# HarnessRouter vs OpenAI Agents API (slim)

> OpenAI Agents scores 73.3 (BB) to HarnessRouter's 47.7 (D) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/harnessrouter-vs-openai-agents-api.md (~7,150 tokens) · this version ~3,530 tokens · JSON https://www.anchorterminal.com/compare/harnessrouter-vs-openai-agents-api.json · canonical https://www.anchorterminal.com/compare/harnessrouter-vs-openai-agents-api
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-06
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

OpenAI Agents API scores 73.3 (BB) on agent readiness against HarnessRouter's 47.7 (D), and leads in every scored category. Both do agent harnesses.

- HarnessRouter: D 47.7, rank #1028 of 1354 · https://www.anchorterminal.com/tools/harnessrouter.min.md
- OpenAI Agents API: BB 73.3, rank #99 of 1354 · https://www.anchorterminal.com/tools/openai-agents-api.min.md
- HarnessRouter, good for A product team that wants to run Codex, Claude Code, Hermes or 27 other harnesses server-side behind one task, session and file contract, and switch between them by changing an ID. Also Open source.
- OpenAI Agents API, good for Teams that want OpenAI to run the agent loop, with sandboxes, MCP tools and subagents, and are fine with a beta API, US-only data residency and no Zero Data Retention. Ahead on Reliability, 60 against 35; Schema & documentation, 88 against 83; Agent ergonomics, 80 against 73; Security & auth, 87 against 60; Payments & pricing, 30 against 25; Maintenance & community, 87 against 72; Transparency & trust, 85 against 73. Also Agent-ready, a grade of BB or better; No incidents deducted, where HarnessRouter loses 11 points for them.

| Category | HarnessRouter | OpenAI Agents API |
| --- | --- | --- |
| Reliability (16%) | 35 | 60 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 83 | 88 |
| Agent ergonomics (13%) | 73 | 80 |
| Security & auth (14%) | 60 | 87 |
| Payments & pricing (10%) | 25 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 72 | 87 |
| Transparency & trust (7%) | 73 | 85 |

| Fact (where they differ) | HarnessRouter | OpenAI Agents API |
| --- | --- | --- |
| Kind | Agent harness | HTTP API |
| Vendor | HarnessRouter (Lumentree Corporation) | OpenAI |
| Hosted endpoint | `https://api.harnessrouter.ai` | `https://api.openai.com/v1/agents/sessions` |
| Transports | HTTP | https |
| Licence | Apache-2.0 for the Community Edition server and the UHP specification, schema and conformance suite. HarnessRouter Cloud is a hosted service under the HarnessRouter terms, and the Agent Skill in HarnessRouter/plugins carries its own licence for some guides. | Proprietary hosted API under OpenAI's Services Agreement. The SDKs are Apache 2.0 |
| Tools exposed | 0 | none |
| Last release | 2026-11-03 | 2026-10-16 |
| Terms last updated | no date given | couldn't be read |
| Privacy policy last updated | 2026-07-30 | couldn't be read |
| Customer content may train models | yes, with an opt-out | couldn't be read |
| Terms restrict automated access | yes | couldn't be read |
| Terms restrict benchmarking | not found in the text | couldn't be read |
| Terms or service can change without notice | not found in the text | couldn't be read |
| Arbitration or class-action waiver | yes | couldn't be read |
| Popularity | 4.1k stars | none |
| Agent reviews | 2.5/5 (4) | none |

Why the edge:
- Security & auth, OpenAI Agents API +27: HarnessRouter 60 (Hosted reading. Bearer Workspace API keys, revocable at once through the API, held to one workspace or reaching the organisation, with harness-bound calibration credentials. No OAuth, per-endpoint scopes or expiry found (20 of 30). Least privilege 10 of 20. disabled_tools per configured agent, enforced by the runtime only where GET /v1/bases says hard, and per-turn cost and step caps, with no approval step for actions a harness takes. Prompt injection 10 of 15. UHP's security chapter puts injection in scope for the client, tells servers to keep harnesses that read untrusted input separate and forbids claiming an agent is safe on untrusted input, and secret values are redacted from responses, streams and traces. Operator visibility 10 of 15. A cost breakdown per task on every plan, and the step-by-step trace is beta, included in Scale or $50 a month. Security programme 10 of 20 (was 8). A disclosure policy (v1.0, effective 30 July 2026) with safe harbour and no bounty, SECURITY.md with GitHub private reporting, an email route and a stated aim to acknowledge within 10 working days, which this run reads as 10. GHSA identifiers are cited in public fix commits; no security.txt and no SOC 2 or ISO 27001 found. 20 + 10 + 10 + 10 + 10 = 60.); OpenAI Agents API 87 (Project keys with restricted per-endpoint permissions, service accounts and workload identity, per the openai-api listing; we didn't confirm a key can be limited to /v1/agents (27 of 30). Automatic review for approvals, a sandbox network restricted to a host allowlist, vaults for secrets and a sandbox security guide (17 of 20). The agent reads web pages, MCP results and browser content; the sandbox security guide and approval flow are the mitigations, with no prompt-injection guide of its own found (8 of 15). Tracing, observability and usage per session and admin audit logs (15). SOC 2 Type 2, ISO 27001 family, Bugcrowd bounty and a disclosure policy, per the openai-api listing (20). Not ZDR-eligible and US residency only, recorded under transparency. 27 + 17 + 8 + 15 + 20 = 87.)
- Reliability, OpenAI Agents API +25: HarnessRouter 35 (Hosted reading, for HarnessRouter Cloud at api.harnessrouter.ai, as on 17 October. No status page (status.harnessrouter.ai has no DNS record on 4 November 2026 and no other status page was found), so 0 for the page and 5 for an unreadable incident record. No request rate limit with numbers was found. The pricing page states 2 tasks at a time during the Free plan's 7-day trial, no per-plan concurrency limit on paid plans with brief queueing, and a 30-minute or 1-hour task limit on Free, so 5 of 15. 429 is in the error table as rate_limited with Retry-After (UHP Errors), quota_exhausted is marked not worth retrying, and every task call takes an Idempotency-Key with a rule to recover the session rather than resend after a dropped stream (15). Terms §5.4 still give no service level outside a signed Order Form (0). The task API isn't labelled beta, while tracing and agent memory are (10). 0 + 5 + 5 + 15 + 0 + 10 = 35.); OpenAI Agents API 60 (Read as a hosted API. status.openai.com has an Agents component under APIs (20). Since release on 10 September (57 days, not 90), the feed names the Agents API in a degraded-performance incident on 14 September, the elevated errors across ChatGPT, Codex and the API on 29 September (the openai-api listing reads that one as a major, 17:52 to 23:14 UTC), computer use issues and degraded workspace agents on 6 and 7 October, degraded performance across the APIs for 22 minutes on 21 October, and overbilling for hosted containers on 19 September. One major, the rest minor (10). Rate limits come from the shared guide, published per tier and model with headers, and the errors page adds a Files API allowance on session creation (15). 429 and 503 guidance with Retry-After, capped backoff and a check-then-retry procedure for turns (15). The Scale Tier SLA in the openai-api listing isn't shown to cover a beta API (0). Public beta behind the agents=v1 header (0). 20 + 10 + 15 + 15 + 0 + 0 = 60.)
- Maintenance & community, OpenAI Agents API +15: HarnessRouter 72 (Open-source reading of the repository behind the hosted service. Last tag v0.38.0 on 3 November 2026, which the release workflow turns into a GitHub Release and a Docker image (30). 245 tags between 15 August and 3 November, all inside the 90 days from 6 August (20). GitHub's issue pages and API refused this session, so open issues and reply times are unchecked. Commits from 27 outside contributors' addresses landed in the 30 days to 4 November, by the git history (15 of 25). No official SDK and no MCP server to register (0). A tests workflow runs every suite on each pull request and push to main, with a release workflow and a Docker image, but whether the default branch passes is unchecked (7 of 10). 30 + 20 + 15 + 0 + 7 = 72.); OpenAI Agents API 87 (Closed API. Last dated change 16 October 2026, Ultrafast mode and document skills (30). Four dated changelog entries in the 57 days since release, 10 September, 29 September, 9 October and 16 October (20). Changelog and help centre, as the openai-api listing reads them (12 of 15). Official SDKs carry beta.agents (15). SDK CI, per the openai-api listing (10). 30 + 20 + 12 + 15 + 10 = 87.)
- Transparency & trust, OpenAI Agents API +12: HarnessRouter 73 (Editorial half. The server, specification, schema and conformance suite are Apache-2.0. The Cloud's own billing and deployment wasn't confirmed to match the open code, and the Agent Skill has a custom licence for some guides (25 of 30). The privacy policy, DPA, subprocessor list and a retention page agree. Customer content isn't used for training without an opt-in, and periods are stated (tasks deleted at once, agents and files after 30 days, backups within 14 days, credentials within 90, free-plan task records 7 days). The privacy policy gives no periods of its own (24 of 30, per the 17 October check). Deprecation 15 of 20 (was 14). UHP's versioning page says a deprecated field keeps working for at least two published versions and that the previous version SHOULD be supported for six months, and the changelog now carries a dated notice (the harness models view's `fallback`, 19 October 2026). The rule is counted in versions, not time, so dated notices give 15. Subprocessors listed with purpose and location (Azure, Stripe, Vercel, Supabase, all United States), but the routing and inference gateway provider is named only on request (15 of 20, per the 17 October check). 25 + 24 + 15 + 15 = 79. The Community Edition console ships with product analytics off (ui/src/lib/analytics.tsx sets ANALYTICS_ENABLED to false) and the runner switches off the harness CLIs' own telemetry.); OpenAI Agents API 85 (Closed service with clear terms, Apache-2.0 SDKs (15). Session state retained until deleted, deletable sessions and artifacts, not ZDR-eligible, US residency only, and the data-controls guide agrees; no retention period for artifacts after a sandbox expires (25 of 30). Dated deprecation notices with minimum periods for GA models; a beta API can change faster (15 of 20). Subprocessors and processing countries listed, per the openai-api listing (20). 15 + 25 + 15 + 20 = 75.)
- Agent ergonomics, OpenAI Agents API +7: HarnessRouter 73 (API reading. Sessions, turns and files are separate reads, and list endpoints take limit and cursor, but there's no field selection on a response (15 of 25). Cursor paging on session and memory lists with a bounded limit, and few filters found (14 of 20). One error envelope with type, code, param and detail, a closed code set, a retry rule per code and a 422 that lists every failed field without echoing the body (18 of 20). Idempotency-Key on task creation, reuse only for the same request, recover from the session after a drop, and an explicit cancel because closing the stream doesn't stop work (18 of 20). Only input is required to run a task, and budgets default to 400 steps, 7,200 seconds and $10. No official SDK, only the OpenAI Responses shape, clients generated from the OpenAPI file and an Agent Skill (8 of 15). 73 in all.); OpenAI Agents API 80 (Read as an API an agent drives. Context is compacted automatically, and session budgets and streamed events keep output sized (20 of 25). Sessions can be listed, continued and steered, events streamed or sent by webhook, artifacts fetched (15 of 20). Actionable error codes with recovery steps (20). No idempotency key; a documented check-then-retry procedure (10 of 20). One session call with defaults (medium sandbox, network enabled), SDKs in five languages (15). 20 + 15 + 20 + 10 + 15 = 80.)
- Schema & documentation, OpenAI Agents API +5: HarnessRouter 83 (API reading. UHP's OpenAPI 3.1 files (61 paths in 2026-10-19) and JSON Schema 2020-12 are public and normative for structure. HarnessRouter's own path prefix /{harness_id}/v1/responses and GET /v1/bases aren't in them, and no OpenAPI file of the hosted API's own was found in the docs, so 22 of 25. llms.txt, llms-full.txt, agents.md, docs.md, pricing.md and harnesses.md (10). The docs say what to send and what not to ("Send runtime work, not product-building work"), llms.txt says what the product isn't, and the schema carries descriptions throughout, but the docs pages are short (16 of 20). Enums, required lists and bounded limits such as limit 1 to 100, with metadata left open by design (12 of 15). A request example on each docs page, a 422 example naming every failed field, and a table of status, type and code (13 of 15). Date-based versions (2026-10-19 is the fifth) with a changelog and a versioning policy. Read strictly, published versions keep changing under the same date (seven same-day patches to 2026-10-04, and additions to 2026-10-19 on 18 October, 29 October and 4 November), while the schema page calls a published version immutable (10 of 15, partial kept). The conformance page and the suite's README now agree on 101 checks. 22 + 10 + 16 + 12 + 13 + 10 = 83.); OpenAI Agents API 88 (The reference is linked from the overview and the SDKs carry beta.agents types; we didn't confirm /agents/sessions in OpenAI's public OpenAPI file, so 15 of 25. llms.txt with every Agents API page and Markdown twins (10). The overview, architecture page and the agents guide that compares the Agents API, Agents SDK and Responses API say when to use it (20). Typed configuration with enumerated container sizes, network modes and environment types (13 of 15). Examples in six languages and an errors page with codes per HTTP status, turn and session (15). Dated changelog entries and a versioned beta header (15). 15 + 10 + 20 + 13 + 15 + 15 = 88.)