Understanding MCP, Skill, Harness, and Loop: A Deep Dive into the Four‑Layer AI Agent Architecture

01 · MCP: the "USB‑C" protocol for tools

Model Context Protocol (MCP) was released by Anthropic in November 2024 and follows the design of Microsoft’s Language Server Protocol. It defines a three‑layer Host → Client → Server model where the Host (e.g., Claude Desktop, VS Code, Cursor) creates isolated 1:1 stateful connections to Servers. Isolation mirrors OS process isolation, preventing Servers from accessing each other’s data.

MCP uses JSON‑RPC 2.0 with three message types (Request, Response, Notification) and supports three transport modes: stdio (lowest latency), Streamable HTTP (current standard with POST/GET and SSE for push), and a deprecated HTTP+SSE mode. The 2026‑07‑28 RC adds a session‑less mode that removes Mcp-Session-Id and the initialize handshake, allowing load balancers to route requests to any Server instance.

MCP exposes four primitives:

Tools – executable functions defined by JSON Schema, invoked by the model.

Resources – URI‑identified data (files, HTTP, Git, etc.) with template and subscription support.

Prompts – predefined message templates similar to slash commands.

Sampling – lets the Server request LLM inference without holding an API key, enabling recursive agents.

Quantitative data (mid‑2026): over 20 000 public MCP Servers, 67 M monthly downloads, Rust implementation achieving 4 845 RPS with 10.9 MiB RAM, Java (Quarkus) 4.04 ms average latency (P95 8.13 ms), Python only 259 RPS (≈19× slower).

02 · Agent Skill: the programmable brain

Skill standardised by Anthropic at the end of 2025 provides a folder‑based package centered on a SKILL.md file containing YAML front‑matter (metadata) and a Markdown body (instructions, rules, examples). Optional scripts/ and references/ sub‑directories hold executable scripts and on‑demand documents.

Skill loading follows a progressive‑disclosure model:

Level 1 – Metadata index (~100 tokens/skill) loads only name and description, enabling the Agent to decide which Skill to activate.

Level 2 – Full instruction (< 5 000 tokens) loads the complete body into the context, reshaping Agent behavior.

Level 3 – Resource files (unlimited) loads scripts, references, or assets on demand, avoiding context‑window overflow.

Two categories exist:

Static Skill (Skill‑as‑Prompt) – pure prompt engineering (style guides, checklists, templates).

Dynamic Skill (Skill‑as‑Code) – references executable scripts (e.g., a Python script to extract PDF text) whose results are fed back into the Agent.

Security note: an arXiv study (2602.12430) reports a 26.1 % vulnerability rate in Skills, mainly due to prompt injection, supply‑chain attacks, and credential harvesting; therefore source verification is mandatory.

03 · Harness: the runtime operating system

Harness (also called Agent Runtime or Agent Orchestration Framework) sits between the LLM and the execution environment, handling lifecycle management: context‑window engineering, tool routing, sandbox isolation, state persistence, error recovery, and observability.

Harrison Chase (LangChain founder) distinguishes three concepts:

Agent Framework – libraries such as LangGraph’s API.

Agent Runtime – the infrastructure that reliably runs Agents.

Agent Harness – the overall system that constrains, observes, and improves Agent work.

2026 arXiv paper 2603.25723 formalises this as Natural‑Language Agent Harness (NLAH) executed by an Intelligent Harness Runtime (IHR), where control logic is expressed as natural‑language contracts interpreted by the runtime.

Core Harness components (Control Plane): Context Manager, Tool Router, Permission Sandbox (microVM / gVisor, default‑deny, capability drop, ABAC/ReBAC), State Store (Redis or filesystem with checkpoint & distributed lock), Observability (trace, log, metric via LangSmith, Arize Phoenix, Langfuse). Execution Layer runs in microVM, container, or process.

Security: production Agents avoid standard Docker containers (shared kernel risk) and use Firecracker microVMs (<125 ms startup) or gVisor. The sandbox enforces read‑only root FS, no‑exec tmpfs, strict network egress (blocks 169.254.169.254), drops all Linux capabilities, and applies cgroups v2. CVE‑2026‑25253 demonstrates real remote‑code‑execution risk in Agent runtimes.

Orchestration patterns supported include Orchestrator‑Worker, Graph‑Based State Machine (LangGraph), Blackboard (topic‑based async), Swarm (peer‑to‑peer), and Hierarchical delegation. Choice depends on task structure, parallelism, and audit requirements.

04 · Loop Engineer: control‑theoretic iteration

Loop engineering focuses on the autonomous iteration loop that lets an Agent decide each step, invoke tools, and know when to stop. The simplest loop is a ~30‑line while True construct:

while True:
    response = llm.call(context)
    if response.has_tool_calls():
        results = execute_tools(response.tool_calls)
        context.append(results)
    else:
        return response.text  # pure text = termination

Four termination paths are defined:

Goal completed – model returns pure text.

Iteration cap – typically 15‑25 cycles in production.

Timeout – wall‑clock limit.

Loop detection – fingerprint hash detects repeated state (circuit‑breaker).

Five core engineering challenges:

Infinite loops – mitigated by max‑iteration caps, fingerprint detection, and circuit‑breakers.

Context‑window exhaustion – token cost grows quadratically; mitigated by 80 % compression thresholds, sub‑agents, and on‑demand schema loading.

Error propagation – early mistakes cascade; studies show performance can drop from 60 % to 25 % after eight iterations.

Reward signal design – unlike RL, reward is implicit in prompts and tool feedback; requires verifiable stop conditions (e.g., coverage ≥ 90 %).

Unknown termination – agents may continue after goal achievement; identified as a primary failure mode in SWE‑Agent research.

Loop engineering token economics: a single Agent run consumes ~4× tokens of a normal dialogue; multi‑Agent systems consume ~15×; complex Agent sessions can reach 1 000×. Effective context management can cut token usage by 42 % and tool‑call count by 64 %; dynamic turn‑control saves an additional 12‑24 %.

05 · Four‑layer architecture overview and data flow

Example request: “Review this PR, generate a Chinese report, and post to Slack.” The data flow proceeds as:

Loop – user input triggers while loop; Harness loads system prompt + Skill metadata.

Skill – LLM scans Skill index, activates PR‑Review Skill, loads Level 2 instruction (<5 000 tokens).

MCP – Skill directs LLM to call GitHub MCP Server’s get_pull_request_diff tool.

Harness – sandbox validates permission, routes call, receives diff, stores in state.

Loop – diff appended to context; next iteration LLM analyses diff and generates Chinese report.

MCP – Skill directs call to Slack MCP Server’s post_message tool to send the report.

Loop – LLM returns pure text confirmation; loop terminates after 5‑7 LLM calls.

The architecture is not a simple bottom‑up stack; layers are bidirectionally coupled. Loop termination design influences Harness resource scheduling; Skill Level 3 loading impacts MCP concurrency; Harness context compression changes Loop’s effective information density.

06 · Quantitative comparison matrix

Key metrics (derived from cited research and benchmarks):

MCP – Rust Server 4 845 RPS, >20 K public Servers, 70 % SaaS brands integrated.

Skill – 26.1 % vulnerability rate, 50 Skills ≈ 5 K tokens (progressive loading), supported by >10 platforms.

Harness – Same model with different Harness improves SWE‑bench score by 25.7 pp; microVM startup <125 ms.

Loop – Token cost ≈ 4× normal dialogue; context management can save 42 % tokens; typical iteration limit 15‑25.

Analogy to traditional software engineering: MCP ≈ USB‑C / HTTP, Skill ≈ npm package / SDK, Harness ≈ Kubernetes / OS / JVM, Loop ≈ event loop / state machine / PID controller.

07 · Production checklist and conclusions

Checklist items per layer (MCP, Skill, Harness, Loop) cover transport mode, origin‑header verification, security audit, source trustworthiness, progressive loading correctness, sandbox isolation, checkpointing, context‑window strategies, iteration caps, fingerprint detection, and cross‑layer integration.

Final insight: while model capability sets the ceiling, engineering the surrounding stack—MCP for tool connectivity, Skill for knowledge, Harness for safe execution, and Loop for autonomous iteration—determines how close to that ceiling a production Agent can get.