Harness coverage matrix
Every harness exposes a different interception surface, and the honest answer to “am I covered?” is per-harness. This page is the living record — updated with every integration we ship. Three questions matter:
- What does the pre-call check intercept? If the hook doesn’t fire for a tool, policy never sees it.
- Can policy ask a human?
denyis easy; a usable control layer needs an approval path. - Can the result be rewritten inline? Output scanning that can’t act is observational — a leaked credential still reaches the model.
| Harness | Install | Pre-call check intercepts | Policy can ask a human? | Result rewritten inline? |
|---|---|---|---|---|
| Claude Code | guide | All native tools + MCP | Yes — native ask |
Yes |
| DeepSeek Harness (dsh) | guide | Everything — native tools, custom plugins, Code Mode sub-calls | Yes — ask feeds dsh’s own approval prompt; headless asks deny by design |
Yes — tools/post-execute can replace result content |
| Cursor | guide | Most native tools (some built-ins don’t emit; bugs filed) | Yes | No |
| Hermes Agent | guide | Everything, in-process — native and custom skills | No — block only; ask maps to block + dashboard approval |
No — post hook is observational |
| opencode | npm: acp-opencode | Permission-routed tools + deny-only backstop for the rest | Yes — via the permission system | No |
| OpenClaw | guide | Native plugin surface | Yes | No |
| Codex CLI | guide | Bash only; file edits need the MCP supplement | No — ask maps to deny + dashboard approval link |
No |
Two rows deserve a note. Claude Code has been the reference surface since day one. DeepSeek Harness is the first harness since to land in the rightmost column on all three questions — its typed interception points (tools/pre-execute returning allow/ask/deny, tools/post-execute able to replace content) were designed for exactly this, and its headless composition denies unanswerable asks by itself.
What “covered” means here
The same wire contract backs every row: the pre-call check posts to /govern/tool-use and maps the server’s allow / ask / deny onto whatever the harness can express; the post-call report goes to /govern/tool-output for output scanning and the audit trail. One workspace, one policy set, every harness — a deny on Claude Code is a deny on dsh.
Where a harness can’t express something (Codex has no ask; Hermes can’t rewrite), the plugin degrades explicitly and the row above says so. We’d rather publish the limitation than paper over it — a coverage gap you know about is a policy decision; one you don’t is an incident.
If you’re building a harness
The spec that earns the full row: one pipeline every tool dispatch flows through, a typed pre-call decision with allow/ask/deny, a post-call hook that can rewrite what the model sees, and deny-by-default for asks nobody can answer. dsh shipped all four in a developer preview; the write-ups for Hermes and dsh go deeper on why those designs worked.
Updated 2026-08-13, with the DeepSeek Harness integration. This page changes whenever a harness integration ships or a harness closes a gap.