An SDR That Bills Like a Streaming Service

The economics of autonomous agents have always been quietly brutal. An agent that wakes up every fifteen minutes, thinks about what to do, does it, and goes back to sleep is an agent that burns tokens around the clock — which is why vendors of autonomous sales agents either charge enterprise prices or quietly degrade the product, shortening prompts and downgrading models until the loop stops costing more than it earns. The README of ethanplusai/harvey opens by naming this problem and then walking around it entirely: Harvey is an autonomous outbound-sales agent whose model calls ride on a Claude Pro/Max subscription through Claude Code, or on a ChatGPT plan through the Codex CLI. No API key, no per-token billing. The agent thinks in a loop all day, and the loop costs what you already pay for the chat subscription you were buying anyway.

That single design decision reframes the whole category. The commercial tools Harvey positions itself against — the Apollo/ZoomInfo/Clay stack — start at $250–500 a month before a single email is written, and the cold-email AI market that has exploded over the past two years runs $25–149 a month for features that are, at their core, web scraping plus a language model turning research into copy — a combination GMass’s testing identified some time ago, noting that the “AI research” in personalization tools is mostly ordinary scraping with GPT doing the prose. Harvey’s pitch is that if the model is already in your subscription and the scraping is free, the entire margin of that industry evaporates.

First, the name

A word on nomenclature, because it will confuse everyone exactly once. This Harvey has nothing to do with Harvey the legal-AI company — the Sequoia- and OpenAI-backed platform used by 200,000 lawyers across 3,500+ customers, which is itself named after neither. All three trace back, presumably, to the invisible six-foot rabbit that befriends Elwood P. Dowd in the 1950 film — though the repo’s actual epigraph is from a different, harder-nosed piece of American sales cinema: Glengarry Glen Ross’s Blake, telling someone to put their coffee down because coffee is for closers. The Harvey.ai legal platform and the Harvey sales agent will collide in search results for years. The rabbit, presumably, is fine with it.

The model is the expensive part, so use it almost never

The genuinely interesting engineering in this repo is not the subscription trick — that’s a business-model insight. The interesting engineering is the discipline around when the model gets invoked at all. Harvey’s stated philosophy is blunt: if something can be gotten deterministically, don’t use a model.

Concretely: the agent runs a heartbeat loop — wake, check budget, decide, act, log, sleep, default fifteen minutes — and the decision of what to do next is not a model call. It’s a fixed priority order over four pipeline counts: handle replies, then send campaigns, then write them, then prospect, then idle. Asking a language model “what should I do now?” when the answer is derivable from four integers is the kind of thing that makes subscription-backed agents economically impossible, and Harvey treats it as a bug in the genre.

The same discipline runs through the pipeline. The profiling stage — reading a business’s homepage, robots.txt, sitemap, team and careers pages — is three HTTP requests and regex over HTML already in hand. No browser, no model. Out of that comes the incumbent marketing agency (scored by footer-credit wording, with confidence thresholds below which nothing is recorded, because a wrong agency named in a cold email is worse than silence), the ad pixels, the missing schema markup, the abandoned blog, the open roles. The pre-send gate that rejects banned phrases, over-length emails, unrendered merge tags, and non-deliverable addresses is deterministic code. The model is reserved for the parts that actually need judgment: scoring prospects, writing the email, handling the reply.

This is the boring part, and it’s where the value is. The entire “runs on a subscription” premise only holds because most of the agent’s work was never model work to begin with.

Every fact is a row

The data model deserves its own paragraph, because it’s the piece most likely to outlive the agent. Harvey stores everything in SQLite under a single governing idea: every fact is a row, never a column. Not companies.has_agency — an observation row carrying the signal code, the value, a confidence score, an evidence URL, and a timestamp. A database trigger rejects any signal code not in a governed vocabulary, so a typo fails loudly instead of quietly inventing junk data.

Four consequences fall out, and the README is honest that they’re the point. New signals need no migration. Confidence and provenance travel with the fact instead of being lost on overwrite. A cohort of prospects becomes a SQL query rather than a list an application stitched together. And — the compounding one — the same signal observed quarterly is a time series. “They dropped their agency last quarter” is a better outreach trigger than any static fact, and the repo’s own philosophy section says the quiet part: the database is the asset, not the agent. The initial list is worth little; the longitudinal record of who changed agencies, who started spending on ads, who let their content go stale is worth a great deal.

Sales knowledge as editable Markdown

Where most agents in this space reach for fine-tuning, vector stores, or retrieval pipelines, Harvey’s sales knowledge is a directory of plain Markdown files — email frameworks, objection handling built on the LAARC loop, qualification via BANT and MEDDIC, offer strategy — concatenated directly into each sub-agent’s prompt before it runs. Edit a file and the next heartbeat behaves differently. No restart, no retraining, no embedding refresh.

It sounds primitive, and in a sense it is. But it’s also the correct primitive for the audience: the person best qualified to fix a pushy email sequence is the seller, not a machine-learning engineer. The repo ships a 301-line email frameworks file that opens with the only rule that matters — write like a real person — and enforces it with a hard ban list of AI tells (“I hope this finds you well,” “circling back”) that the deterministic pre-send gate also checks. The five sub-agents (scout, writer, sender, handler, analyst) each get a different slice of the library, defined in one editable map.

The paranoia is the feature

The most over-engineered section of the README — and I mean that admiringly — is the Codex provider support. Because Harvey’s prompts contain untrusted text (scraped pages, prospect replies), the model must have nothing to act with. The lockdown is exhaustive: every tool-providing feature disabled, web search off, sub-agents off, hooks and skills and project instructions off, a read-only sandbox as belt-and-suspenders, and then verification — Harvey interrogates Codex’s own reports of its effective configuration before sending anything, and any attempted tool call mid-turn kills the runtime. It refuses newer Codex CLI versions on principle, because a different Codex could add tools the lockdown doesn’t know about. It starts Codex once without your login to verify requests would go only to OpenAI’s endpoint, and hands the runtime a credential copy stripped of its refresh token.

This is one of the more serious prompt-injection defenses you’ll find documented in an open-source consumer tool, and its existence is an admission of the real threat model: an agent that reads the internet and sends email is an agent one malicious footer away from doing something regrettable.

The same defensive posture shapes the human-facing side. Every outgoing email waits for approval by default, presented one at a time in a deliberately asymmetric UI — because a wall of stacked drafts invites an approve-all reflex, which is exactly the reflex the approval ladder exists to break. There’s a kill switch, quiet hours, spend caps, a bounce-rate threshold that trips automatically, and a legal section that opens with the number $53,088 — the per-email CAN-SPAM penalty — before walking through GDPR legitimate interest, bot disclosure, and a deliverability warmup regime. The roadmap explicitly refuses an autonomous AI cold-dialer, citing FCC rules on artificial voices with uncapped per-call penalties. Whatever one thinks of cold email as a practice, this is a repo that has thought about the ways it goes wrong.

Where it sits, and where it’s thin

Context matters here. Salesforce’s guide to AI sales agents frames the category around reps spending only 28% of their time selling; Rox’s market overview cites Gartner’s projection that a quarter of B2B sales organizations will run at least one autonomous agent in core revenue processes by 2027, up from under 5% in 2024. The commercial field is crowded — Snov’s roundup alone compares ten tools — but nearly all of them are SaaS platforms with per-seat or per-email pricing, CRM integrations, and vendor-hosted models. Harvey is the open-source, local, flat-cost counter-position, aimed squarely at the segment those tools serve worst: small local businesses with 5–50 people, where the README claims single-provider contact coverage caps around 30%.

The limits are visible and mostly self-reported, which is to the repo’s credit. The free default discovery source, OpenStreetMap, maps premises rather than businesses, so entire trades are nearly absent — under 2,000 roofers in the whole US — and Harvey says so in the UI rather than quietly under-delivering. The subscription trick itself sits in a terms-of-service gray zone: the README tells you to check your provider’s terms, which is the polite way of acknowledging that neither Anthropic nor OpenAI designed these plans to be an agent’s brain. The Codex support is macOS/Linux only, pinned to one exact CLI version, and carries several seconds of verification overhead per call. And at version 0.2.1, from what appears to be a single maintainer, this is a young project — 242 tests and unusually thorough documentation, but young.

The deeper criticism isn’t technical at all. Every tool in this genre — Harvey included — is engaged in the same arms race: making unsolicited email slightly more specific so it clears the spam filters that exist because of unsolicited email. Harvey’s answer is that its personalization is grounded in real, checkable observations, that disqualification criteria matter more than qualification, and that a prospect list you can’t explain is a list you shouldn’t send to. That’s a more defensible position than most of the market’s. It is not a philosophical solution to cold email.

The bet

Strip away the sales domain and what remains is an architectural argument that applies well beyond it: subscription-backed CLIs changed the cost curve of always-on agents; deterministic code should absorb everything derivable; untrusted input demands a model with no hands; and longitudinal observation data compounds in a way that agent cleverness doesn’t. If the argument is right, expect to see the pattern — subscription brain, deterministic skeleton, observation store, approval ladder — copied into domains that have nothing to do with closing. Coffee, after all, is for closers. But the infrastructure that gets them there turns out to be worth reading about on its own.