kcp-harness — KCP compliance proxy MCP server

kcp-harness

🧾 See it run — interactive KCP playground · read the reveal

Deterministic knowledge governance for any AI agent.

Your agent can read every file in your project. Can it prove why it read what it read?

KCP Harness is an MCP compliance proxy that sits between an AI coding agent and its tools. It intercepts knowledge-related calls, routes them through the kcp-agent deterministic planner (14-gate cascade, no LLM), and produces compliance artifacts — decision traces, audit logs, budget ledgers — as a side effect of normal agent operation.

The agent can't bypass governance because it only talks to the proxy's MCP interface. The proxy decides what knowledge is accessible, tracks spend, and logs every decision. Fail-closed: if the harness can't verify a request, the agent gets nothing.

Agent (Claude Code / Cursor / Copilot / Windsurf / Cline / Crush / OpenClaw / ...)
  │
  │  MCP tool call
  v
┌─────────────────────────────────────────────────────────┐
│  kcp-harness                                            │
│                                                         │
│  classify → govern (14 gates) → execute → audit         │
│                                                         │
│  Side outputs:                                          │
│  · Decision traces     (per-request, deterministic)     │
│  · Audit log           (append-only JSONL)              │
│  · Budget ledger       (itemized, ceiling-enforced)     │
│  · Temporal drift      (plan validity over time)        │
│  · Approval tickets    (named-human sign-off, durable)  │
│  · Confidence verdicts (post-synthesis gate)            │
└─────────────────────────────────────────────────────────┘
  │
  v
Knowledge manifests (knowledge.yaml)

Documentation →

Why

Enterprises need agents that are defensible — auditable, reproducible, budget-controlled, temporally pinned. Today's agents can't prove why they read what they read. The harness adds a compliance layer without replacing the agent.

You sell the compliance layer. The agents are pluggable.

Install

npm install -g kcp-harness

Or use without installing:

npx kcp-harness --help

Native executables

Pre-built binaries (no Node/Deno required) for Linux x64/arm64, macOS x64/arm64, and Windows x64 — grab them from a release. To build one yourself:

npm ci && npm run build
deno compile --allow-read --allow-env --allow-net --allow-run \
  --node-modules-dir=auto --output kcp-harness dist/cli.js

Quick start

1. Initialize

kcp-harness init          # creates harness.yaml

2. Generate agent integration

kcp-harness integrate claude-code    # or: pi, cursor, copilot, windsurf, cline, continue, crush, openclaw

3. Start coding

Your agent now routes knowledge access through the harness. Every decision is logged.

Supported agents

Shortened. The full README is on GitHub.