harness-mcp-v2 3.2.16 → 3.2.18

package/README.md

@@ -2,7 +2,7 @@
 
 [![MCP Toplist](https://mcptoplist.com/badge/glama%2Fharness%2Fmcp-server.svg)](https://mcptoplist.com/server/glama%2Fharness%2Fmcp-server)
 
-An MCP (Model Context Protocol) server that gives AI agents full access to the Harness.io platform through 11 consolidated tools and 216 resource types.
+An MCP (Model Context Protocol) server that gives AI agents full access to the Harness.io platform through 11 consolidated tools and 220 resource types.
 
 ## Why Use This MCP Server
 
@@ -10,8 +10,8 @@ Most MCP servers map one tool per API endpoint. For a platform as broad as Harne
 
 This server is built differently:
 
-- **11 tools, 216 resource types.** A registry-based dispatch system routes `harness_list`, `harness_get`, `harness_create`, etc. to any Harness resource — pipelines, services, environments, orgs, projects, feature flags, cost data, and more. The LLM picks from 11 tools instead of hundreds.
-- **Full platform coverage.** 37 default toolsets spanning CI/CD, GitOps, Feature Flags, Cloud Cost Management, Security Testing, Chaos Engineering, Database DevOps, Internal Developer Portal, Software Supply Chain, Infrastructure as Code Management, Governance, Service Overrides, Knowledge Graph, and more. Opt-in Ansible coverage is available when you need inventory and playbook data.
+- **11 tools, 220 resource types.** A registry-based dispatch system routes `harness_list`, `harness_get`, `harness_create`, etc. to any Harness resource — pipelines, services, environments, orgs, projects, feature flags, cost data, and more. The LLM picks from 11 tools instead of hundreds.
+- **Full platform coverage.** 38 default toolsets spanning CI/CD, GitOps, Feature Flags, Cloud Cost Management, Security Testing, Chaos Engineering, Database DevOps, Internal Developer Portal, Software Supply Chain, Infrastructure as Code Management, Governance, Service Overrides, Knowledge Graph, and more. Opt-in Ansible coverage is available when you need inventory and playbook data.
 - **Multi-project workflows out of the box.** Agents discover organizations and projects dynamically — no hardcoded env vars needed. Ask "show failed executions across all projects" and the agent can navigate the full account hierarchy.
 - **34 prompt templates.** Pre-built prompts for common workflows: build & deploy apps end-to-end, debug failed pipelines, review DORA metrics, triage vulnerabilities, optimize cloud costs, audit access control, plan feature flag rollouts, review pull requests, approve pending pipelines, and more.
 - **Works everywhere.** Stdio transport for local clients (Claude Desktop, Cursor, Devin Desktop), HTTP transport for remote/shared deployments, Docker and Kubernetes ready.
@@ -132,7 +132,7 @@ Operational constraints in HTTP mode:
 - `POST /mcp` without `mcp-session-id` must be an `initialize` request.
 - `POST /mcp`, `GET /mcp`, and `DELETE /mcp` for existing sessions require the `mcp-session-id` header.
 - `GET /mcp` is used for SSE notifications (progress updates and elicitation prompts).
-- Idle sessions are reaped after `MCP_SESSION_TTL_MS` milliseconds once no request or SSE stream is active (default `300000`, or 5 minutes).
+- Idle sessions are reaped after `MCP_SESSION_TTL_MS` milliseconds once no request or SSE stream is active (default `1800000`, or 30 minutes).
 - `GET /health` is the only non-MCP endpoint.
 - Request body size is capped by `HARNESS_MAX_BODY_SIZE_MB` (default `10` MB).
 - Set `x-harness-pipeline-version: 0` or `1` on the `initialize` request to select V0 or V1 pipeline resources for that HTTP session.
@@ -555,7 +555,9 @@ The server automatically loads environment variables from a `.env` file in the p
 | `HARNESS_MCP_ALLOWED_HOSTS` | No       | --                          | Comma-separated hostnames allowed by HTTP transport Host-header validation. `mcp.harness.io` is allowed by default for localhost binds; add proxy/custom domains here                                                                                 |
 | `HARNESS_MCP_AUTH_TOKEN`    | No       | --                          | Bearer token required on `/mcp` HTTP routes when set. Required by default when HTTP transport binds to a non-loopback host                                                                                                                             |
 | `HARNESS_MCP_ALLOW_UNAUTHENTICATED_HTTP` | No | `false`         | Explicitly allow unauthenticated HTTP transport on non-loopback binds. Use only behind another authenticated control                                                                                                                                    |
+| `HARNESS_MCP_TRUST_PROXY`   | No       | `0`                         | Number of reverse proxy / load balancer hops to trust for client IP resolution (Express `trust proxy`). Set to the proxy count in front of the server so per-IP rate limiting keys on the real client rather than the proxy socket peer                |
 | `HARNESS_MCP_LOG_FILE`      | No       | `~/.claude/harness-mcp.log` | File used for stdio disconnect/crash diagnostics when stderr may no longer be available                                                                                                                                                               |
+| `HARNESS_LOG_UNSAFE_BODIES` | No       | `false`                     | Include raw request/response bodies in logs. Off by default since bodies can contain secrets; enable only for local debugging                                                                                                                          |
 | `HARNESS_AUDIT_FILE`        | No       | --                          | Append audit events to a newline-delimited JSON file for durable local collection                                                                                                                                                                      |
 | `HARNESS_AUDIT_WEBHOOK_URL` | No       | --                          | HTTPS endpoint that receives batched audit events. HTTP URLs require `HARNESS_ALLOW_HTTP=true` for local development                                                                                                                                   |
 | `HARNESS_AUDIT_WEBHOOK_TOKEN` | No     | --                          | Optional bearer token sent to the audit webhook                                                                                                                                                                                                        |
@@ -566,6 +568,7 @@ The server automatically loads environment variables from a `.env` file in the p
 | `HARNESS_SEARCH_SERVICE_URL` | No      | --                          | Base URL of the remote search service when `HARNESS_SEARCH_PROVIDER=remote` (e.g. `http://search-svc:8080`). Required when using the `remote` provider |
 | `HARNESS_SEARCH_SERVICE_HEADERS` | No  | --                          | JSON object of headers sent with every request to the remote search service. Supports any auth scheme: `{"Authorization":"Bearer tok"}`, `{"x-api-key":"key"}`, or multiple internal service-to-service headers |
 | `HARNESS_HF_CACHE_DIR`      | No       | `/tmp/hf-cache`             | Directory for the `@huggingface/transformers` model cache used by the `local` search provider. The Docker image pre-bakes the model into `/app/.cache/hf` to avoid runtime downloads. Set to a persistent volume path in production deployments       |
+| `HARNESS_DIAGNOSE_LOG_FETCH_CONCURRENCY` | No | `3`              | Max concurrent log-blob downloads issued by `harness_diagnose` when fetching logs for failed steps. Increase only if diagnose latency is dominated by log-fetch wall-clock and the pod has memory headroom                                              |
 
 
 ### Semantic Search
@@ -1199,7 +1202,7 @@ Harness pipelines can be stored in three ways:
 
 ## Resource Types
 
-216 resource types organized across 37 toolsets. Each resource type supports a subset of CRUD operations and optional execute actions.
+220 resource types organized across 38 toolsets. Each resource type supports a subset of CRUD operations and optional execute actions.
 
 ### Platform
 
@@ -1509,38 +1512,40 @@ Use `harness_execute(resource_type="pull_request", action="close", ...)` for an
 ### Chaos Engineering
 
 
-| Resource Type                | List | Get | Create | Update | Delete | Execute Actions        |
-| ---------------------------- | ---- | --- | ------ | ------ | ------ | ---------------------- |
-| `chaos_experiment`           | x    | x   | x      |        | x      | `run`, `stop`          |
-| `chaos_experiment_run`       |      | x   |        |        |        |                        |
-| `chaos_experiment_variable`  | x    |     |        |        |        |                        |
-| `chaos_component_variable`   |      | x   |        |        |        |                        |
-| `chaos_input_set`            | x    | x   | x      | x      | x      |                        |
-| `chaos_experiment_template`  | x    | x   |        |        | x      | `create_from_template` |
-| `chaos_probe`                | x    | x   | x      |        | x      | `enable`, `verify`     |
-| `chaos_probe_in_run`         | x    |     |        |        |        |                        |
-| `chaos_probe_template`       | x    | x   |        |        | x      |                        |
-| `chaos_infrastructure`       | x    |     |        |        |        |                        |
-| `chaos_k8s_infrastructure`   | x    | x   |        |        |        | `check_health`         |
-| `chaos_environment`          | x    |     |        |        |        |                        |
-| `chaos_hub`                  | x    | x   | x      | x      | x      |                        |
-| `chaos_hub_fault`            | x    |     |        |        |        |                        |
-| `chaos_fault`                | x    | x   |        |        | x      |                        |
-| `chaos_fault_template`       | x    | x   |        |        | x      |                        |
-| `chaos_fault_experiment_run` | x    |     |        |        |        |                        |
-| `chaos_action`               | x    | x   |        |        | x      |                        |
-| `chaos_action_template`      | x    | x   |        |        | x      |                        |
-| `chaos_loadtest`             | x    | x   | x      |        | x      | `run`, `stop`          |
-| `chaos_application_map`      | x    | x   |        |        |        |                        |
-| `discovered_namespace`       | x    |     |        |        |        |                        |
-| `discovered_service`         | x    |     |        |        |        |                        |
-| `discovered_network_map`     | x    |     |        |        |        |                        |
-| `chaos_guard_condition`      | x    | x   |        |        | x      |                        |
-| `chaos_guard_rule`           | x    | x   |        |        | x      | `enable`               |
-| `chaos_recommendation`       | x    | x   |        |        |        |                        |
-| `chaos_risk`                 | x    | x   |        |        |        |                        |
-| `chaos_dr_test`              | x    |     | x      |        |        |                        |
-
+| Resource Type                | List | Get | Create | Update | Delete | Execute Actions                                          |
+|------------------------------| ---- | --- | ------ | ------ | ------ |----------------------------------------------------------|
+| `chaos_experiment`           | x    | x   | x      |        | x      | `run`, `stop`                                            |
+| `chaos_experiment_run`       |      | x   |        |        |        |                                                          |
+| `chaos_experiment_variable`  | x    |     |        |        |        |                                                          |
+| `chaos_component_variable`   |      | x   |        |        |        |                                                          |
+| `chaos_input_set`            | x    | x   | x      | x      | x      |                                                          |
+| `chaos_experiment_template`  | x    | x   |        |        | x      | `create_from_template`                                   |
+| `chaos_probe`                | x    | x   | x      |        | x      | `enable`, `verify`                                       |
+| `chaos_probe_in_run`         | x    |     |        |        |        |                                                          |
+| `chaos_probe_template`       | x    | x   |        |        | x      |                                                          |
+| `chaos_infrastructure`       | x    |     |        |        |        |                                                          |
+| `chaos_k8s_infrastructure`   | x    | x   |        |        |        | `check_health`                                           |
+| `chaos_environment`          | x    |     |        |        |        |                                                          |
+| `chaos_hub`                  | x    | x   | x      | x      | x      |                                                          |
+| `chaos_hub_fault`            | x    |     |        |        |        |                                                          |
+| `chaos_fault`                | x    | x   |        |        | x      |                                                          |
+| `chaos_fault_template`       | x    | x   |        |        | x      |                                                          |
+| `chaos_fault_experiment_run` | x    |     |        |        |        |                                                          |
+| `chaos_action`               | x    | x   |        |        | x      |                                                          |
+| `chaos_action_template`      | x    | x   |        |        | x      |                                                          |
+| `chaos_loadtest`             | x    | x   | x      |        | x      | `run`, `stop`                                            |
+| `chaos_application_map`      | x    | x   |        |        |        |                                                          |
+| `discovered_namespace`       | x    |     |        |        |        |                                                          |
+| `discovered_service`         | x    |     |        |        |        |                                                          |
+| `discovered_network_map`     | x    |     |        |        |        |                                                          |
+| `chaos_guard_condition`      | x    | x   |        |        | x      |                                                          |
+| `chaos_guard_rule`           | x    | x   |        |        | x      | `enable`                                                 |
+| `chaos_recommendation`       | x    | x   |        |        |        |                                                          |
+| `chaos_risk`                 | x    | x   |        |        |        |                                                          |
+| `chaos_dr_test`              | x    |     | x      |        |        |                                                          |
+| `scanned_risk`               | x    | x   |        |        |        | `occurrences`, `summary_by_service`                      |
+| `chaos_risk_rule`            | x    | x   |        |        |        |                                                          |
+| `chaos_risk_scan`            | x    | x   | x      | x      | x      | `retry`, `abort`, `report`, `report_download`, `heatmap` |
 
 ### Cloud Cost Management (CCM)
 
@@ -1598,6 +1603,17 @@ SEI resources are consolidated for token efficiency. Use `metric` or `aspect` pa
 | `scs_sbom`                 |      | x   |        |        |        |                 |
 
 
+### Evidence Vault
+
+Evidence Vault stores in-toto attestations (SDLC evidences). List supports account/org/project scope via `resource_scope`. Singular free-text filters (pipeline, artifact alone, gitoid) use `search_term`; an additional Name constraint uses `filters.subject_name`; subject content digest uses `filters.subject_digest`. Get looks up by `gitoid_sha256` and requires `org_id`/`project_id` (from the list row). Download (`harness_execute` action `download`) returns a time-limited `download_url` — always show that link to the user. Requires feature flag `SCS_EVIDENCE_VAULT`.
+
+
+| Resource Type | List | Get | Create | Update | Delete | Execute Actions |
+| ------------- | ---- | --- | ------ | ------ | ------ | --------------- |
+| `attestation` | x    | x   |        |        |        | `download`      |
+
+
+
 ### Security Testing Orchestration (STO)
 
 
@@ -1743,7 +1759,7 @@ Security exemption execute workflow:
 
 ## Toolset Filtering
 
-By default, 37 of 38 toolsets are enabled. One toolset is opt-in and excluded from the defaults:
+By default, 38 of 39 toolsets are enabled. One toolset is opt-in and excluded from the defaults:
 
 - **`ansible`** — Harness Ansible (inventories, playbooks, hosts, activity). Opt-in because it is project-scoped and adds concepts many users do not need.
 
@@ -1806,10 +1822,11 @@ Available toolset names:
 | `pull-requests`         | pull_request, pr_reviewer, pr_comment, pr_check, pr_activity                                                                                                                                                                                                                                    |
 | `feature-flags`         | fme_workspace, fme_environment, fme_feature_flag, fme_feature_flag_definition, fme_rollout_status, fme_rule_based_segment, fme_rule_based_segment_definition, fme_traffic_type, fme_identity, fme_standard_segment, fme_segment_keys                                                           |
 | `gitops`                | gitops_agent, gitops_application, gitops_cluster, gitops_repository, gitops_applicationset, gitops_repo_credential, gitops_app_event, gitops_pod_log, gitops_managed_resource, gitops_resource_action, gitops_dashboard, gitops_app_resource_tree                                               |
-| `chaos`                 | chaos_experiment, chaos_experiment_run, chaos_experiment_variable, chaos_component_variable, chaos_input_set, chaos_experiment_template, chaos_probe, chaos_probe_in_run, chaos_probe_template, chaos_infrastructure, chaos_k8s_infrastructure, chaos_environment, chaos_hub, chaos_hub_fault, chaos_fault, chaos_fault_template, chaos_fault_experiment_run, chaos_action, chaos_action_template, chaos_loadtest, chaos_application_map, discovered_namespace, discovered_service, discovered_network_map, chaos_guard_condition, chaos_guard_rule, chaos_recommendation, chaos_risk, chaos_dr_test |
+| `chaos`                 | chaos_experiment, chaos_experiment_run, chaos_experiment_variable, chaos_component_variable, chaos_input_set, chaos_experiment_template, chaos_probe, chaos_probe_in_run, chaos_probe_template, chaos_infrastructure, chaos_k8s_infrastructure, chaos_environment, chaos_hub, chaos_hub_fault, chaos_fault, chaos_fault_template, chaos_fault_experiment_run, chaos_action, chaos_action_template, chaos_loadtest, chaos_application_map, discovered_namespace, discovered_service, discovered_network_map, chaos_guard_condition, chaos_guard_rule, chaos_recommendation, chaos_risk, chaos_dr_test, scanned_risk, chaos_risk_rule, chaos_risk_scan |
 | `ccm`                   | cost_perspective, cost_breakdown, cost_timeseries, cost_summary, cost_recommendation, cost_anomaly, cost_anomaly_summary, cost_category, cost_account_overview, cost_filter_value, cost_recommendation_stats, cost_recommendation_detail, cost_commitment                                       |
 | `sei`                   | sei_metric, sei_productivity_metric, sei_dora_metric, sei_team, sei_team_detail, sei_org_tree, sei_org_tree_detail, sei_business_alignment, sei_ai_usage, sei_ai_adoption, sei_ai_impact, sei_ai_raw_metric                                                                                     |
 | `scs`                   | scs_artifact_source, artifact_security, scs_artifact_component, scs_artifact_remediation, scs_chain_of_custody, scs_compliance_result, code_repo_security, scs_sbom                                                                                                                             |
+| `evidence-vault`        | attestation                                                                                                                                                                                                                                                                                     |
 | `sto`                   | security_issue, security_issue_filter, security_exemption, sast_remediation_diff                                                                                                                                                                                                                |
 | `dbops`                 | database_schema, database_instance, database_snapshot_object, database_llm_authoring_pipeline                                                                                                                                                                                                   |
 | `access_control`        | user, user_group, service_account, role, role_assignment, resource_group, permission                                                                                                                                                                                                            |
@@ -1839,8 +1856,8 @@ Available toolset names:
                           |
                  +--------v---------+
                 |    Registry       |  <-- Declarative resource definitions
-                |  37 Toolsets      |      (data files, not code)
-                |  216 Resource Types|
+                |  38 Toolsets      |      (data files, not code)
+                |  220 Resource Types|
                  +--------+---------+
                           |
                  +--------v---------+

package/build/data/schemas/v0/pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../../src/data/schemas/v0/pipeline.ts"],"names":[],"mappings":"AAGA,QAAA,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAm7uH/B,CAAC;AACF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../../src/data/schemas/v0/pipeline.ts"],"names":[],"mappings":"AAGA,QAAA,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAk1vH/B,CAAC;AACF,eAAe,MAAM,CAAC"}