harness-mcp-v2 3.2.17 → 3.2.19

package/README.md

@@ -2,7 +2,7 @@
 
 [![MCP Toplist](https://mcptoplist.com/badge/glama%2Fharness%2Fmcp-server.svg)](https://mcptoplist.com/server/glama%2Fharness%2Fmcp-server)
 
-An MCP (Model Context Protocol) server that gives AI agents full access to the Harness.io platform through 11 consolidated tools and 220 resource types.
+An MCP (Model Context Protocol) server that gives AI agents full access to the Harness.io platform through 11 consolidated tools and 223 resource types.
 
 ## Why Use This MCP Server
 
@@ -10,7 +10,7 @@ Most MCP servers map one tool per API endpoint. For a platform as broad as Harne
 
 This server is built differently:
 
-- **11 tools, 220 resource types.** A registry-based dispatch system routes `harness_list`, `harness_get`, `harness_create`, etc. to any Harness resource — pipelines, services, environments, orgs, projects, feature flags, cost data, and more. The LLM picks from 11 tools instead of hundreds.
+- **11 tools, 223 resource types.** A registry-based dispatch system routes `harness_list`, `harness_get`, `harness_create`, etc. to any Harness resource — pipelines, services, environments, orgs, projects, feature flags, cost data, and more. The LLM picks from 11 tools instead of hundreds.
 - **Full platform coverage.** 38 default toolsets spanning CI/CD, GitOps, Feature Flags, Cloud Cost Management, Security Testing, Chaos Engineering, Database DevOps, Internal Developer Portal, Software Supply Chain, Infrastructure as Code Management, Governance, Service Overrides, Knowledge Graph, and more. Opt-in Ansible coverage is available when you need inventory and playbook data.
 - **Multi-project workflows out of the box.** Agents discover organizations and projects dynamically — no hardcoded env vars needed. Ask "show failed executions across all projects" and the agent can navigate the full account hierarchy.
 - **34 prompt templates.** Pre-built prompts for common workflows: build & deploy apps end-to-end, debug failed pipelines, review DORA metrics, triage vulnerabilities, optimize cloud costs, audit access control, plan feature flag rollouts, review pull requests, approve pending pipelines, and more.
@@ -132,7 +132,7 @@ Operational constraints in HTTP mode:
 - `POST /mcp` without `mcp-session-id` must be an `initialize` request.
 - `POST /mcp`, `GET /mcp`, and `DELETE /mcp` for existing sessions require the `mcp-session-id` header.
 - `GET /mcp` is used for SSE notifications (progress updates and elicitation prompts).
-- Idle sessions are reaped after `MCP_SESSION_TTL_MS` milliseconds once no request or SSE stream is active (default `300000`, or 5 minutes).
+- Idle sessions are reaped after `MCP_SESSION_TTL_MS` milliseconds once no request or SSE stream is active (default `1800000`, or 30 minutes).
 - `GET /health` is the only non-MCP endpoint.
 - Request body size is capped by `HARNESS_MAX_BODY_SIZE_MB` (default `10` MB).
 - Set `x-harness-pipeline-version: 0` or `1` on the `initialize` request to select V0 or V1 pipeline resources for that HTTP session.
@@ -555,7 +555,9 @@ The server automatically loads environment variables from a `.env` file in the p
 | `HARNESS_MCP_ALLOWED_HOSTS` | No       | --                          | Comma-separated hostnames allowed by HTTP transport Host-header validation. `mcp.harness.io` is allowed by default for localhost binds; add proxy/custom domains here                                                                                 |
 | `HARNESS_MCP_AUTH_TOKEN`    | No       | --                          | Bearer token required on `/mcp` HTTP routes when set. Required by default when HTTP transport binds to a non-loopback host                                                                                                                             |
 | `HARNESS_MCP_ALLOW_UNAUTHENTICATED_HTTP` | No | `false`         | Explicitly allow unauthenticated HTTP transport on non-loopback binds. Use only behind another authenticated control                                                                                                                                    |
+| `HARNESS_MCP_TRUST_PROXY`   | No       | `0`                         | Number of reverse proxy / load balancer hops to trust for client IP resolution (Express `trust proxy`). Set to the proxy count in front of the server so per-IP rate limiting keys on the real client rather than the proxy socket peer                |
 | `HARNESS_MCP_LOG_FILE`      | No       | `~/.claude/harness-mcp.log` | File used for stdio disconnect/crash diagnostics when stderr may no longer be available                                                                                                                                                               |
+| `HARNESS_LOG_UNSAFE_BODIES` | No       | `false`                     | Include raw request/response bodies in logs. Off by default since bodies can contain secrets; enable only for local debugging                                                                                                                          |
 | `HARNESS_AUDIT_FILE`        | No       | --                          | Append audit events to a newline-delimited JSON file for durable local collection                                                                                                                                                                      |
 | `HARNESS_AUDIT_WEBHOOK_URL` | No       | --                          | HTTPS endpoint that receives batched audit events. HTTP URLs require `HARNESS_ALLOW_HTTP=true` for local development                                                                                                                                   |
 | `HARNESS_AUDIT_WEBHOOK_TOKEN` | No     | --                          | Optional bearer token sent to the audit webhook                                                                                                                                                                                                        |
@@ -566,6 +568,7 @@ The server automatically loads environment variables from a `.env` file in the p
 | `HARNESS_SEARCH_SERVICE_URL` | No      | --                          | Base URL of the remote search service when `HARNESS_SEARCH_PROVIDER=remote` (e.g. `http://search-svc:8080`). Required when using the `remote` provider |
 | `HARNESS_SEARCH_SERVICE_HEADERS` | No  | --                          | JSON object of headers sent with every request to the remote search service. Supports any auth scheme: `{"Authorization":"Bearer tok"}`, `{"x-api-key":"key"}`, or multiple internal service-to-service headers |
 | `HARNESS_HF_CACHE_DIR`      | No       | `/tmp/hf-cache`             | Directory for the `@huggingface/transformers` model cache used by the `local` search provider. The Docker image pre-bakes the model into `/app/.cache/hf` to avoid runtime downloads. Set to a persistent volume path in production deployments       |
+| `HARNESS_DIAGNOSE_LOG_FETCH_CONCURRENCY` | No | `3`              | Max concurrent log-blob downloads issued by `harness_diagnose` when fetching logs for failed steps. Increase only if diagnose latency is dominated by log-fetch wall-clock and the pod has memory headroom                                              |
 
 
 ### Semantic Search
@@ -1199,7 +1202,7 @@ Harness pipelines can be stored in three ways:
 
 ## Resource Types
 
-220 resource types organized across 38 toolsets. Each resource type supports a subset of CRUD operations and optional execute actions.
+223 resource types organized across 38 toolsets. Each resource type supports a subset of CRUD operations and optional execute actions.
 
 ### Platform
 
@@ -1602,12 +1605,12 @@ SEI resources are consolidated for token efficiency. Use `metric` or `aspect` pa
 
 ### Evidence Vault
 
-Evidence Vault stores in-toto attestations (SDLC evidences). List supports account/org/project scope via `resource_scope`. Singular free-text filters (pipeline, artifact alone, gitoid) use `search_term`; an additional Name constraint uses `filters.subject_name`; subject content digest uses `filters.subject_digest`. Get looks up by `gitoid_sha256` and requires `org_id`/`project_id` (from the list row). Requires feature flag `SCS_EVIDENCE_VAULT`.
+Evidence Vault stores in-toto attestations (SDLC evidences). List supports account/org/project scope via `resource_scope`. Singular free-text filters (pipeline, artifact alone, gitoid) use `search_term`; an additional Name constraint uses `filters.subject_name`; subject content digest uses `filters.subject_digest`. Get looks up by `gitoid_sha256` and requires `org_id`/`project_id` (from the list row). Download (`harness_execute` action `download`) returns a time-limited `download_url` — always show that link to the user. Requires feature flag `SCS_EVIDENCE_VAULT`.
 
 
 | Resource Type | List | Get | Create | Update | Delete | Execute Actions |
 | ------------- | ---- | --- | ------ | ------ | ------ | --------------- |
-| `attestation` | x    | x   |        |        |        |                 |
+| `attestation` | x    | x   |        |        |        | `download`      |
 
 
 
@@ -1854,7 +1857,7 @@ Available toolset names:
                  +--------v---------+
                 |    Registry       |  <-- Declarative resource definitions
                 |  38 Toolsets      |      (data files, not code)
-                |  220 Resource Types|
+                |  223 Resource Types|
                  +--------+---------+
                           |
                  +--------v---------+

package/build/data/schemas/v0/pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../../src/data/schemas/v0/pipeline.ts"],"names":[],"mappings":"AAGA,QAAA,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAk1vH/B,CAAC;AACF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../../src/data/schemas/v0/pipeline.ts"],"names":[],"mappings":"AAGA,QAAA,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CA89vH/B,CAAC;AACF,eAAe,MAAM,CAAC"}

package/build/data/schemas/v0/pipeline.js

@@ -29255,7 +29255,8 @@ const schema = {
                                     "config": {
                                         "type": "string",
                                         "enum": [
-                                            "hunt",
+                                            "hunt_full",
+                                            "hunt_incremental",
                                             "scan"
                                         ]
                                     },
@@ -29381,7 +29382,8 @@ const schema = {
                             "config": {
                                 "type": "string",
                                 "enum": [
-                                    "hunt",
+                                    "hunt_full",
+                                    "hunt_incremental",
                                     "scan"
                                 ]
                             },
@@ -55662,6 +55664,18 @@ const schema = {
                                                 "minLength": 1
                                             }
                                         ]
+                                    },
+                                    "filters": {
+                                        "oneOf": [
+                                            {
+                                                "$ref": "#/definitions/pipeline/steps/iacm/AnsibleFilters"
+                                            },
+                                            {
+                                                "type": "string",
+                                                "pattern": "^<\\+input>((\\.)((executionInput\\(\\))|(allowedValues|default|regex)\\(.+?\\)))*$",
+                                                "minLength": 1
+                                            }
+                                        ]
                                     }
                                 }
                             }
@@ -55719,9 +55733,64 @@ const schema = {
                                 "items": {
                                     "$ref": "#/definitions/pipeline/steps/iacm/ImportCommandParameterField"
                                 }
+                            },
+                            "filters": {
+                                "oneOf": [
+                                    {
+                                        "$ref": "#/definitions/pipeline/steps/iacm/AnsibleFilters"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "pattern": "^<\\+input>((\\.)((executionInput\\(\\))|(allowedValues|default|regex)\\(.+?\\)))*$",
+                                        "minLength": 1
+                                    }
+                                ]
                             }
                         }
                     },
+                    "AnsibleFilters": {
+                        "title": "AnsibleFilters",
+                        "type": "object",
+                        "properties": {
+                            "tags": {
+                                "description": "Only run tasks and roles carrying one of these tags.",
+                                "oneOf": [
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    {
+                                        "type": "string",
+                                        "pattern": "^<\\+input>((\\.)((executionInput\\(\\))|(allowedValues|default|regex)\\(.+?\\)))*$",
+                                        "minLength": 1
+                                    }
+                                ]
+                            },
+                            "skipTags": {
+                                "description": "Skip tasks and roles carrying one of these tags. Takes precedence over tags.",
+                                "oneOf": [
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    {
+                                        "type": "string",
+                                        "pattern": "^<\\+input>((\\.)((executionInput\\(\\))|(allowedValues|default|regex)\\(.+?\\)))*$",
+                                        "minLength": 1
+                                    }
+                                ]
+                            },
+                            "limit": {
+                                "description": "Restrict the run to matching hosts. A single ansible host pattern, e.g. \"web,db:!staging\".",
+                                "type": "string"
+                            }
+                        },
+                        "$schema": "http://json-schema.org/draft-07/schema#"
+                    },
                     "IACMRemediationAgentStepNode": {
                         "title": "IACMRemediationAgentStepNode",
                         "type": "object",
@@ -55857,6 +55926,20 @@ const schema = {
                                     },
                                     "llmConnectorRef": {
                                         "type": "string"
+                                    },
+                                    "resourceAddresses": {
+                                        "oneOf": [
+                                            {
+                                                "type": "array",
+                                                "items": {
+                                                    "type": "string"
+                                                }
+                                            },
+                                            {
+                                                "type": "string",
+                                                "pattern": "^<\\+.*>$"
+                                            }
+                                        ]
                                     }
                                 }
                             }
@@ -55895,6 +55978,20 @@ const schema = {
                             },
                             "llmConnectorRef": {
                                 "type": "string"
+                            },
+                            "resourceAddresses": {
+                                "oneOf": [
+                                    {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    {
+                                        "type": "string",
+                                        "pattern": "^<\\+.*>$"
+                                    }
+                                ]
                             }
                         }
                     }
@@ -74928,7 +75025,8 @@ const schema = {
                                     "GoogleMigInstanceTemplate",
                                     "GoogleMigConfiguration",
                                     "GoogleMigAutoscalerConfiguration",
-                                    "GoogleMigHealthCheckConfiguration"
+                                    "GoogleMigHealthCheckConfiguration",
+                                    "AgentConfig"
                                 ]
                             },
                             "description": {
@@ -75448,6 +75546,22 @@ const schema = {
                                         }
                                     }
                                 }
+                            },
+                            {
+                                "if": {
+                                    "properties": {
+                                        "type": {
+                                            "const": "AgentConfig"
+                                        }
+                                    }
+                                },
+                                "then": {
+                                    "properties": {
+                                        "spec": {
+                                            "$ref": "#/definitions/pipeline/steps/cd/AgentConfigManifest"
+                                        }
+                                    }
+                                }
                             }
                         ]
                     },
@@ -75876,7 +75990,8 @@ const schema = {
                                         "enum": [
                                             "V2",
                                             "V3",
-                                            "V380"
+                                            "V380",
+                                            "V4"
                                         ]
                                     },
                                     "metadata": {
@@ -76601,6 +76716,31 @@ const schema = {
                             }
                         }
                     },
+                    "AgentConfigManifest": {
+                        "title": "AgentConfigManifest",
+                        "allOf": [
+                            {
+                                "$ref": "#/definitions/pipeline/steps/cd/ManifestAttributes"
+                            },
+                            {
+                                "type": "object",
+                                "properties": {
+                                    "metadata": {
+                                        "type": "string"
+                                    },
+                                    "store": {
+                                        "$ref": "#/definitions/pipeline/steps/cd/StoreConfigWrapper"
+                                    }
+                                }
+                            }
+                        ],
+                        "$schema": "http://json-schema.org/draft-07/schema#",
+                        "properties": {
+                            "description": {
+                                "desc": "This is the description for AgentConfigManifest"
+                            }
+                        }
+                    },
                     "ManifestSourceWrapper": {
                         "title": "ManifestSourceWrapper",
                         "type": "object",