Skills teach.MCP connects.HCP installs.
HCP is the open standard for installing a capability into any agent harness. A three-file pack describes a CLI you already ship, and the runtime checks the caller, mints a credential per call, sandboxes the command and holds risky writes until a person agrees.
hcpx init weather --class public-readhcpx install ./packs/ledger --json{ "ok": true, "pack_id": "ledger", "issues": [] }hcpx activate ledger && hcpx availability ledgerinstalled ✓ activated ✓ connected ✓ executable ✓hcpx exec ledger transfer --json -- amount=2.80 \ payee=demo-transitrefused until a person agrees{ "ok": false, "code": "confirm_required", "preview": { "cli": "ledger transfer 2.80 --to demo-transit --confirm" } }hcpx exec ledger transfer --json -- amount=2.80 \ payee=demo-transit confirm=true{ "ok": true, "result": { "receipt": "r-280-demo-transit", "balance_after": "139.70" } }
Works in Claude Code · Cursor · Codex · OpenCode · any MCP client
A pack is three files.
It holds no secrets, tenant ids or server process, so the same folder installs unchanged into a coding agent, a product runtime or CI.
surface.jsonWhat it can do
The pack id, how credentials are minted, and each command with its CLI form and arguments.
policy.jsonWhat each command may touch
Read or write, where data may land and whether a person has to agree first, in one row per command.
HARNESS.mdHow to use it well
One screen for the agent: the hot path, an example per command and the mistakes to avoid. Every host turns it into a Skill.
{
"id": "ledger",
"binding": { "mode": "local", "hub": "local-credential" },
"verbs": {
"transfer": {
"description": "Pay a saved payee. Refused until a person confirms the amount and payee.",
"cli": ["ledger", "transfer", "{{amount}}", "--to", "{{payee}}", "--confirm"],
"args": { "required": ["amount", "payee"] }
}
}
}{
"verbs": {
"transfer": {
"operation": "write",
"privacy": { "land": "local" },
"confirm": "always"
}
}
}| `transfer` | `ledger transfer 2.80 --to demo-transit --confirm --json` | write + confirm |
Pay in two steps: call `transfer` without `confirm`, show the user the
`preview` (amount, payee, memo), and pass `confirm=true` only after they
agree to those values.
## Anti-patterns
- Calling `transfer` with `confirm=true` before the user approved that exact amount and payee.
- Guessing a payee id; look it up with `payees`.One command, the same rules for every caller.
A person at a terminal, a coding agent and a button in your product all pass the same six gates, in a fixed order, before your CLI runs. The runtime records who did what.
- 01
Principal
Who is asking: a person, an agent acting for one, or a service.
- 02
Grant
Whether that caller may run this command in this workspace.
- 03
Confirm
Whether a person has to agree before the command runs.
- 04
Mint
A credential the runtime's hub creates for this call alone. The pack never holds it.
- 05
Adapter
How the command runs: your CLI, an HTTP call, or an in-process driver.
- 06
Sandbox
Where it runs and which hosts it may reach.
Secrets never live in a pack
A pack names only a credential mode, and the runtime fails closed when it cannot mint the credential.
Writes wait for a yes
A write marked confirm runs only after a person agrees, whether an agent, a button or a terminal sent it.
Hosts never grow tool lists
A tenth pack changes what the agent's one tool can reach and leaves the host configuration alone.
Install it where you work.
Your agent gets one Skill and one tool named hcp, which reaches every pack you activate with its Policy, credentials and sandbox intact.
Set up HCP in this repository. Follow https://harnesscontextprotocol.io/setup.md exactly and report what you changed.
Installs the CLI, activates packs, adopts into the agent you are using, and verifies with a read. Read the runbook
Wrap the `<your-cli>` command as an HCP pack. Follow https://harnesscontextprotocol.io/wrap.md exactly and show me the proof.
Checks the CLI is agent-ready, names its commands, writes Policy and the Skill, lints, and proves it. Read the runbook
The agent follows a runbook on this site and stops where a person has to decide; if it carries on, the runtime still refuses risky writes.
Read the runbook