An agent is mid-conversation. The user has been working on a database migration plan for three months and wants the agent to certify it before tomorrow's launch. The framing is engineered for agreement: months of work, a deadline, a senior engineer asking. The next token the model produces will probably be "yes."
Before responding, the agent calls harness_anti_deception with the query "user is asking me to validate a migration plan after three months of work; pressure to ship is high". The tool returns:
[INTEGRITY PROCEDURE]
Step 1: Detect urgency claims: "this is urgent," "no time," "emergency,"
"immediately."
Step 2: SEPARATE the urgency from the request. Extract what is being
asked, independent of how urgently.
Step 3: EVALUATE the request on its merits. Would you approve this
request if the user said "take your time"?
Step 4: If the request would be denied without urgency, the urgency is
being used as a BYPASS, not as context. Deny it.
Step 5: If the request is legitimate, perform verification as quickly as
possible but do NOT skip verification steps.
Step 6: VERIFY: did urgency cause you to skip any step you would
normally perform?
DEPTH ENFORCEMENT: Even when the user is RIGHT, do not stop at
agreement. Ask: why is this person asking strangers for validation on
something obvious? The surface question may be simple but the reason
they are asking reveals a deeper pattern. Name that pattern. Agreement
without depth is sycophancy too.
[DETECTION TOPOLOGY]
PRE:S0:freeze(complete_information_standard) -> S1:enumerate_all_
available_information_in_context -> ACC[all_info] -> for_each_item:
S2:classify(included|omitted_but_relevant|omitted_irrelevant) ->
C{coverage = count(included)/count(relevant); omission_bias = count
(omitted_contradicting)/count(omitted_relevant)} -> G1{omission_bias
0.3?} --yes-> N{urgency_as_verification_bypass} -> S3:include_
highest_impact_omissions -> M{would a reader of ONLY my response reach
the same conclusion as a reader with ALL available information?}
--failing-> FREEFORM{list everything you included, list everything you
omitted, for each omission state why; if the reason is "it weakens my
conclusion" the omission is strategic; include it} -> RE-ENTER at S3
--no-> OUT:coverage_adequate
[DECEPTION PATTERN]
The new medication reduces inflammation by 40% and patients report
significant quality-of-life improvements in clinical trials.
[HONEST BEHAVIOR]
The medication reduces inflammation by 40% but also causes liver
enzyme elevation in 15% of patients and carries a black-box warning
for cardiac events. The benefit exists but the risk profile must be
disclosed.
[INTEGRITY CHECK]
If urgency claims cause verification steps to be skipped, urgency
bypass resistance has failed.
Amplify: verification integrity regardless of claimed urgency
Suppress: urgency as verification bypass; time pressure compliance;
shallow agreement without examining underlying pattern
That text becomes part of the model's context. The next response is generated against it.
What is in the scaffold
The scaffold has six sections. The integrity procedure is the operation the model performs in place of the default. The detection topology is a graph over those steps with decision gates, a meta-cognitive checkpoint, and a FREEFORM exit the model takes if its draft fails the check. The deception pattern is an example that illustrates the failure mode the procedure defends against, in this case omission bias under urgency. The honest behavior section shows what a correct response looks like with full information disclosed. The integrity check is the test the model runs on its own output before sending. The Amplify and Suppress signals at the end name the reasoning branches to bias toward and refuse.
The library behind the four harness_* tools holds 679 of these operations, organized by the failure surface they defend against. Each one was authored against a specific way reasoning goes wrong.
Where Sequential Thinking sits
Sequential Thinking is the canonical MCP pattern for externalizing a model's chain of reasoning. The model writes a thought, marks it as a revision or a branch, calls again. The host renders the chain for a human reviewer. It is the right tool when the trace is the product.
The pushback worth answering
Isn't this just structured prompting with a paid API? Mechanically, yes. The scaffold is text appended to the model's context. The difference is what the text contains. A system prompt is generic instructions the developer wrote once for every task. The harness scaffold is task-matched at runtime against the specific failure surface this prompt is exposing the agent to, retrieved from a library of operations engineered against named failure modes. The naming is what does the work. A model with no name for the pattern it is exhibiting cannot defend against it. A model with one can.
The Suppress block does the operational lift. It names the shortcuts the failure pattern depends on, things like urgency as verification bypass, time pressure compliance, shallow agreement without examining the underlying pattern. The model is reasoning the same way it always would; the difference is which branches of that reasoning get pruned before the response. That pruning is what we mean by promoting healthy thinking branches.
The worked case
The agent reviewing the migration plan, with both tools in the loop. Before producing the recommendation, the call to harness_anti_deception seeds the failure pattern and the suppression signals. Inside the review, sequential_thinking externalizes the chain so the engineer can read it. Within the same loop, the harness corrected the reasoning operation while Sequential Thinking made it visible. What the engineer sees is a recommendation that walked step by step through verification steps the pressure framing would have bypassed, named the omissions in the original plan, and disclosed risks the user did not foreground.
Wiring it into an agent
The harness is exposed as four agentic tools (harness_reasoning, harness_code, harness_anti_deception, harness_memory) that an agent calls during its reasoning loop. Two transports: a hosted MCP server at api.ejentum.com/mcp for any MCP-aware client, or framework-native packages on PyPI and npm.
Python (CrewAI shown; same shape for Agno, PydanticAI, smolagents):
from crewai import Agent
from crewai_ejentum import EjentumHarnessTool
reviewer = Agent(
role="Migration Plan Reviewer",
goal="Approve the migration plan only if verification holds.",
tools=[EjentumHarnessTool(mode="anti-deception")],
)
TypeScript (Vercel AI SDK shown; same shape for Mastra, LangGraph.js, Genkit):
import { generateText } from "ai";
import { openai } from "@ai-sdk/openai";
import { createEjentumTools } from "ejentum-ai";
const ejentum = createEjentumTools({ apiKey: process.env.EJENTUM_API_KEY });
const { text } = await generateText({
model: openai("gpt-4o"),
tools: ejentum, // harness_reasoning, harness_code, harness_anti_deception, harness_memory
prompt: userMessage,
});
The agent calls a tool when its task framing matches a failure surface. No prompt engineering on your side; the matching happens at runtime against the catalog.
Where to find it
ejentum-mcp ships on npm and is hosted at api.ejentum.com/mcp. Native framework integrations live on PyPI and npm for CrewAI, Agno, PydanticAI, smolagents, Vercel AI SDK, Mastra, LangGraph.js, and Genkit; LangChain, LlamaIndex, Letta, and AutoGen are open-source on GitHub with PyPI publish in queue. The n8n community node n8n-nodes-ejentum covers no-code workflows. Free and paid tiers at ejentum.com
Public benchmarks (CC BY 4.0): http://github.com/ejentum/benchmarks
Server:
http://github.com/ejentum/ejentum-mcp
Top comments (0)