Google Cloud shows how to build custom agent harnesses with the Antigravity SDK
Skills, sandboxed tools, persistent sessions and hooks are becoming the standard parts of an agent, and the harness is now the real engineering.
Google Cloud has published a walkthrough of the Antigravity SDK, a Python toolkit that exposes the same runtime engine used in Antigravity 2.0 and the Antigravity command-line tool so that developers can build their own agent hubs or custom harnesses. The post, by Wei Yih Yap, a forward deployed engineer, and Paul Datta, a practice customer engineer at Google Cloud, appeared on the Google Cloud blog on 8 September 2026.
The authors position the SDK as an alternative to the managed Gemini Enterprise Agent Platform for teams with bespoke workflows or custom execution engines. The runtime handles model interactions with Gemini 3.1 Pro and Gemini 3.8 Flash, tool execution with built-in sandboxing, thinking traces and skill execution, and the post says harnesses built on it pick up optimisations automatically when the core runtime is updated.
Four building blocks are described. Skills are reusable instruction bundles resolved from filesystem directories containing a SKILL.md file and injected into the agent's prompt. Built-in file tools (LIST_DIR, FIND_FILE, SEARCH_DIR, VIEW_FILE, CREATE_FILE and EDIT_FILE) are confined to directories declared in a workspaces setting, enforced by a policy such as policy.workspace_only(). Session persistence uses a save_dir and a conversation_id, storing each trajectory under a traj- prefix with full turn history, tool receipts and artefacts so that sessions can be resumed. Lifecycle hooks, written as decorated async functions such as on_session_start, pre_tool_call_decide, post_tool_call and on_session_end, allow telemetry streaming to dashboards and human-in-the-loop approval gates before a tool runs.
The post also documents a streaming interface that exposes three concurrent async iterators over one model response: visible text, internal reasoning deltas, and typed tool-call events carrying a name and arguments. Code samples are provided for each building block, and the SDK is available from the google-antigravity/antigravity-sdk-python repository on GitHub alongside quick-start documentation. Pricing and availability terms are not stated in the post.
Why it matters
Agent frameworks are converging on a small set of primitives: skills loaded from files, sandboxed tools, persistent sessions and hooks that let a human or a policy intervene. Google shipping its production runtime as a library means the difference between a hosted agent platform and a self-built one is becoming a matter of governance and operations rather than capability. The emphasis on workspace scoping and pre-tool-call decisions reflects the main risk of autonomous agents, which is what they do to files and systems rather than what they say. For developers, the lesson is that the harness is now the unit of engineering and the model is a swappable component inside it.
Agent frameworks are converging on a small set of primitives: skills loaded from files, sandboxed tools, persistent sessions and hooks that let a human or a policy intervene.
Lifecycle hooks and telemetry
Async functions run at session start, before and after tool calls, and at session end; can allow or deny actions
Skills
SKILL.md instruction bundles resolved from directories and injected into the prompt
Session persistence
save_dir and conversation_id store full turn history, tool receipts and artefacts for resumable sessions
Sandboxed built-in tools
File tools confined to declared workspaces by policy.workspace_only()
Runtime engine
Same engine as Antigravity 2.0 and CLI; handles Gemini model calls, thinking traces and tool execution
What you can learn from this
A harness is everything around the model call. The model produces text and tool requests; the harness decides which tools exist, executes them, feeds results back, stores history and enforces limits. Two agents using the same model can behave completely differently depending on the harness. Treating the harness as a separate engineering artefact, with its own tests and versioning, is what allows a team to swap models without rewriting workflows. The Antigravity SDK is an example of a vendor packaging that layer for reuse.
File-based skills separate instructions from code. A skill directory holds a SKILL.md describing a capability and is injected into the prompt when relevant, so domain knowledge lives in version-controlled text rather than in application code. This lets non-developers contribute procedures and lets the same runtime be specialised for research, code review or operations by pointing it at different directories. The model reads the instructions at run time, which is why the quality of the written skill matters as much as the model. The pattern now appears across several agent toolkits.
Tool sandboxing applies least privilege to agents. An agent that can edit files is only as safe as the boundary around which files it can reach. Declaring workspaces and enforcing a workspace-only policy means a tool call that targets a path outside the allowed directories is refused by the runtime rather than by the model's judgement. This matters because prompt injection or a simple mistake can make a model request a harmful action. Enforcing the boundary in code rather than in the prompt is the difference between a guideline and a guarantee.
Persistent trajectories make agents resumable and auditable. Storing every turn, tool call and result under a conversation identifier lets a session be paused and picked up later, and lets an operator replay what happened. Tool receipts, meaning the recorded inputs and outputs of each call, are what make an agent's actions reviewable after the fact. Without persistence, a long-running task that hits a crash or a rate limit has to start over. With it, the agent becomes a stateful service rather than a one-shot script.
Lifecycle hooks are middleware for agents. A hook is a function the runtime calls at a defined moment, such as before a tool executes, and it can observe, modify or veto the action. A pre-tool-call hook that returns an allow or deny result is the mechanism for human approval gates and for policy checks that depend on context the model does not have. Hooks that broadcast events to a dashboard turn an agent's inner loop into observable telemetry. This is the same idea as request middleware in web frameworks, applied to agent steps.
We teach this
How to use this in practice
Install the SDK and run the skills example. In a fresh Python virtual environment, clone google-antigravity/antigravity-sdk-python, follow the quick-start including any API key setup, and create two skill directories each holding a SKILL.md with a short procedure. Run the sample that loads both and ask the agent a question that should trigger one of them. Done looks like a transcript showing the agent following instructions from your skill file.
Prove the workspace boundary holds. Configure the file tools with workspaces set to a single scratch directory and the workspace-only policy enabled, then ask the agent to read a file outside that directory. Observe the refusal and capture the hook or log output that records it, then repeat the request for a file inside the workspace to confirm the boundary is the only difference. Done looks like a saved log line showing a denied tool call and the path it tried to reach, beside a successful call for the in-scope file.
Write a pre-tool-call hook that asks you first. Using the hooks pattern from the post, implement a function that prints the tool name and arguments and waits for a y or n from the terminal before returning an allow or deny result. Run one task that involves a file edit and deny it once, then check the persisted trajectory to see how the denial was recorded. Done looks like a run where the denied edit left the file unchanged and an allowed one changed it, with both decisions visible in the saved session.
Draw the harness as layers. Sketch the runtime engine at the bottom, then tools and policies, then sessions, then skills, then hooks and telemetry at the top, with arrows showing where a tool call passes through. Done looks like a diagram that shows the two points at which a policy can block an action and the one place where the session is written to disk.
Sources
- Power agent hubs or custom harnesses with the Antigravity SDK in one toolkit — Google Cloud Blog
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report