Grok Build harness — guide

The Grok Build package lets you run your MeshWeaver chat threads on grok (the Grok Build CLI), under your own Grok account. Your threads, your mesh content and the mesh tools stay as they are; what changes is the engine that executes each round of the conversation.

It is for people who already use Grok Build and want MeshWeaver's threads to run on their Grok account rather than on the models the mesh provides.

Key concepts

• A harness, not an agent. A harness decides what executes the round, not which agent you talk to. Switching a thread back to the standard MeshWeaver path loses nothing.
• Personal, access-based opt-in. Getting the package gives you access to it, and the chat's harness picker offers the harnesses of every package you can read — so the harness appears in your picker, and in no one else's who has not got the package. Nothing is copied into your home for this. (On installations that still copy app content into homes, the older behaviour, the Store also places a copy at {you}/Harness/Grok.) There is no shared key, and nothing is billed to the mesh.
• Driven over the Agent Client Protocol. Grok Build speaks the Agent Client Protocol (ACP), the JSON-RPC protocol coding agents expose for embedding. One shared harness implementation drives every ACP agent MeshWeaver supports; it ships with the ACP Agents package (How the harness drives an ACP agent), which this package requires. This package is the per-user opt-in for Grok Build.
• One session per thread. Each thread maps to one Grok Build session. Grok Build supports resuming a session without replaying its history, so every later round sends only your new message. If the session cannot be continued, the harness starts a fresh one in the same round and hands it the thread's earlier turns as a bounded transcript, with the agent's instructions at the head of the first prompt.
• The mesh as the workspace. Every session is given MeshWeaver's MCP server, acting as you under your own credentials, so mesh access control applies unchanged. The harness offers the agent no file-system or terminal access on the server: the agent's own tools run inside the agent process, and the mesh is reached through the MCP server.

Typical workflow

1. Get the package from the Store. The Grok Build CLI itself must be installed beside the portal.
2. Open a thread and pick Grok Build as the harness.
3. Run /login and sign in with your Grok account through a device code you confirm in the browser, or paste an xAI API key. The browser OAuth login of the CLI works only on the machine that runs MeshWeaver.
4. Chat as usual. The answer and the agent's reasoning stream into the thread, and every tool the agent runs shows up as a tool call with its result.

Uninstalling removes only a legacy home copy ({you}/Harness/…) where your installation made one; it does not revoke your access to the package, so the picker keeps offering the harness and threads that selected it keep using it. To stop using it, switch each thread to another harness — or to the standard MeshWeaver agent path — in the picker; nothing breaks and no history is lost.

Permissions

Nobody is watching each step of a round, so the harness answers the agent's permission requests by policy instead of leaving it waiting. A request is allowed when the deployment has turned on auto-approval, or when the tool's kind is on the allowed list — by default read, search, fetch, think and other. Everything else, including a request that names no kind, is rejected.

The harness then picks from the options the agent offers: for an allowed request it chooses "allow once" when offered, and otherwise the agent's other allow option — which can be "allow always" — even with auto-approval off. A rejected request likewise takes "reject once", else any other reject option. If the agent offers no matching option, the request is cancelled.

Your login stays yours

Each user runs the agent under a home directory of their own, so logins and sessions never mix between people on the same server. A pasted key is stored as your harness credential and passed to the agent on each round.

What you get

• Grok Build as an execution engine for every MeshWeaver thread you choose.
• Continuity across rounds through the agent's own session store.
• The full mesh toolset through the MCP back-connection, under your own permissions.
• Your account, your login, your picker — nothing shared.