SandBase Harness v0.3.8: local-first runtime for auditable agent sessions

[liyangbing]

SandBase Harness v0.3.8 is now available.\n\nThis release brings together three practical improvements:\n\n- Git-hosted DeepSeek Harness installs build missing dist/ entries through prepare.\n- Runtime metrics count model usage once per request and persist session token aggregates.\n- Confirmed tool calls are validated against raw AI SDK v4 stream lifecycle data, rejecting malformed, incomplete, duplicate, and projection-only calls.\n\nQuick start:\n\nbash\ngit clone --branch v0.3.8 --depth 1 https://github.com/sandbaseai/sandbase-harness.git\ncd sandbase-harness\nnpm ci\nnpm run build\nmkdir ../my-agents && cd ../my-agents\nnode ../sandbase-harness/dist/index.js init\nnode ../sandbase-harness/dist/index.js start\n\n\nThen open http://127.0.0.1:3000/dashboard and configure a model under Settings > Models. For DSH integration, see the DeepSeek Harness guide in the repository.\n\nImportant boundary: the local sandbox runs with the current OS user and is intended for trusted development. Use Docker or Kubernetes for stronger isolation.\n\nRelease: https://github.com/sandbaseai/sandbase-harness/releases/tag/v0.3.8\nDocs: https://github.com/sandbaseai/sandbase-harness#readme\n\nUse this thread for installation reports, provider compatibility notes, and reproducible integration feedback.

Ecosystem discovery

Verified and public references:

• Official MCP Registry
• dshbase verified listing
• Awesome Agents
• abordage/awesome-mcp
• Merged references: awesome-agent-runtime, Awesome Agent Cortex, and Awesome AI Devtools.

Independent directories make their own editorial decisions; the repository and release metadata remain the source of truth.

中文简介

SandBase Harness 是一个本地优先、可自托管的 AI Agent Runtime，提供持久化会话、沙箱执行、MCP 工具、Memory、凭证、审批、审计和事件回放，并支持本地 Console。

• 中文 README
• 中文场景展示
• 中文安装说明

[liyangbing]

生态分发更新（2026-08-30）：SandBase Harness 已加入自有 Awesome Agent Runtime 地图（https://github.com/sandbaseai/awesome-agent-runtime）。同时已向以下社区目录提交集成条目，均等待各自维护者审核：DeepSeek 官方 Awesome Agent（https://github.com/deepseek-ai/awesome-deepseek-agent/pull/411）、Awesome AI SDKs（https://github.com/e2b-dev/awesome-ai-sdks/pull/344）、Awesome MCP Servers（https://github.com/punkpeye/awesome-mcp-servers/pull/13188）。欢迎通过真实使用反馈帮助我们改进。

[liyangbing]

新增推广进展：已向中文 AI Agent 资源库提交 skyming/awesome-ai-agent#19，补充 SandBase Harness 的本地优先 Runtime、持久化会话、沙箱、MCP、记忆、凭据、审计与回放能力。

[liyangbing]

推广渠道进展更新：

• Harness Engineering Guide #70：提交到 Harness 工具资源入口。
• ToolSDK MCP Registry #487：提交官方 Docker MCP Bridge，Schema 与 Biome 检查均已通过。
• Awesome CLI Coding Agents #313：提交到 Agent infrastructure 分类，按 stars 正确排序。

这些条目均使用官方仓库、文档和 v0.3.8 镜像信息，等待各项目维护者审核。

[liyangbing]

MCP 目录补充：

• Awesome MCP Clients #182：以 MCP Client 形式收录 SandBase Harness。
• Awesome MCP List #407：以官方 stdio MCP Bridge 形式收录。

两项 PR 均只包含对应目录要求的单条客观描述，当前等待维护者审核。

[liyangbing]

Distribution update — 2026-08-30

New community discovery submissions are now in review:

• Agentic AI Landscape: feat: add SandBase Harness to agentic landscape agentic-community/agentic-landscape#2
• Agent runtime comparison: docs: add SandBase Harness runtime profile dz3ai/awesome-agent-runtimes#1
• Agent sandbox directories: docs: add SandBase Harness sandbox runtime arjan/awesome-agent-sandboxes#8 and docs: add SandBase Harness to agent sandboxes dloss/awesome-agent-sandboxes#7
• MCP security lists: docs: add SandBase Harness to MCP security tools Puliczek/awesome-mcp-security#298 and docs: add SandBase Harness MCP security runtime AIM-Intelligence/awesome-mcp-security#48
• MCP Marketplace tool schema: feat: add SandBase Harness MCP tool schema aiagenta2z/mcp-marketplace#5

The reproducible installation guide is now merged in main: https://github.com/sandbaseai/sandbase-harness/blob/main/llms-install.md

[liyangbing]

Cline Marketplace promotion is now submitted: cline/mcp-marketplace#2364

The repository now includes a 400×400 icon at https://raw.githubusercontent.com/sandbaseai/sandbase-harness/main/docs/assets/sandbase-harness-icon.png and a verified Cline CLI setup in llms-install.md. The published MCP image completed an MCP initialize handshake over stdio.

[liyangbing]

MCP.Directory follow-up: the public submission endpoint confirms that SandBase Harness has already been submitted and is queued for review (duplicate submissions are rejected). Directory entry: https://mcp.directory/submit

[liyangbing]

Distribution update: two ecosystem listings are now merged — sandbaseai/awesome-agent-runtime#12 and 0xNyk/awesome-agent-cortex#72. Cline Marketplace remains under review at cline/mcp-marketplace#2364; MCP.Directory confirms SandBase Harness is already submitted and queued for review.

[liyangbing]

Docker MCP Registry promotion submitted: docker/mcp-registry#4838

The entry uses the pinned ghcr.io/sandbaseai/sandbase-harness-mcp:0.3.8 image, includes the six-tool schema, runtime URL/API-key configuration, and the 400×400 project icon. Docker Registry validation passed; the PR is awaiting Docker team review.

[liyangbing]

Discovery update: npm metadata now includes mcp-server, model-context-protocol, docker-mcp, cline, and cursor keywords, matching the documented integrations and improving package search discovery. PR: #89

[liyangbing]

Distribution update: additional ecosystem listings confirmed merged — yeaight7/awesome-ai-devtools#33 and VoltAgent/awesome-agent-skills#946. MCP.Directory has accepted the submission into its review queue, but no public SandBase detail page is indexed yet.

[liyangbing]

New directory submission: SandBase Harness is now queued for review on MCP Hub (AIMCP), submission ID 1514. The free submission used the public repository and project icon; newsletter subscription was disabled. Submit page: https://www.aimcp.info/en/submit

[liyangbing]

Promotion update (2026-08-30): Docker MCP Registry PR #4838 remains open and blocked pending maintainer review; Cline marketplace submission #2364 remains open with no review comment. MCP Server Spot has a public submission page, but its submit action is a server-side form rather than a documented public API, so no submission was made without a normal browser session. Existing official registry, MCP.Directory, MCP Hub, and merged ecosystem listings remain unchanged.

[liyangbing]

Developer quick start: run the MCP bridge locally with the published image:\n\nbash\ndocker run --rm -i \\\n -e MANAGED_AGENTS_URL=http://host.docker.internal:3000 \\\n ghcr.io/sandbaseai/sandbase-harness-mcp:0.3.8\n\n\nAdd MANAGED_AGENTS_API_KEY when the Harness API requires authentication. The installation guide includes Cline and other MCP client configuration, API notes, and troubleshooting. A separate Show and tell discussion could not be created because the current GitHub account lacks the CreateDiscussion permission, so this demo is recorded here.

[liyangbing]

New organic discovery channel submitted: BrethofAI/awesome-mcp-servers Issue #12 proposes listing SandBase Harness in its active curated MCP directory. The proposal includes the maintained v0.3.8 release, official MCP metadata, six-tool bridge, self-hosted sandbox/runtime positioning, and reproducible installation guide.\n\nhttps://github.com/BrethofAI/awesome-mcp-servers/issues/12

[liyangbing]

Promotion update: dshbase has now verified SandBase Harness after headless L3 validation and published the verified listing: https://dshbase.com/plugins/sandbase-harness/ . The project remains on v0.3.8 with the official install and showcase links in the repository.

[liyangbing]

最新推广进展（2026-08-30）：自有 Awesome Agent Runtime 的 SandBase 条目已通过 PR #15 合并，并补充了 v0.3.8、官方 MCP Registry、dshbase 验证和客户端安装指南。另有新的审核申请正在等待维护者决定：harness survey #14、RUCAIBox reading list #11、agent harness benchmark #1。这些链接均为公开、可复核信息，不代表第三方背书。

[liyangbing]

推广更新（2026-08-30）：AgentDepot 已提交 SandBase Harness MCP 条目，公开 PR #9 正在等待维护者审核：biagruot/agentdepot-agents#9 。MCP.Directory 的提交接口确认该仓库已在审核队列中（HTTP 409 already submitted），但尚无公开详情页，因此暂不宣称已上线。Kiprio 本轮接口跳转首页，未计为成功收录。以上状态均可由公开链接复核。

[liyangbing]

推广更新（2026-08-30）：又确认 3 个公开合并入口：Awesome Agent Cortex 的 PR #72、Awesome AI Devtools 的 PR #33、VoltAgent Awesome Agent Skills 的 PR #946。合并后的主分支均可直接看到 SandBase 条目；对应链接已同步到推广台账。另一个高信号 runtime 目录要求 5,000+ stars，当前不符合准入条件，未提交。

[liyangbing]

推广更新（2026-08-30）：已通过 mcpservers.org 公共表单成功提交 SandBase Harness，确认页显示将在 12 小时内审核：https://mcpservers.org/submit 。当前尚无公开 listing URL，因此状态记录为“已提交/待审核”，不提前宣称上线。

[liyangbing]

推广更新（2026-08-30）：向 Open Source Observer 的 OSS Directory 提交了 SandBase Harness 条目，PR #1211 正在审核：opensource-observer/oss-directory#1211 。该目录通过公开 PR 维护 OSS 项目注册信息；本地 pnpm validate:projects 已验证全库 7,133 个项目通过。

[liyangbing]

推广更新（2026-08-30）：向 OpenSourceChoice 提交了 SandBase Harness。提交前目录搜索无 SandBase 结果，公开提交接口返回 HTTP 202 / {"ok":true}；该站点说明免费审核、通过后公开收录：https://opensourcechoice.com/ 。当前仍是审核中，尚无公开 listing，台账已记录。

[liyangbing]

推广更新（2026-08-30）：已向 Ossium 提交 SandBase Harness。其公开提交 API 返回 HTTP 200、success:true，审核 ID 为 G1BPvgbobGfKn1x9nSasR；该平台说明免费人工审核并要求公开仓库、活跃维护和至少 17 stars：https://ossium.in/submit-oss 。目前尚无公开项目页。

[liyangbing]

推广维护更新（2026-08-30）

首页的中英文 README 已补充“近期已核验的社区引用”，并已推送到 main：

• dshbase verified plugin page: https://dshbase.com/plugins/sandbase-harness/
• awesome-agent-runtime merged entry: docs: refresh SandBase Harness discovery links awesome-agent-runtime#15
• Awesome Agent Cortex merged entry: Add SandBase CLI to the MCP ecosystem 0xNyk/awesome-agent-cortex#72
• Awesome AI Devtools merged entry: Add SandBase CLI to AI devtools catalog yeaight7/awesome-ai-devtools#33
• Awesome Agent Skills merged entry: Add skill: sandbaseai/multi-source-search VoltAgent/awesome-agent-skills#946

对应提交：af532fd

README 只展示已核验的公开引用；待审核的 AgentDepot、OSS Directory、MCP.Directory、mcpservers.org、OpenSourceChoice、Ossium 等仍在推广台账中单独跟踪，不提前宣称已收录。

[liyangbing]

推广维护更新（2026-08-30，后续核验批次）

最近继续完成了几类源代码驱动的社区说明，并保持“已回复”和“已收录”分开：

• MCP reconnect / slow retry 讨论：MCP client: reconnect budget exhaustion unregisters the server's tools permanently — propose slow-retry keepalive instead deepseek-ai/deepseek-harness#5105 (comment)
• session export / observability / streaming render / sandbox workdir / delegated-agent / oversized prompt / torn log 讨论：
  • Provide official session export/inspect tooling for zstd-framed session logs deepseek-ai/deepseek-harness#5108 (comment)
  • Observability: per-line timestamps in dsh-web.log and an export path for token-meter data deepseek-ai/deepseek-harness#5110 (comment)
  • 建议优化会话流式渲染：批量/节流更新 token，避免每 token 全量重建当前消息 deepseek-ai/deepseek-harness#5114 (comment)
  • bash tool: absolute workdir outside the sandbox workspace root fails late/confusingly instead of being rejected up front deepseek-ai/deepseek-harness#5101 (comment)
  • [Bug] In-process subagents cannot write under inherited workspace-write because escalation fields remain exposed deepseek-ai/deepseek-harness#5095 (comment)
  • CLI: guard against oversized prompt arguments (Windows ~32K argv limit); add --prompt-file / stdin input channels deepseek-ai/deepseek-harness#5107 (comment)
  • Session log reader hard-fails when a complete frame contains a torn trailing JSONL record, rejecting the entire session history deepseek-ai/deepseek-harness#5104 (comment)
• AgentDepot PR Align runtime resource handling #9 已补充 v0.3.8、Registry、GHCR 多架构证据：Add SandBase Harness MCP agent biagruot/agentdepot-agents#9 (comment)
• 新提交的 Agent Harness 收录请求：
  • Add SandBase Harness to the Agent Harness list mahonzhan/awesome-agent-harness#30
  • Add SandBase Harness to Agent Runtimes AutoJunjie/awesome-agent-harness#59

所有尚未获得维护者确认的渠道仍标为 pending，不把 Issue/PR 当作已收录。完整状态见仓库的 docs/promotion.md。

[liyangbing]

推广更新（2026-08-30）

新增并已核验的推广进展：

• AgentSpot 免费目录提交已创建：[Submit] SandBase Harness agentspot/agentspot-submissions#1
• AgentMatter MCP Bridge 提交已进入审核队列（submission Feat/ci setup #2）：https://www.agentmatter.net/submit
• Backblaze Agent Infrastructure 收录 PR fix(package): point metadata at sandbase-harness #21 仍在审核：Add SandBase Harness to agent infrastructure backblaze-labs/awesome-agent-infrastructure#21

这些入口目前都属于审核中，不提前宣称已公开收录。项目当前安装和能力说明仍以 v0.3.8 release、README、API 文档和 GHCR MCP bridge 为准；完整状态见 docs/promotion.md。

[liyangbing]

推广进展更新（2026-08-30）：

• 已向开源 McpMux MCP Server Registry 提交 PR #286。
• 提交内容使用 GHCR ghcr.io/sandbaseai/sandbase-harness-mcp:0.3.8，并提供运行时 URL 与可选 API Key 配置。
• 上游单文件 Schema 校验通过，全库 264 个定义的冲突检查通过。
• 当前状态：OPEN / MERGEABLE / REVIEW_REQUIRED，等待上游维护者审核；尚未宣称已收录。

[liyangbing]

推广进展（2026-08-31）：

• Awesome DSH Hub 已公开列出 SandBase Harness；该目录为自动维护，项目 README 已记录为发现入口。
• 已向 Awesome Agent Engineering 提交候选项目 Issue #1，等待其按“每类最多 10 个项目”的规则审核。
• Awesome Agent Cortex PR #73 的项目链接检查因两个上游链接 HTTP 429 失败，新增 Harness 链接未受影响；已在 PR 中说明，等待维护者处理。

独立目录有各自的编辑和审核规则；本仓库 README、server.json 与 release 页面仍是安装和版本信息的权威来源。

[liyangbing]

供应链透明度更新（2026-08-31）：

• 新增并成功运行 OpenSSF Scorecard workflow，默认 GitHub Actions 权限为只读，发布任务使用最小化 job 权限。
• 当前公开扫描结果：Scorecard API，分数 4.1/10。结果仍明确显示代码审查和提交签名覆盖不足；这不是安全背书，而是供用户复核的公开信号。
• 针对自动目录将插件/MCP 能力识别为缺失的问题，已提交 HVTracker correction #212，并附上当前 agent-plugin/、server.json 和六个 DSH 操作的源码证据。

[liyangbing]

维护进展（2026-08-31）：依赖安全分支已合并到 main（d650341）。

• OpenSSF Scorecard 当前公开结果为 4.6/10；Token-Permissions 和 SAST（CodeQL）均为满分。
• main 的 CI、CodeQL、Scorecard 均已通过。
• 已加入 Dependabot，每周跟踪 npm 与 GitHub Actions 更新。
• npm audit --omit=dev --audit-level=high 当前仍报告 7 个生产依赖问题；剩余 AI SDK 依赖链需要破坏性 major upgrade，已保留为后续可审查 PR，不做未经验证的强制升级。

这是安全透明度和维护连续性的更新，不代表 OpenSSF 或第三方目录对项目作出背书。