the gateway proxies it straight to your browser. A verification gate stops the agent from declaring success while the build is broken: it reads the dev-server or build error, fixes its own code, and re-checks until it's clean.
Harness foundation
Isolated Docker containers per thread for code, shell and file work; subagents for decomposing long-horizon tasks and running them in parallel; persistent memory across sessions; structured skills hot-loaded on demand; an MCP client with OAuth; and a gateway that lets you drive the agent from Slack, Telegram or the web.
Lineage, honestly
OmniHarness began as a fork of ByteDance's DeerFlow 2.0 and credits it openly. It has since diverged into an independent project with a different goal — and its README says plainly when DeerFlow is the safer pick. Because the agent writes and runs code with your credentials, the guardrails are the product: sandboxed off the control plane, with secrets scoped per capability and never exposed back to the model.