When Agents Touch the Physical World: Building Device-Aware Automation with Anthropic's Model Hardware Standard

For the past few years, AI agents have lived on screens: reading code, writing files, calling APIs. On August 27, 2026, Anthropic opened a research preview of the Model Hardware Standard (MHS), a shared specification aimed at letting agents leave the screen and discover and operate physical devices such as microscopes, robotic arms, and liquid handlers. For developers, this is less a new model than a new interface contract: device drivers get normalized behind a small primitive set, read, write, and discovery, and agents talk to hardware through MCP, CLI tools, or plain APIs. This guide explains what MHS actually specifies, why safety limits live below the model, and how to prototype a device descriptor, a discovery service, and an MCP tool for your own hardware today.

1. The Problem MHS Is Trying to Solve

MHS targets a mundane but expensive pain point: the equipment on a lab bench or factory cell comes from vendors that never planned to interoperate. Every instrument ships its own interface, so specialists hand-write bespoke translators between each pair, and Anthropic's team estimates that integration usually takes weeks to months. The MHS idea is not to unify the hardware but to unify the driver layer: fold each device's capabilities behind a small set of standard primitives that any compliant agent can use directly. Anthropic reports that in early pilots integration time dropped to hours or minutes, with partners including AWS, Universal Robots, and Hugging Face; Genentech ran a drug-discovery experiment, and HHMI's Janelia Research Campus compressed a weeks-long imaging experiment into a day.

# A minimal MHS-style device descriptor (JSON) for a temperature-controlled stage.
{
  "device": "thermo-stage-01",
  "driver": "mhs.driver.thermo",
  "primitives": ["read", "write", "discover"],
  "limits": {
    "temperature_c": {"min": 4.0, "max": 60.0, "step": 0.1},
    "max_write_rate_per_min": 3
  },
  "read_only": ["sensor_temperature_c", "firmware"],
  "safety": {"interlock": "door_closed", "auto_stop_above_c": 65.0}
}

2. The Core of the Standard: Read, Write, and Discovery

MHS keeps the driver abstraction deliberately tiny: read fetches state, such as the current temperature; write changes state, such as a setpoint; discovery lets devices and agents find each other across a network without a translator in between. Each device declares its supported primitives, ranges, and limits in a descriptor file. The design borrows from operating-system driver layers: expose a stable interface upward, hide vendor differences downward. To an agent, operating a temperature-controlled stage is no different from calling an API, except for the added constraints of the physical world, ranges, interlocks, and write-rate limits, and those constraints should be enforced by the driver, not left to the model's good behavior.

# Discovery: advertise a device so agents can find it without a translator.
# mDNS-style announce on the lab network.
import json, socket

def announce(descriptor, port=5353):
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
    msg = json.dumps({"type": "mhs.discover", "device": descriptor["device"], "port": port}).encode()
    sock.sendto(msg, ("255.255.255.255", port))

with open("thermo-stage.json") as f:
    announce(json.load(f))

3. Why Safety Limits Live Below the Model

Anthropic stresses that MHS launches as a research preview precisely because it does not want to open-source the standard before more safety evaluations are done. The most valuable design lesson is that safety limits are enforced at the driver layer, below the agent. The model plans; the driver vetoes: an out-of-range temperature is rejected outright, a setpoint change is refused while the chamber door is open, and excessive write frequency is throttled. That means even if a model is prompt-injected or behaves erratically, physical equipment stays behind a hard boundary that is independent of the model. For any physical-device automation you build, this principle should outrank model capability.

# The driver primitive surface: read, write, and a safety gate.
class ThermoDriver:
    def __init__(self, limits, interlock):
        self.limits = limits
        self.interlock = interlock

    def read(self, name):
        if name == "sensor_temperature_c":
            return self._sample_sensor()
        raise KeyError(name)

    def write(self, name, value):
        lo, hi = self.limits["temperature_c"]["min"], self.limits["temperature_c"]["max"]
        if not (lo <= value <= hi):
            raise ValueError(f"{value}C outside safe range [{lo}, {hi}]")
        if not self.interlock.closed():
            raise RuntimeError("door open: refusing setpoint change")
        self._set_setpoint(value)

4. The Device Descriptor: Write Capabilities and Constraints Down

The first step into an MHS-style setup is a machine-readable descriptor for your device: the driver type, supported primitives, min/max/step for every parameter, read-only fields, and interlock conditions. The descriptor is both the agent's instruction manual and the blueprint the driver validates against. In practice, put the descriptor under version control so any parameter or safety-policy change goes through code review; validate the JSON with a formatter, and checksum firmware and config manifests so a device never loads a tampered descriptor.

5. From Descriptor to Callable: Discovery and an MCP Tool

With a descriptor in hand, the second step is making the device discoverable and callable. On a local network, an mDNS-style broadcast lets a device announce itself periodically, and an agent that receives the descriptor knows which port to connect to. The third step is exposing driver methods as model-callable tools: Anthropic says MHS is model-agnostic and reachable through MCP, command-line tools, and APIs. The safest pattern is an MCP-style tool definition whose description and inputSchema spell out the safe ranges, because a precise tool description measurably reduces misuse. Verify every endpoint with an API tester before letting an agent touch it.

# Expose the device to an agent through an MCP-style tool definition.
{
  "tools": [
    {
      "name": "set_stage_temperature",
      "description": "Set the heated stage setpoint in Celsius. Fails if outside the safe range or if the chamber door is open.",
      "inputSchema": {
        "type": "object",
        "properties": {"celsius": {"type": "number", "minimum": 4, "maximum": 60}},
        "required": ["celsius"]
      }
    }
  ]
}

6. Three Practical Takeaways for Your Team

Three practical takeaways follow from the pilots. First, do not wait for the standard to be formally open-sourced: the read/write/discovery primitives are usable in your own device integrations today at near-zero cost. Second, treat driver-level vetoes as a hard requirement: every write must pass range checks, interlock checks, and rate limits; ten extra lines of defensive code beat betting on a model's judgment. Third, audit agent operations: record who changed which device from what value to what value and when, ideally in the same log pipeline you already run for API traffic, so any incident can be replayed and any safety review has evidence. Start with one non-critical instrument, such as a test rig or a development chamber, prove the descriptor, discovery, and approval loop on it for two weeks, and only then extend the pattern to equipment that touches production work. The physical world has no Ctrl+Z, and slow and steady is the only kind of fast that survives contact with hardware.

# Agent-side guardrails: never call write twice without a read, and cap write rate.
class WritePolicy:
    def __init__(self, max_per_min=3):
        self.max_per_min = max_per_min
        self.times = []

    def allow(self):
        import time
        now = time.time()
        self.times = [t for t in self.times if now - t < 60]
        if len(self.times) >= self.max_per_min:
            return False
        self.times.append(now)
        return True

assert WritePolicy(max_per_min=2).allow() is True