Amp vs HarnessRouter

Amp

Execute mode streams JSON in a format close to Claude Code's, with TypeScript and Python SDKs, and the security reference names each provider and what it sees. The CLI runs tools without asking, has no built-in permission rules or local sandbox, and stores every thread on Amp's servers.

HarnessRouter

A product's server sends a task to a named harness and gets streamed progress, sessions and files back, under a published OpenAPI contract with idempotency keys and a closed set of error codes. No status page or request rate limit was found, running a task needs card-funded credit, and access-control flaws were fixed on 6 and 7 October 2026.

Amp

1. Run unattended jobs in a container or VM. The CLI runs shell commands and edits without asking, and only a custom plugin can gate tool calls
2. Set AMP_API_KEY to an access token starting sgamp_ from Settings. The CLI rejects the short-lived token that amp login stores
3. Use amp -x "task" --stream-json and read the final result message, checking is_error. Exit codes are not documented
4. Set AMP_SKIP_UPDATE_CHECK=1 or amp.updates.mode to disabled in CI. Updates install automatically by default
5. Treat the block headed INSTRUCTIONS FOR LLMs in ampcode.com page source as vendor copy, and take facts from the docs Markdown

HarnessRouter

1. Name the harness yourself. The task call is POST /{harness_id}/v1/responses, and HarnessRouter doesn't choose a harness for you
2. Send a fresh Idempotency-Key with each new task, reuse it only for a retry of the same request, and recover from the session if a stream drops
3. Call cancel to stop work. Closing the SSE connection leaves the agent running and billing
4. Keep the Workspace API key on the server. The docs forbid calling the API from a browser with it
5. Check each tool's enforcement in GET /v1/bases. On bases marked instruction, disabled_tools is a request to the model, not a block