Crush vs HarnessRouter

Crush

Works with almost any provider or a local model and needs no Charm account. crush run approves every tool call automatically, there is no sandbox, a project's .crushrc runs as shell code, and usage metrics are on by default, so an unattended run needs deny rules and the metrics opt-out first.

HarnessRouter

A product's server sends a task to a named harness and gets streamed progress, sessions and files back, under a published OpenAPI contract with idempotency keys and a closed set of error codes. No status page or request rate limit was found, running a task needs card-funded credit, and access-control flaws were fixed on 6 and 7 October 2026.

Crush

1. Add permissions deny rules or a PreToolUse hook before crush run. It approves every permission request in its session
2. Read .crushrc, crushrc and crush.json in a cloned repository before running Crush there. They execute as shell code at startup
3. Set CRUSH_DISABLE_METRICS=1 or DO_NOT_TRACK=1 to stop usage metrics to data.charm.land
4. Wrap crush run in your own timeout. It has no turn, time or cost limit flag
5. Configure a provider by environment variable or crushrc first. With none, crush run exits with an error asking for interactive setup

HarnessRouter

1. Name the harness yourself. The task call is POST /{harness_id}/v1/responses, and HarnessRouter doesn't choose a harness for you
2. Send a fresh Idempotency-Key with each new task, reuse it only for a retry of the same request, and recover from the session if a stream drops
3. Call cancel to stop work. Closing the SSE connection leaves the agent running and billing
4. Keep the Workspace API key on the server. The docs forbid calling the API from a browser with it
5. Check each tool's enforcement in GET /v1/bases. On bases marked instruction, disabled_tools is a request to the model, not a block