Harness Overview
Polygent Code is the built-in agent runtime used by sessions; operators select a model and control the context, tools, delegation, and safety policy available to it. For model credentials and availability, see Models & Backends.
Core capabilities
The harness combines the controls that determine what an agent can know and do.
| Capability | Operator use |
|---|---|
| Skills | Publish reusable instruction packs and restrict which sessions can load them. |
| Subagents | Define named helpers with bounded models, tools, and MCP access. |
| MCP Server | Expose approved Polygent tools and connect configured MCP servers. |
| Memory | Preserve workspace knowledge across sessions. |
| AI Cost Budgets | Apply global, workspace, and ticket cost limits. |
| Tool controls | Limit file, command, web, skill, subagent, and MCP capabilities by session source. |
| Bash policy | Reject commands matching administrator or repository deny rules. |
The model selector is a single list. Operators do not install or select a separate agent provider.
User settings
User settings control default context loading, delegation, web access, and guard behavior for Polygent Code sessions.
Open Dev Tools → Polygent Code → User Settings. The tab requires administrator access or Manage Polygent Code User Settings.
Context loading
Context loading controls which managed sources are added automatically.
| Setting | Effect |
|---|---|
| Repository instruction files | Loads supported repository instruction files when present. |
| Workspace memory | Loads workspace memory automatically. Agents can still use permitted memory tools on demand. |
| Selected skills | Exposes the skills selected by the session source. Turning this off exposes no managed skills. |
Capabilities
Capability defaults control delegation and web retrieval without overriding stricter administrator restrictions.
| Setting | Values | Effect |
|---|---|---|
| Built-in subagent behavior | Auto-assign, disabled, always general, always explorer | Selects which built-in helper is exposed by default. The effective helper remains bounded by the parent session's capabilities. |
| Custom subagents by default | On/off | Permits selected custom subagents to be exposed. |
| Web access behavior | Allow, ask first, block | Controls direct web retrieval. Use Block when outbound web access is prohibited. |
Safety
Safety settings determine how untrusted content and large operations are handled.
| Setting | Values | Effect |
|---|---|---|
| Read/write guard strictness | Standard, strict | Strict mode requires an existing file to be read before it can be overwritten. |
| Prompt-injection guard behavior | Warn, block | Warn marks suspicious external content; block prevents that content from entering the agent context. This is defense in depth, not a substitute for least privilege. |
| Large-read behavior | Truncate near context limit, always truncate, refuse near context limit | Controls whether large reads are shortened or rejected as context fills. |
Tool and MCP scoping
Tool scoping limits the capabilities exposed by bots, templates, automations, and subagents.
- Unrestricted means all currently enabled entries in that category.
- An explicit empty selection means none.
- A non-empty selection exposes only the selected entries.
- Built-in subagents may still be available according to the configured built-in behavior and the parent session's capabilities.
- Workspace capability limits can only reduce a session's effective capabilities.
Use the narrowest set required. In particular, grant command execution, file writes, web access, and write-capable MCP tools only to trusted session sources.
Bash command policy
The Bash policy is a global denylist that rejects matching commands before execution.
Open Settings → Bash Permissions with Manage Settings permission. Each rule contains a pattern and an operator-facing reason.
| Pattern form | Example | Behavior |
|---|---|---|
| Substring | git stash | Case-insensitive match anywhere in the command. |
| Glob | git stash* | * and ? act as wildcards. |
| Regular expression | /^rm\s+-rf/ | Case-insensitive regular expression enclosed by /. |
Repository-level Claude Code permissions.deny rules are also honored when present. A command matching either source is blocked. An empty administrator list does not make command execution safe; use tool restrictions to remove Bash when it is not required.
MCP network boundary
The MCP endpoint is a privileged agent integration surface protected by temporary, server-issued run credentials.
Each credential is bound to the launching identity, session, workspace, and effective tool grants. Direct endpoint calls cannot widen those limits, workspace membership changes are rechecked, and ending a session invalidates only that session's credentials. Restrict /mcp to trusted worker networks and require TLS as defense in depth. See MCP Server security.
Troubleshooting
Use this sequence to isolate common harness configuration failures.
| Symptom | Check |
|---|---|
| A skill or subagent is missing | Confirm it is enabled, selected by the session source, allowed by User Settings, and permitted by workspace capability limits. Start a new session after changing selection. |
| A tool is unavailable | Check the session source, workspace capability limits, User Settings, and subagent tool selection. An explicit empty selection allows no tools. |
| Bash is rejected | Review the error reason, global Bash policy, and repository permissions.deny rules. |
| Web retrieval is unavailable | Check Web access behavior and the effective tool selection. |
| The agent loses earlier context | Reduce large inputs, select a model with sufficient context, and review large-read behavior. |
| A remote worker cannot use Polygent MCP tools | Verify the configured MCP URL is reachable from the worker and that /mcp is allowed through the network boundary. |
| A run stops unexpectedly | Check session messages, system logs, and budget enforcement. |