[ agent harness ]

Generate an agent harness from your repo, with your decisions built in.

decree-harness scans your code and the decisions your team wrote down. It writes a system prompt, tools bound to your real routes and scripts, guardrails, evals and a get_decisions tool, for four targets.

$npx decree-harness

Read the docs →

tool call · get_decisionsmcp

// the agent is about to edit a ledger adjustment
get_decisions { "paths": ["src/ledger/adjust.ts"] }

// result (text)
2 decisions govern these paths, most specific first. Follow them, and cite the id when one constrains your change.

[adr-0014-ledger-writes-go-through-ledgerservice] Ledger writes go through LedgerService
Rule: Write to `ledger_entries` only through `LedgerService`, in the same transaction as the change that caused the entry.
Governs: src/payments/**, src/ledger/** | Source: docs/adr/0014-ledger-writes-go-through-ledgerservice.md

[adr-0021-store-money-as-integer-minor-units] Store money as integer minor units
Rule: Store and pass amounts as integer minor units with a currency code. Never use floating point for money.
Governs: ** | Source: docs/adr/0021-store-money-as-integer-minor-units.md

Example output for an illustrative orders and payments service.

[ what it reads ]

The scan covers your code and your written decisions.

The code scan runs locally with no network calls. ADRs keep the status they declare. Rules and post-mortem lessons start as proposed and reach agents only after someone confirms them.

[ code ]

Routes in Express, Fastify, Hono, NestJS, Next.js, FastAPI, Flask, Django, Gin, Echo, Chi, Rails and more
OpenAPI and Swagger specs
Scripts in package.json, Makefile, pyproject, justfile and Taskfile
Env var names and database models
README and existing agent config

[ decisions ]

ADRs, for example docs/adr/*.md
Post-mortems and incident write-ups
CLAUDE.md and AGENTS.md
Cursor rules, .cursorrules and Copilot instructions
Each extracted decision keeps the file and line it came from

[ what it writes ]

Four targets from one decree.json.

Pick targets with --targets typescript,python,mcp,claude-code or all. When decree.json has decisions, every target includes get_decisions, and the system prompt tells the agent to call it before it changes code.

Claude Codeagent/claude-code/CLAUDE.md, .claude agents, commands, skills and settings, plus .mcp.json. Calls get_decisions through the MCP server, or a .claude/skills/decisions script without it.
MCP serveragent/mcp-server/An MCP server for Claude Code, Claude Desktop and Cursor, with get_decisions reading a bundled decisions.json.
TypeScriptagent/typescript/A standalone agent on the Anthropic TypeScript SDK with a CLI, a REPL and evals.
Pythonagent/python/A standalone agent on the Anthropic Python SDK with pytest tests.

~/acme-orderszsh

$ npx decree-harness generate --targets all

decree.json     tools, guardrails, targets, decisions
.decree/        profile.json, manifest.json, schema.json
agent/          
  claude-code/  CLAUDE.md, .claude/ agents and skills, .mcp.json
  mcp-server/   MCP server with get_decisions and decisions.json
  typescript/   standalone agent (Anthropic TypeScript SDK)
  python/       standalone agent (Anthropic Python SDK)
  evals.json    eval cases

[ safety defaults ]

Guardrails ship in the generated code.

Every tool carries readOnly, destructive and requiresApproval flags. Destructive tools always ask a person first.
File tools are confined to guardrails.allowedPaths, including symlink escapes.
Shell tools quote parameters and refuse anything in guardrails.blockedCommands.
Secret env var values are redacted from tool output before the model sees them.
maxTurns and maxCostUsd cap every run.
Generated files you edited are never overwritten unless you pass --force.

[ roadmap · harness governance ]

Later: governance for every agent, read from the same decisions.

Today the generated harness serves decisions to agents and enforces the guardrails in decree.json. Once the hosted workspace holds decisions for every repository, we plan to add runtime controls on top of it. None of this is available yet.

[ tool access ]planned: Each agent gets a scoped identity: which repositories, environments and external services it can reach. Access is granted and revoked in one place.
[ sandboxing ]planned: Agent runs are isolated, and every action is logged against the agent that took it.
[ policy checks ]planned: Each action is checked against live decisions before it runs. A blocked action cites the decision, its source and its owner.
[ evaluation ]planned: One view of every agent: what it ran, what it cost, and which decisions it tripped.

policy checkdesign sketch

agent: acme-orders-agent
action: write_file src/orders/refund-adjust.ts
writes: ledger_entries (direct SQL insert)
checked: 3 live decisions from get_decisions

BLOCKED · violates adr-0014-ledger-writes-go-through-ledgerservice

Write to ledger_entries only through LedgerService.

source docs/adr/0014-ledger-writes-go-through-ledgerservice.md · owner @jkim

Design sketch of a planned feature. Not available yet.