HarnessRouter vs Mirror CLI

HarnessRouter

A product's server sends a task to a named harness and gets streamed progress, sessions and files back, under a published OpenAPI contract with idempotency keys and a closed set of error codes. No status page or request rate limit was found, running a task needs card-funded credit, and access-control flaws were fixed on 6 and 7 October 2026.

Mirror CLI

Mirror CLI is Apache-2.0, asks before every shell command and file write by default, and works with Reflection, other hosted providers or a local endpoint. It is a one-day-old 0.1.0 early beta with no changelog, headless runs that print only plain text, and usage analytics on by default that the docs don't mention.

HarnessRouter

1. Name the harness yourself. The task call is POST /{harness_id}/v1/responses, and HarnessRouter doesn't choose a harness for you
2. Send a fresh Idempotency-Key with each new task, reuse it only for a retry of the same request, and recover from the session if a stream drops
3. Call cancel to stop work. Closing the SSE connection leaves the agent running and billing
4. Keep the Workspace API key on the server. The docs forbid calling the API from a browser with it
5. Check each tool's enforcement in GET /v1/bases. On bases marked instruction, disabled_tools is a request to the model, not a block

Mirror CLI

1. Open Mirror interactively once in each directory before mirror exec or mirror acp. Both refuse to run until the usage and folder notices are accepted
2. Pass --approval-mode auto to mirror exec only inside a container or VM. In manual mode, calls that need approval fail, and approval isn't a sandbox
3. Set --max-iterations on unattended runs. Turns are unlimited by default
4. Check the result with your own tests. exec returns 0 whenever it prints an answer
5. Never share logs recorded with --log-level debug. The docs say they contain request headers with the API key