← all repositories
DenisSergeevitch/agents-best-practices

Your Agent Needs a Harness, Not Just a Prompt

A provider-neutral skill that stops your agent from becoming an unaudited operator by rigorously defining the runtime harness around every tool proposal.

agents-best-practices
Velocity · 7d
+6.4
★ / day
Trend
accelerating
star history

What it does This repository packages architectural best practices as an Agent Skill compatible with Codex and Claude Code. It provides a structured reference for designing the control plane around an agent: the loop that builds context, calls the model, validates tool proposals, checks permissions, executes or pauses for approval, and returns structured observations. It also generates domain-specific MVP blueprints and audits existing harnesses for brittleness, cost, and safety gaps.

The interesting bit The insight is that most agent failures are runtime-level, not prompt-level. The skill treats the model as a mere proposer and insists that application code—budgets, schema validators, permission checks, and audit trails—does the actual acting. It even codifies how context compaction should rehydrate active state like approvals and plans instead of just summarizing chat history.

Key highlights

  • Provider-neutral design works across OpenAI, Anthropic, and compatible APIs.
  • Fifteen reference documents cover everything from loop invariants and risk-classified tool permissions to prompt caching and launch checklists.
  • Emphasizes narrow typed tools with structured results over generic send_message or execute_anything wrappers.
  • Includes concrete MVP blueprints for domains like sales, support, and operations, not just coding tasks.
  • Stresses that draft and commit are separate: high-risk side effects require approval records stored outside the prompt window.

Caveats

  • It is a reference and audit framework, not a runtime authorization layer or sandbox in itself.
  • Not a multi-agent framework by default; it focuses on single-agent harness discipline first.
  • The actual safety guarantees still depend on your external authorization, audit logs, and infrastructure.

Verdict Worth installing if you are building or reviewing any agent that will read CRMs, draft emails, or trigger deploys. Skip it if you are looking for a drop-in execution framework or prompt-only security fixes.

Frequently asked

What is DenisSergeevitch/agents-best-practices?
A provider-neutral skill that stops your agent from becoming an unaudited operator by rigorously defining the runtime harness around every tool proposal.
Is agents-best-practices open source?
Yes — DenisSergeevitch/agents-best-practices is open source, released under the MIT license.
How popular is agents-best-practices?
DenisSergeevitch/agents-best-practices has 2.1k stars on GitHub and is currently accelerating.
Where can I find agents-best-practices?
DenisSergeevitch/agents-best-practices is on GitHub at https://github.com/DenisSergeevitch/agents-best-practices.

heatdrop uses Google Analytics to see which pages get read — nothing else. Your call. How we handle data.