Harness MCP Server
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| LOG_LEVEL | No | Log verbosity: debug, info, warn, error. | info |
| HARNESS_ORG | No | Organization ID. Used when org_id is not specified per tool call. If omitted, org_id must be provided explicitly. Agents can also discover orgs dynamically via harness_list(resource_type="organization"). | |
| HARNESS_API_KEY | No | Harness personal access token or service account token. Required in single-user mode. Must NOT be set in multi-user mode. | |
| HARNESS_PROJECT | No | Project ID. Used when project_id is not specified per tool call. Agents can also discover projects dynamically via harness_list(resource_type="project"). | |
| HARNESS_BASE_URL | No | Harness API/UI base URL for local stdio or self-hosted HTTP deployments. Set this to environments such as https://harness0.harness.io when running the server yourself. It does not affect the managed https://mcp.harness.io/mcp hosted endpoint. | https://app.harness.io |
| HARNESS_MCP_MODE | No | Deployment mode: single-user (API key in config, used for all sessions) or multi-user (HTTP only, per-session credentials via x-harness-api-key and optional x-harness-account-id headers) | single-user |
| HARNESS_TOOLSETS | No | Comma-separated toolset list. Empty loads default toolsets. Supports +name to explicitly include opt-in toolsets and -name to remove defaults. | |
| HARNESS_READ_ONLY | No | Block all mutating operations (create, update, delete, execute). Only list and get are allowed. | false |
| HARNESS_ACCOUNT_ID | No | Harness account identifier. Auto-extracted from PAT/SAT tokens in single-user mode; multi-user sessions can provide their own via x-harness-account-id when the API key does not embed one. | |
| HARNESS_ALLOW_HTTP | No | Allow non-HTTPS HARNESS_BASE_URL. Set to true only for local development against a non-TLS Harness instance. | false |
| HARNESS_AUDIT_FILE | No | Append audit events to a newline-delimited JSON file in addition to stderr. | |
| HARNESS_MAX_RETRIES | No | Retry count for transient failures (429, 5xx). | 3 |
| HARNESS_MCP_LOG_FILE | No | File used for stdio disconnect/crash diagnostics when stderr may no longer be available. | ~/.claude/harness-mcp.log |
| HARNESS_API_TIMEOUT_MS | No | HTTP request timeout in milliseconds. | 30000 |
| HARNESS_MCP_AUTH_TOKEN | No | Bearer token required on /mcp HTTP routes when set. Required by default when HTTP transport binds to a non-loopback host. | |
| HARNESS_RATE_LIMIT_RPS | No | Client-side request throttle (requests per second) to Harness APIs. | 10 |
| HARNESS_MAX_BODY_SIZE_MB | No | Max HTTP request body size in MB for http transport. | 10 |
| HARNESS_PIPELINE_VERSION | No | (Alpha) Pipeline YAML version. 0 loads the pipeline resource type and excludes pipeline_v1; 1 loads pipeline_v1 and excludes pipeline. | 0 |
| HARNESS_SKIP_ELICITATION | No | Deprecated — use HARNESS_AUTO_APPROVE_RISK=all instead. Kept for backward compatibility. | false |
| HARNESS_AUDIT_WEBHOOK_URL | No | HTTPS endpoint that receives batched audit events. HTTP URLs require HARNESS_ALLOW_HTTP=true for local development. | |
| HARNESS_AUTO_APPROVE_RISK | No | Risk-based auto-approve threshold for autonomous workflows. Values: none, low_write, medium_write, high_write, all. | none |
| HARNESS_MCP_ALLOWED_HOSTS | No | Comma-separated hostnames allowed by HTTP transport Host-header validation. mcp.harness.io is allowed by default for localhost binds; add proxy/custom domains here. | |
| HARNESS_AUDIT_WEBHOOK_TOKEN | No | Optional bearer token sent to the audit webhook. | |
| OTEL_EXPORTER_OTLP_ENDPOINT | No | Enables OpenTelemetry audit spans when the optional OpenTelemetry packages are installed. | |
| HARNESS_AUDIT_WEBHOOK_FLUSH_MS | No | Max time to hold audit events before webhook flush. | 5000 |
| HARNESS_AUDIT_WEBHOOK_BATCH_SIZE | No | Number of audit events to batch before webhook flush. | 10 |
| HARNESS_MCP_ALLOW_UNAUTHENTICATED_HTTP | No | Explicitly allow unauthenticated HTTP transport on non-loopback binds. Use only behind another authenticated control. | false |
Capabilities
Features and capabilities supported by this server
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
| completions | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| harness_listA | List Harness resources with filtering and pagination. Accepts a Harness URL to auto-extract scope. |
| harness_getA | Get a Harness resource by ID. Accepts a Harness URL to auto-extract identifiers. For failure analysis, prefer harness_diagnose. |
| harness_createA | Create a Harness resource. For pipelines/input sets: pass body as a YAML string directly (recommended for complex definitions), or use body.yamlPipeline (YAML string), or body.pipeline (JSON object). For remote pipelines, pass git details in params: external Git (store_type='REMOTE', connector_ref, repo_name, branch, file_path) or Harness Code (store_type='REMOTE', is_harness_code_repo=true, repo_name, branch, file_path). For others: call harness_describe for the body format. |
| harness_updateA | Update an existing Harness resource. For pipelines/input sets: pass body as a YAML string directly (recommended for complex definitions), or use body.yamlPipeline/body.pipeline. You can pass a Harness URL to auto-extract identifiers. Response includes openInHarness link to the updated resource when applicable. |
| harness_deleteA | Delete a Harness resource. You can pass a Harness URL to auto-extract identifiers. This is destructive and cannot be undone. |
| harness_executeA | Execute an action on a Harness resource: run/retry/interrupt pipelines, kill/restore FME feature flags, test connectors, sync GitOps apps, run chaos experiments. You can pass a Harness URL to auto-extract identifiers. Pass |
| harness_diagnoseA | Diagnose a Harness resource — analyze failures, test connectivity, check health, or troubleshoot GitOps sync issues. Defaults to pipeline execution diagnosis. Accepts a Harness URL to auto-detect the resource type. |
| harness_searchA | Search across multiple Harness resource types. Returns results ranked by relevance. Accepts a Harness URL for scope. |
| harness_describeA | Describe available Harness resource types, their supported operations, and fields. No API call — returns local metadata only. Use this to discover what resource_types you can use with other harness_ tools. |
| harness_statusA | Get a live project health overview: recent failed executions, currently running executions, and recent deployment activity. You can pass a Harness URL to auto-extract org and project. Ideal first question: 'what's happening in my project right now?' |
| harness_schemaA | Fetch Harness YAML schema or examples for a resource type. Pipeline/template schemas are bundled from harness-schema; connector, environment, service, secret, and infrastructure schemas are fetched live from NG /yaml-schema (pass scope, org_id, project_id). Use without path for a summary of fields and available sections. Use with path to drill into a specific section. Use with example to fetch a named example YAML snippet. Use with example_search to find examples by keyword. Precedence: example > example_search > path > summary. Available schemas: pipeline, template, trigger, pipeline_v1, template_v1, inputSet_v1, overlayInputSet_v1, agent-pipeline, connector, environment, service, secret, infrastructure. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| debug-pipeline-failure | Analyze a failed pipeline execution and suggest fixes. Accepts an execution ID, pipeline ID, or Harness URL. |
| create-pipeline | Generate a new Harness pipeline YAML from requirements |
| create-agent | Create and update Harness AI agent instances - standalone templates used as building blocks in pipelines. Agents contain a single agent step with connector-driven architecture requiring llmConnector (LLM access) and optional mcpConnectors (GitHub, Slack, Harness platform). Supports runtime inputs and task/rules-based instruction. |
| optimize-costs | Analyze cloud cost data and recommend optimizations for a Harness project |
| security-review | Review security issues across Harness resources and suggest remediations |
| onboard-service | Walk through onboarding a new service into Harness with environments and a deployment pipeline |
| dora-metrics-review | Review DORA metrics (deployment frequency, change failure rate, MTTR, lead time) and suggest improvements |
| setup-gitops-application | Guide through onboarding a GitOps application — verify agent, cluster, repo, and create the application |
| chaos-resilience-test | Design and run a chaos experiment to test service resilience |
| feature-flag-rollout | Plan and execute a progressive FME feature flag rollout across environments |
| migrate-pipeline-to-template | Analyze an existing pipeline and extract reusable stage/step templates from it |
| delegate-health-check | Check delegate connectivity, health, and token status with troubleshooting guidance |
| developer-portal-scorecard | Review IDP scorecards for services and identify gaps to improve developer experience |
| cloud-cost-breakdown | Deep-dive into cloud costs by service, environment, or cluster with trend analysis |
| commitment-utilization-review | Analyze reserved instance and savings plan utilization to find waste and optimize commitments |
| cost-anomaly-investigation | Investigate cost anomalies — determine root cause, impacted resources, and remediation |
| rightsizing-recommendations | Review and prioritize rightsizing recommendations, optionally create Jira or ServiceNow tickets |
| vulnerability-triage | Triage security vulnerabilities across pipelines and artifacts, prioritize by severity and exploitability |
| sbom-compliance-check | Audit SBOM and compliance posture for artifacts — license risks, policy violations, component vulnerabilities |
| supply-chain-audit | End-to-end software supply chain security audit — provenance, chain of custody, policy compliance |
| security-exemption-review | Review pending security exemptions and make batch approval or rejection decisions |
| bulk-exemption-create | Create STO security exemptions in bulk from issue filters or explicit issue IDs. Optimized for repeated component-level exemptions. |
| exempt-opa-failed-issues | Create STO security exemptions for the issues that caused an OPA Policy step to fail a pipeline execution. Reads policy_evaluation results for the execution, pulls the execution's Pipeline Security issues + scan steps, correlates the deny signals to specific issue_ids, asks for confirmation, then bulk-creates exemptions. |
| access-control-audit | Audit user permissions, over-privileged accounts, and role assignments to enforce least-privilege |
| code-review | Review a Harness Code pull request — analyze diff, commits, checks, and comments to provide structured feedback |
| pr-summary | Auto-generate a pull request title and description from the commit history and diff of a branch |
| branch-cleanup | Analyze branches in a repository and recommend stale or merged branches to delete |
| pending-approvals | Find pipeline executions waiting for approval and present them for action |
| build-deploy-app | End-to-end workflow: scan a repo, generate CI/CD pipelines in Harness, build a Docker image, generate K8s manifests, and deploy |
| summarize-pipeline | Summarize an entire pipeline execution — all steps, statuses, durations, and logs. Accepts an execution ID, pipeline ID, or Harness URL. |
| add-metric | Step-by-step: add a new metric to the open-source harness-evals SDK and optionally register it in the ai-evals control plane |
| run-evaluation | Use AI Evals MCP resources to discover or create datasets, targets, metrics, wire an evaluation, and trigger a run |
| create-eval-suite | Build a multi-evaluation suite in AI Evals: create suite, add members, optional suite run |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| execution-summary | Recent pipeline execution summaries (last 10). |
| pipeline schema | Harness JSON Schema definitions (bundled). Valid schema names: pipeline, template, trigger, pipeline_v1, template_v1, inputSet_v1, overlayInputSet_v1, agent-pipeline. For connector, environment, service, secret, and infrastructure schemas, use the harness_schema tool (live fetch from NG /yaml-schema) — they are not available via schema:/// resources. |
| template schema | Harness JSON Schema definitions (bundled). Valid schema names: pipeline, template, trigger, pipeline_v1, template_v1, inputSet_v1, overlayInputSet_v1, agent-pipeline. For connector, environment, service, secret, and infrastructure schemas, use the harness_schema tool (live fetch from NG /yaml-schema) — they are not available via schema:/// resources. |
| trigger schema | Harness JSON Schema definitions (bundled). Valid schema names: pipeline, template, trigger, pipeline_v1, template_v1, inputSet_v1, overlayInputSet_v1, agent-pipeline. For connector, environment, service, secret, and infrastructure schemas, use the harness_schema tool (live fetch from NG /yaml-schema) — they are not available via schema:/// resources. |
| pipeline_v1 schema | Harness JSON Schema definitions (bundled). Valid schema names: pipeline, template, trigger, pipeline_v1, template_v1, inputSet_v1, overlayInputSet_v1, agent-pipeline. For connector, environment, service, secret, and infrastructure schemas, use the harness_schema tool (live fetch from NG /yaml-schema) — they are not available via schema:/// resources. |
| template_v1 schema | Harness JSON Schema definitions (bundled). Valid schema names: pipeline, template, trigger, pipeline_v1, template_v1, inputSet_v1, overlayInputSet_v1, agent-pipeline. For connector, environment, service, secret, and infrastructure schemas, use the harness_schema tool (live fetch from NG /yaml-schema) — they are not available via schema:/// resources. |
| inputSet_v1 schema | Harness JSON Schema definitions (bundled). Valid schema names: pipeline, template, trigger, pipeline_v1, template_v1, inputSet_v1, overlayInputSet_v1, agent-pipeline. For connector, environment, service, secret, and infrastructure schemas, use the harness_schema tool (live fetch from NG /yaml-schema) — they are not available via schema:/// resources. |
| overlayInputSet_v1 schema | Harness JSON Schema definitions (bundled). Valid schema names: pipeline, template, trigger, pipeline_v1, template_v1, inputSet_v1, overlayInputSet_v1, agent-pipeline. For connector, environment, service, secret, and infrastructure schemas, use the harness_schema tool (live fetch from NG /yaml-schema) — they are not available via schema:/// resources. |
| agent-pipeline schema | Harness JSON Schema definitions (bundled). Valid schema names: pipeline, template, trigger, pipeline_v1, template_v1, inputSet_v1, overlayInputSet_v1, agent-pipeline. For connector, environment, service, secret, and infrastructure schemas, use the harness_schema tool (live fetch from NG /yaml-schema) — they are not available via schema:/// resources. |
Latest Blog Posts
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/harness/mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server