Is Smoke Monkey an AI model?

No. Smoke Monkey is not an LLM. It is an embeddable, framework-agnostic runtime that turns LLMs (NVIDIA, Gemini, OpenAI, Claude, Ollama) into autonomous engineering agents capable of multi-step planning, calling tools, editing files, and running test loops with zero runtime dependencies.

Do I need a database (Postgres, SQLite, or Redis)?

No database is required. State is persisted through lean session files on disk, or you can plug in your own custom storage adapter. You can deploy it as a CLI, a desktop app, or inside a serverless function without provisioning a database.

How does human-in-the-loop permission gating work?

Smoke Monkey comes with three permission policies: allow-all, deny-all, and ask-default (or a custom function resolver). When a sensitive tool like edit_file or run_command is called under "ask", the runtime emits a permission.required event, pausing execution until your code or UI calls agent.resolvePermission(id, "allow" | "deny").

How does the Model Context Protocol (MCP) server work?

Smoke Monkey ships an official stdio MCP server in smoke-monkey-harness-mcp. Point Claude Code, Cursor, Codex, or opencode at it using npx -y smoke-monkey-harness-mcp to let other AI tools plan, scaffold, verify, and run agents using Smoke Monkey automatically.

What are SKILL.md skills and how do they prevent context bloat?

Skills are directories containing a SKILL.md workflow file. The system prompt only includes a one-line catalog of available skills. When a task requires specialized expertise (e.g. frontend-ui-engineering, test-driven-development, or security-hardening), the agent calls use_skill to load instructions just-in-time, saving thousands of tokens.

What is an AI Agent Harness?

An AI agent harness is the execution environment that bridges raw Large Language Models (LLMs) to real-world software engineering capabilities. While an LLM generates tokens, an AI harness manages deterministic phase loops (explore, plan, edit, verify, recover), tool execution sandboxing, token budget compaction, and safety gates needed for autonomous problem-solving.

What makes Smoke Monkey an Agentic AI runtime rather than a simple wrapper?

Unlike basic prompt-response chains, Smoke Monkey implements true agentic AI architecture: a deterministic 6-phase state machine with automatic failure recovery, runaway loop guards, 24 built-in developer tools, dynamic subcontext isolation, and interactive human-in-the-loop permission pauses.

Is Smoke Monkey Harness 100% Open Source AI?

Yes. Smoke Monkey Harness is 100% open source under the permissive MIT license with zero runtime dependencies. There is no telemetry lock-in, no mandatory cloud backend, and no database requirement—giving engineering teams complete sovereignty over their agent code.

What Agent APIs does Smoke Monkey Harness provide?

Smoke Monkey provides composable TypeScript Agent APIs: createAgent() for initialization, agent.run() for multi-turn execution, agent.on() for fine-grained lifecycle and streaming events, agent.resolvePermission() for interactive human authorization, subcontext switching APIs, and stdio Model Context Protocol (MCP) server endpoints.

Can I run completely offline without API keys?

Yes! Smoke Monkey natively supports Ollama out of the box. Set provider: "ollama" and model: "qwen3:8b" with workspacePath, and the agent will run locally on your machine with zero external network requests.

Security

10 min readUpdated: October 2026

AI Agent Security: Sandboxing, Permission Gates & Safe Tool Execution

Technical Review: Smoke Monkey Core Architecture Team

|Tested on Node.js 18+ & Bun|TypeScript 5.x

Quick Answer & Executive Definition

AI Agent Security: Sandboxing, Permission Gates & Safe Tool Execution: Designed as a zero-dependency, open-source TypeScript architecture under the MIT License with native Model Context Protocol (MCP) support and deterministic phase state machines.

Key Architectural Takeaways

Three-tier permission model: auto-approve, ask, or always-deny per tool
Workspace sandboxing prevents writes outside the configured root
Every tool execution is logged with full input/output audit trail
Allowlist specific shell commands to block dangerous operations

The Three-Tier Permission Model

Smoke Monkey Harness maps every tool invocation through a configurable permission layer before execution:

`auto`: Execute immediately, no human prompt (safe for read-only tools like file reading).
`ask`: Pause and display the proposed action to the user. Resume only after explicit approval.
`deny`: Block the tool entirely — the agent is informed it cannot use it.

This maps directly to the principle of least privilege for agentic systems.

secure-agent.tstypescript

1import { createAgent } from 'smoke-monkey-harness';
2
3const agent = createAgent({
4  provider: 'anthropic',
5  model: 'claude-3-7-sonnet',
6  workspacePath: '/projects/my-app',  // Sandboxed root
7  permissions: {
8    // Read tools: auto-approve
9    read_file: 'auto',
10    list_dir: 'auto',
11    grep_search: 'auto',
12
13    // Write tools: require human approval
14    write_file: 'ask',
15    replace_file_content: 'ask',
16
17    // Dangerous tools: always require approval
18    run_command: 'ask',
19
20    // Denied entirely
21    delete_file: 'deny',
22  },
23});

Workspace Sandboxing

The workspacePath option in Smoke Monkey creates a hard boundary. All file operations are validated against this root:

Path traversal attacks (e.g., ../../etc/passwd) are rejected before tool execution.
Symlink resolution is performed before sandbox validation.
Absolute paths outside the workspace are blocked automatically.

For maximum isolation, run agents in Docker containers with the workspace mounted as a volume.

Always set an explicit workspacePath

Never use process.cwd() as the workspacePath in production agents. Set it explicitly to the minimum necessary project directory.

Audit Logging Every Tool Execution

Every tool call, its input parameters, and its output are logged to the session file. Use the agent event system to pipe these logs to your SIEM or observability stack:

typescript

agent.on('tool.executed', (event) => {
  auditLogger.info({
    tool: event.data.toolName,
    input: event.data.input,
    duration: event.data.durationMs,
    approved: event.data.wasApproved,
  });
});

Google Search Questions & Answers

Frequently Asked Questions

Q:Can I allowlist specific shell commands instead of blocking all of run_command?

Yes. Use a custom tool wrapper that validates the command string against an allowlist before passing to the OS. This gives you fine-grained control over which shell operations the agent can perform.

Q:Does Smoke Monkey support network isolation for agents?

Smoke Monkey itself does not enforce network policies — use your OS-level firewall, Docker network rules, or a zero-trust proxy to restrict outbound network access from agent processes.

Related Alternatives & Comparisons

vs Cognition Devin

Open Source Devin Alternative: Build Autonomous Software Engineers in TypeScript

Compare

vs Fixie AI & Hosted Agent Platforms

Fixie AI & Hosted Agent Platform Alternatives: Self-Sovereign TypeScript Runtime

Compare

Build with Smoke Monkey Harness

Zero dependencies. 24 built-in tools. Human-in-the-loop safety. 100% open source under the MIT License.

npm install smoke-monkey-harness