harness-mcp-v2 3.2.19 → 3.2.21

package/build/registry/toolsets/iacm.js

@@ -1,3 +1,4 @@
+import { SCOPE_BEHAVIOR_DOC } from "../scope-utils.js";
 // ─── Response extractors ─────────────────────────────────────────────────────
 /** IaCM page size is fixed at 30 by the API. */
 const IACM_PAGE_SIZE = 30;
@@ -22,6 +23,42 @@ const workspaceListExtract = (raw) => {
  * IACM workspace get: API returns a single workspace object directly.
  */
 const workspaceGetExtract = (raw) => raw;
+/**
+ * Workspace create/update return `{ policy_evaluation? }` only — not the workspace.
+ * Project that stable shape so agents don't treat the write response as workspace
+ * metadata; follow up with harness_get for the workspace itself.
+ */
+const workspaceWriteExtract = (raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return {};
+    }
+    const rec = raw;
+    return {
+        policy_evaluation: rec.policy_evaluation ?? null,
+    };
+};
+/**
+ * Variable-set list: API returns `{ items: [...] }` with no pagination params.
+ * Normalize to the shared list shape used by other IaCM resources.
+ */
+const variableSetListExtract = (raw) => {
+    const items = Array.isArray(raw)
+        ? raw
+        : raw && typeof raw === "object" && Array.isArray(raw.items)
+            ? (raw.items)
+            : [];
+    return {
+        items,
+        page_count: items.length,
+        has_more: false,
+        pagination_note: `Returned ${items.length} variable set(s). This endpoint is not paginated — treat page_count as the full result size for the selected scope.`,
+    };
+};
+/**
+ * Variable-set get/create/update return the VariableSet resource directly
+ * (identifier, name, variables, connectors, …) — not a policy_evaluation envelope.
+ */
+const variableSetExtract = (raw) => raw;
 /**
  * IACM resources list: API returns a ResourcesResponse with resources, outputs,
  * dataSources, and pagination metadata. Pass the full structure through so the
@@ -66,6 +103,25 @@ const moduleListExtract = (raw) => {
             : `All modules on this page returned (${items.length} items). has_more=false means this is the last page.`,
     };
 };
+/** Module get/create/update return the module resource (or create result) directly. */
+const moduleExtract = (raw) => raw;
+/**
+ * Provider list: API returns a raw JSON array of provider objects.
+ */
+const providerListExtract = (raw) => {
+    const items = Array.isArray(raw) ? raw : [];
+    const has_more = items.length >= IACM_PAGE_SIZE;
+    return {
+        items,
+        page_count: items.length,
+        has_more,
+        pagination_note: has_more
+            ? `Only ${items.length} providers returned (page is full). Call again with page+1 to fetch the next batch. Do NOT report ${items.length} as the total provider count.`
+            : `All providers on this page returned (${items.length} items). has_more=false means this is the last page.`,
+    };
+};
+/** Provider get/create/version ops return the API payload directly. */
+const providerExtract = (raw) => raw;
 /**
  * IACM workspace costs: API returns a raw JSON array of cost entries.
  * Costs are typically a small finite list so has_more acts as a safety signal only.
@@ -117,15 +173,469 @@ const requireProjectScope = async (ctx) => {
             "and will fail silently without them.");
     }
 };
+/**
+ * Resolve account/org/project path prefix for IaCM variable-set endpoints.
+ * Paths use `/variable-sets` for list and `/variable-set` for get/create/update.
+ */
+const resolveVariableSetScopePrefix = (input, config) => {
+    const requestedScope = input.resource_scope;
+    const org = input.org_id ?? config.HARNESS_ORG;
+    const project = input.project_id ?? config.HARNESS_PROJECT;
+    const useProject = requestedScope === "project" ||
+        (!requestedScope && Boolean(org && project));
+    const useOrg = requestedScope === "org" ||
+        useProject ||
+        (!requestedScope && Boolean(org));
+    if (requestedScope === "project" && (!org || !project)) {
+        throw new Error('resource_scope="project" requires org_id and project_id (or HARNESS_ORG / HARNESS_PROJECT defaults).');
+    }
+    if (requestedScope === "org" && !org) {
+        throw new Error('resource_scope="org" requires org_id (or a HARNESS_ORG default).');
+    }
+    if (useProject && org && project) {
+        return `/iacm/api/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(project)}`;
+    }
+    if (useOrg && org) {
+        return `/iacm/api/orgs/${encodeURIComponent(org)}`;
+    }
+    return "/iacm/api";
+};
+const variableSetListPath = (input, config) => `${resolveVariableSetScopePrefix(input, config)}/variable-sets`;
+const variableSetCollectionPath = (input, config) => `${resolveVariableSetScopePrefix(input, config)}/variable-set`;
+const variableSetItemPath = (input, config) => {
+    const id = input.variable_set_id;
+    if (!id) {
+        throw new Error('Missing required field "variable_set_id" for iacm_variable_set. Pass it via params or as resource_id.');
+    }
+    return `${variableSetCollectionPath(input, config)}/${encodeURIComponent(id)}`;
+};
+const providerCreatePath = (input) => {
+    const body = input.body ?? {};
+    const type = input.type ?? body.type;
+    if (!type) {
+        throw new Error('Missing required field "type" for iacm_provider create. Pass it in body.type (e.g. "aws", "terraform").');
+    }
+    return `/iacm/api/providers/${encodeURIComponent(type)}`;
+};
+const providerCreateBody = (input) => {
+    const body = { ...(input.body ?? {}) };
+    delete body.type;
+    return body;
+};
+const providerVersionMethod = (input) => input.version ? "PUT" : "POST";
+const providerVersionPath = (input) => {
+    const id = input.id;
+    if (!id) {
+        throw new Error('Missing required field "id" for iacm_provider update. Pass the provider id via params or as resource_id.');
+    }
+    if (input.version) {
+        return `/iacm/api/providers/${encodeURIComponent(id)}/version/${encodeURIComponent(String(input.version))}`;
+    }
+    return `/iacm/api/providers/${encodeURIComponent(id)}/version`;
+};
+const providerVersionBody = (input) => {
+    const body = { ...(input.body ?? {}) };
+    if (input.version) {
+        delete body.version;
+    }
+    else if (body.version === undefined || body.version === "") {
+        throw new Error('Missing required field "version" for iacm_provider version create. ' +
+            "Pass version in body when creating a new version, or pass params.version to update an existing version.");
+    }
+    return body;
+};
+// ─── Workspace request schemas ───────────────────────────────────────────────
+const workspaceVariableValueFields = [
+    { name: "key", type: "string", required: true, description: "Variable key (must match the map entry key)" },
+    { name: "value", type: "string", required: true, description: "Variable value, or secret reference when value_type is secret" },
+    {
+        name: "value_type",
+        type: "string",
+        required: true,
+        description: "Variable value type: string or secret",
+    },
+];
+const workspaceOptionalFields = [
+    { name: "description", type: "string", required: false, description: "Long-form workspace description" },
+    { name: "provisioner_version", type: "string", required: false, description: "Provisioner version; defaults to latest" },
+    {
+        name: "provisioner_configuration",
+        type: "object",
+        required: false,
+        description: "Provisioner-specific configuration as a string-to-string map " +
+            "(IaCM wire type is map[string]string; OpenAPI may show string due to a custom goa type).",
+    },
+    { name: "terragrunt_provider", type: "boolean", required: false, description: "Whether the workspace uses Terragrunt" },
+    { name: "terragrunt_version", type: "string", required: false, description: "Terragrunt version" },
+    { name: "run_all", type: "boolean", required: false, description: "Run all Terragrunt modules" },
+    {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Infrastructure repository name. Required by IaCM when repository_connector is empty " +
+            '(API returns "repository name can\'t be empty").',
+    },
+    { name: "repository_branch", type: "string", required: false, description: "Repository branch" },
+    { name: "repository_commit", type: "string", required: false, description: "Repository commit or tag" },
+    { name: "repository_sha", type: "string", required: false, description: "Repository commit SHA" },
+    { name: "repository_connector", type: "string", required: false, description: "Harness connector for the infrastructure repository" },
+    { name: "repository_path", type: "string", required: false, description: "Path to the infrastructure code within the repository" },
+    {
+        name: "repository_submodules",
+        type: "string",
+        required: false,
+        description: "Submodule checkout mode: false, true, or recursive",
+    },
+    {
+        name: "sparse_checkout",
+        type: "array",
+        required: false,
+        itemType: "string",
+        description: "Git sparse-checkout path patterns as a JSON string array " +
+            "(IaCM wire type is string[]; OpenAPI may show string due to a custom goa type).",
+    },
+    {
+        name: "cost_estimation_enabled",
+        type: "boolean",
+        required: false,
+        description: "Enable cost-estimation operations for the workspace",
+    },
+    {
+        name: "terraform_variable_files",
+        type: "array",
+        required: false,
+        itemType: "workspace Terraform variable-file reference",
+        description: "Variable files stored in repositories other than the workspace repository",
+    },
+    { name: "budget", type: "number", required: false, description: "Workspace budget" },
+    {
+        name: "default_pipelines",
+        type: "object",
+        required: false,
+        description: "Operation-to-default-pipeline map with optional workspace overrides",
+    },
+    {
+        name: "variable_sets",
+        type: "array",
+        required: false,
+        itemType: "string",
+        description: "Identifiers of variable sets attached to the workspace",
+    },
+    { name: "tags", type: "object", required: false, description: "String key-value tags" },
+    {
+        name: "provider_connectors",
+        type: "array",
+        required: false,
+        itemType: "workspace provider connector",
+        description: "Additional provider connector definitions",
+    },
+    {
+        name: "prune_sensitive_data",
+        type: "boolean",
+        required: false,
+        description: "Prune sensitive data from workspace output",
+    },
+    {
+        name: "ccm_cost_enabled",
+        type: "boolean",
+        required: false,
+        description: "Enable CCM cost integration for the workspace",
+    },
+];
+const workspaceCreateSchema = {
+    description: "IaCM workspace definition. Create from a template by also supplying associated_template.",
+    fields: [
+        { name: "identifier", type: "string", required: true, description: "Unique workspace identifier" },
+        { name: "name", type: "string", required: true, description: "Workspace display name" },
+        {
+            name: "provider_connector",
+            type: "string",
+            required: true,
+            description: "Harness connector reference for the infrastructure provider",
+        },
+        { name: "provisioner", type: "string", required: true, description: "Provisioner such as terraform, opentofu, terragrunt, or awscdk" },
+        {
+            name: "terraform_variables",
+            type: "object",
+            required: true,
+            description: "Map of Terraform variables (key → { key, value, value_type }). " +
+                'Use {} when none are required. value_type is "string" or "secret".',
+            fields: workspaceVariableValueFields,
+        },
+        {
+            name: "environment_variables",
+            type: "object",
+            required: true,
+            description: "Map of environment variables (key → { key, value, value_type }). " +
+                'Use {} when none are required. value_type is "string" or "secret".',
+            fields: workspaceVariableValueFields,
+        },
+        {
+            name: "associated_template",
+            type: "object",
+            required: false,
+            description: "Optional workspace template reference",
+            fields: [
+                { name: "template_id", type: "string", required: true, description: "Template identifier" },
+                { name: "version", type: "string", required: true, description: "Template version" },
+            ],
+        },
+        ...workspaceOptionalFields,
+    ],
+};
+const workspaceUpdateSchema = {
+    description: "Complete IaCM workspace update definition. Send the full workspace body (not a partial patch). " +
+        "Include repository (and related git fields) when updating a git-backed workspace — " +
+        "IaCM rejects an empty repository when repository_connector is empty.",
+    fields: [
+        { name: "name", type: "string", required: true, description: "Workspace display name" },
+        {
+            name: "provider_connector",
+            type: "string",
+            required: true,
+            description: "Harness connector reference for the infrastructure provider",
+        },
+        { name: "provisioner", type: "string", required: true, description: "Provisioner such as terraform, opentofu, terragrunt, or awscdk" },
+        {
+            name: "terraform_variables",
+            type: "object",
+            required: true,
+            description: "Complete Terraform variable map (key → { key, value, value_type }). " +
+                'Use {} when none are configured. value_type is "string" or "secret".',
+            fields: workspaceVariableValueFields,
+        },
+        {
+            name: "environment_variables",
+            type: "object",
+            required: true,
+            description: "Complete environment variable map (key → { key, value, value_type }). " +
+                'Use {} when none are configured. value_type is "string" or "secret".',
+            fields: workspaceVariableValueFields,
+        },
+        ...workspaceOptionalFields,
+    ],
+};
+const variableSetOptionalCollections = [
+    {
+        name: "terraform_variable_files",
+        type: "array",
+        required: false,
+        itemType: "variable-set Terraform variable-file reference",
+        description: "Variable files stored in external repositories. On update this is full-replacement: " +
+            "omit or [] clears existing files. Prefer get-then-put and resend current files to keep them.",
+    },
+    {
+        name: "connectors",
+        type: "array",
+        required: false,
+        itemType: "variable-set connector",
+        description: "Connector references attached to the variable set ({ connector_ref, type }). " +
+            "On update this is full-replacement: omit or [] clears existing connectors. " +
+            "Prefer get-then-put and resend current connectors to keep them.",
+    },
+];
+const variableSetCreateSchema = {
+    description: "IaCM variable set definition for create. Optional maps use key → { key, value, value_type } " +
+        'where value_type is "string" or "secret".',
+    fields: [
+        { name: "identifier", type: "string", required: true, description: "Unique variable set identifier" },
+        { name: "name", type: "string", required: true, description: "Variable set display name" },
+        { name: "description", type: "string", required: false, description: "Long-form variable set description" },
+        {
+            name: "environment_variables",
+            type: "object",
+            required: false,
+            description: "Environment variable map (key → { key, value, value_type }). " +
+                'Use {} when none are configured. value_type is "string" or "secret".',
+            fields: workspaceVariableValueFields,
+        },
+        {
+            name: "terraform_variables",
+            type: "object",
+            required: false,
+            description: "Terraform variable map (key → { key, value, value_type }). " +
+                'Use {} when none are configured. value_type is "string" or "secret".',
+            fields: workspaceVariableValueFields,
+        },
+        ...variableSetOptionalCollections,
+    ],
+};
+const variableSetUpdateSchema = {
+    description: "Complete IaCM variable set update body (HTTP PUT — not a partial patch). " +
+        "Identifier comes from the path (variable_set_id / resource_id). " +
+        "IaCM merges collections by full replacement: omitting terraform_variables, environment_variables, " +
+        "connectors, or terraform_variable_files clears those collections. " +
+        "Always harness_get first, then PUT the full desired state (or {} / [] to clear).",
+    fields: [
+        { name: "name", type: "string", required: true, description: "Variable set display name" },
+        { name: "description", type: "string", required: false, description: "Long-form variable set description" },
+        {
+            name: "environment_variables",
+            type: "object",
+            required: true,
+            description: "Complete environment variable map (key → { key, value, value_type }). " +
+                "Required on update so agents cannot accidentally wipe vars by omitting the field — " +
+                'send the current map from harness_get, or {} to clear. value_type is "string" or "secret".',
+            fields: workspaceVariableValueFields,
+        },
+        {
+            name: "terraform_variables",
+            type: "object",
+            required: true,
+            description: "Complete Terraform variable map (key → { key, value, value_type }). " +
+                "Required on update so agents cannot accidentally wipe vars by omitting the field — " +
+                'send the current map from harness_get, or {} to clear. value_type is "string" or "secret".',
+            fields: workspaceVariableValueFields,
+        },
+        ...variableSetOptionalCollections,
+    ],
+};
+const moduleOptionalFields = [
+    { name: "description", type: "string", required: false, description: "Free-form module description" },
+    {
+        name: "tags",
+        type: "string",
+        required: false,
+        description: "Comma-separated tags (e.g. networking,vpc,aws)",
+    },
+    { name: "repository", type: "string", required: false, description: "Git repository name containing the module source" },
+    { name: "repository_branch", type: "string", required: false, description: "Repository branch" },
+    { name: "repository_commit", type: "string", required: false, description: "Repository commit or tag" },
+    {
+        name: "repository_connector",
+        type: "string",
+        required: false,
+        description: "Harness Git connector identifier; leave empty for Harness Code repositories",
+    },
+    { name: "repository_path", type: "string", required: false, description: "Path to the module within the repository" },
+    {
+        name: "git_tag_style",
+        type: "string",
+        required: false,
+        description: "Git tag pattern for versioning (e.g. module-name-*)",
+    },
+    {
+        name: "storage_type",
+        type: "string",
+        required: false,
+        description: "Version storage mode: git_reference or artifact",
+    },
+    {
+        name: "onboarding_pipeline",
+        type: "string",
+        required: false,
+        description: "Harness pipeline identifier used for module onboarding/metadata sync",
+    },
+    {
+        name: "onboarding_pipeline_org",
+        type: "string",
+        required: false,
+        description: "Org where the onboarding pipeline is defined",
+    },
+    {
+        name: "onboarding_pipeline_project",
+        type: "string",
+        required: false,
+        description: "Project where the onboarding pipeline is defined",
+    },
+    {
+        name: "onboarding_pipeline_sync",
+        type: "boolean",
+        required: false,
+        description: "When true, sync metadata automatically on new Git tags",
+    },
+    {
+        name: "org",
+        type: "string",
+        required: false,
+        description: "Org where the Git connector is defined (defaults to scope_org)",
+    },
+    {
+        name: "project",
+        type: "string",
+        required: false,
+        description: "Project where the Git connector is defined (defaults to scope_project)",
+    },
+];
+const moduleCreateSchema = {
+    description: "IaCM module registry create definition. Account comes from auth headers. " +
+        "Module visibility scope is set with resource_scope / org_id / project_id (sent as scope_org/scope_project query params), " +
+        "never as body fields — body.org / body.project only locate the module's Git connector.",
+    fields: [
+        { name: "name", type: "string", required: true, description: "Module name; unique within the same scope and system" },
+        {
+            name: "system",
+            type: "string",
+            required: true,
+            description: "Target provider/system in lowercase letters only (e.g. aws, gcp, azure, kubernetes)",
+        },
+        ...moduleOptionalFields,
+    ],
+};
+const moduleUpdateSchema = {
+    description: "IaCM module registry update definition (HTTP PUT). Module id comes from the path (id / resource_id) and the " +
+        "module's scope from resource_scope / org_id / project_id (scope_org/scope_project query params, not body fields). " +
+        "Required body fields: name, system. Optional fields are pointers on the API — omit them only when " +
+        "you intend to clear; prefer harness_get then PUT the full desired module (get-then-put).",
+    fields: [
+        { name: "name", type: "string", required: true, description: "Module name; unique within the same scope and system" },
+        {
+            name: "system",
+            type: "string",
+            required: true,
+            description: "Target provider/system in lowercase letters only (e.g. aws, gcp, azure, kubernetes)",
+        },
+        ...moduleOptionalFields,
+    ],
+};
+const providerCreateSchema = {
+    // type is REQUIRED at the call layer (enforced by pathBuilder), but declared required:false
+    // here because bodySchema validates the BUILT body — and providerCreateBody strips type
+    // from the wire payload (type is a path segment, not a JSON field).
+    description: "IaCM provider registry create definition. Account-scoped (Harness-Account header only). " +
+        "body.type is REQUIRED (path segment, e.g. aws); only description is forwarded in the JSON body. " +
+        "API response is { id } only — call harness_get with that id for full details.",
+    fields: [
+        {
+            name: "type",
+            type: "string",
+            required: false,
+            description: "REQUIRED (enforced by pathBuilder). Provider type path segment (e.g. aws, terraform). Stripped from the JSON body.",
+        },
+        { name: "description", type: "string", required: false, description: "Optional provider description" },
+    ],
+};
+const providerUpdateSchema = {
+    description: "Version-oriented provider update. There is no metadata PUT /providers/{id}. " +
+        "Omit params.version to POST a new version (include body.version). " +
+        "Pass params.version to PUT an existing version. Version writes may return an empty 201/204 body.",
+    fields: [
+        {
+            name: "version",
+            type: "string",
+            required: false,
+            description: "Required in body when creating a new version (no params.version). Omitted from body on PUT update.",
+        },
+        {
+            name: "protocol",
+            type: "array",
+            required: true,
+            itemType: "string",
+            description: "Supported Terraform/OpenTofu protocol versions (e.g. [\"5.0\"])",
+        },
+        { name: "gpg_key_id", type: "string", required: true, description: "GPG signing key id for the provider version" },
+    ],
+};
 // ─── Toolset definition ─────────────────────────────────────────────────────
 export const iacmToolset = {
     name: "iacm",
     displayName: "Infrastructure as Code Management (IaCM)",
-    description: "Harness IaCM (Infrastructure as Code Management) — manage Terraform workspaces, " +
-        "inspect provisioned resources and Terraform outputs, browse the module registry, " +
-        "review workspace cost history, and diff resource changes from past plan/apply/destroy activities. " +
-        "Use iacm_workspace to list and get workspaces, iacm_resource for Terraform resources and outputs, " +
-        "iacm_module for the module registry, iacm_workspace_costs for cost breakdown, " +
+    description: "Harness IaCM (Infrastructure as Code Management) — manage Terraform workspaces " +
+        "(list/get/create/update), shared variable sets, provisioned resources and Terraform outputs, " +
+        "the module and provider registries, workspace cost history, and resource-change diffs from plan/apply/destroy. " +
+        "Use iacm_workspace to list, get, create, or update workspaces; iacm_variable_set for reusable " +
+        "variable sets (account/org/project); iacm_resource for Terraform resources and outputs; " +
+        "iacm_module (account/org/project) and iacm_provider for private registries; iacm_workspace_costs for cost breakdown; " +
         "and iacm_activity_resource_change for activity diffs.",
     optIn: false,
     resources: [
@@ -140,7 +650,8 @@ export const iacmToolset = {
                 "The response includes has_more (true = more pages exist) and page_count (items on THIS page only). " +
                 "IMPORTANT: page_count is NOT the total number of workspaces. " +
                 "To find the true total or list all workspaces, keep calling with page+1 until has_more=false, then sum the page_counts. " +
-                "Use harness_get with workspace_id to fetch full details of a single workspace. " +
+                "Use harness_get with workspace_id to fetch full details, harness_create to create from scratch or a template, " +
+                "and harness_update with workspace_id to update an existing workspace. " +
                 "See also: iacm_resource for Terraform resources, iacm_workspace_costs for cost breakdown.",
             toolset: "iacm",
             scope: "project",
@@ -224,6 +735,121 @@ export const iacmToolset = {
                     description: "Get full metadata for a specific IaCM workspace by its identifier. " +
                         "Returns id, identifier, name, status, last_run, variables, cost_summary, and project_id.",
                 },
+                create: {
+                    method: "POST",
+                    path: "/iacm/api/orgs/{org}/projects/{project}/workspaces",
+                    pathParams: { org_id: "org", project_id: "project" },
+                    preflight: requireProjectScope,
+                    operationPolicy: { risk: "medium_write", retryPolicy: "do_not_retry" },
+                    bodyBuilder: (input) => input.body,
+                    bodySchema: workspaceCreateSchema,
+                    skipScopeBodyInjection: true,
+                    responseExtractor: workspaceWriteExtract,
+                    description: "Create an IaCM workspace. Supply the full required workspace body; to create from a template, " +
+                        "also provide associated_template with template_id and version. IaCM enforces permissions, validation, and policy evaluation. " +
+                        "Response is { policy_evaluation } only — not the workspace. Follow up with harness_get " +
+                        "(resource_type=iacm_workspace, workspace_id=<identifier>) to fetch the created workspace.",
+                },
+                update: {
+                    method: "PUT",
+                    path: "/iacm/api/orgs/{org}/projects/{project}/workspaces/{workspaceId}",
+                    pathParams: {
+                        org_id: "org",
+                        project_id: "project",
+                        workspace_id: "workspaceId",
+                    },
+                    preflight: requireProjectScope,
+                    operationPolicy: { risk: "medium_write", retryPolicy: "do_not_retry" },
+                    bodyBuilder: (input) => input.body,
+                    bodySchema: workspaceUpdateSchema,
+                    skipScopeBodyInjection: true,
+                    responseExtractor: workspaceWriteExtract,
+                    description: "Update an IaCM workspace by identifier. This endpoint uses full-replacement semantics for core fields: " +
+                        "include name, provider_connector, provisioner, terraform_variables, and environment_variables. " +
+                        "IaCM enforces permissions, validation, and policy evaluation. " +
+                        "Response is { policy_evaluation } only — not the workspace. Follow up with harness_get " +
+                        "(resource_type=iacm_workspace, workspace_id=<identifier>) to fetch the updated workspace.",
+                },
+            },
+        },
+        // ─── Variable Sets ─────────────────────────────────────────────────────
+        {
+            resourceType: "iacm_variable_set",
+            displayName: "IaCM Variable Set",
+            description: "A reusable IaCM variable set containing Terraform variables, environment variables, " +
+                "variable files, and connector references that can be attached to workspaces. " +
+                "Supports account, org, and project scope. " +
+                SCOPE_BEHAVIOR_DOC +
+                " Use harness_list/harness_get to discover sets, harness_create to create, and harness_update with variable_set_id to update. " +
+                "Create/update return the VariableSet resource (identifier, name, variables, connectors). " +
+                "IMPORTANT: harness_update is HTTP PUT with full-replacement collections — call harness_get first, then PUT the full desired body " +
+                "(omitting terraform_variables / environment_variables / connectors / terraform_variable_files clears them on the server). " +
+                "NOTE: IaCM variable-set RBAC permissions (iac_variableset_*) are currently Experimental in Harness — " +
+                "deny paths are not enforceable until iac-server activates them; MCP still forwards the caller token unchanged. " +
+                "See also: iacm_workspace.variable_sets for attaching sets to a workspace.",
+            toolset: "iacm",
+            scope: "project",
+            supportedScopes: ["account", "org", "project"],
+            identifierFields: ["variable_set_id"],
+            relatedResources: [
+                {
+                    resourceType: "iacm_workspace",
+                    relationship: "used by",
+                    description: "Workspaces can attach this variable set via their variable_sets field",
+                },
+            ],
+            operations: {
+                list: {
+                    method: "GET",
+                    path: "/iacm/api/orgs/{org}/projects/{project}/variable-sets",
+                    pathBuilder: variableSetListPath,
+                    operationPolicy: { risk: "read", retryPolicy: "safe" },
+                    responseExtractor: variableSetListExtract,
+                    description: "List IaCM variable sets at the selected account/org/project scope. " +
+                        "Response fields: items, page_count (full result size — this API is not paginated), has_more=false.",
+                },
+                get: {
+                    method: "GET",
+                    path: "/iacm/api/orgs/{org}/projects/{project}/variable-set/{variableSetId}",
+                    pathBuilder: variableSetItemPath,
+                    operationPolicy: { risk: "read", retryPolicy: "safe" },
+                    responseExtractor: variableSetExtract,
+                    description: "Get a variable set by identifier at the selected account/org/project scope. " +
+                        "Pass variable_set_id via params or as resource_id. Response is the VariableSet resource.",
+                },
+                create: {
+                    method: "POST",
+                    path: "/iacm/api/orgs/{org}/projects/{project}/variable-set",
+                    pathBuilder: variableSetCollectionPath,
+                    operationPolicy: { risk: "medium_write", retryPolicy: "do_not_retry" },
+                    bodyBuilder: (input) => input.body,
+                    bodySchema: variableSetCreateSchema,
+                    skipScopeBodyInjection: true,
+                    responseExtractor: variableSetExtract,
+                    description: "Create an IaCM variable set. Required body fields: identifier, name. " +
+                        "Optional: description, environment_variables, terraform_variables, terraform_variable_files, connectors. " +
+                        "Variable maps use key → { key, value, value_type } with value_type string|secret. " +
+                        "Response is the created VariableSet resource. " +
+                        "MCP forwards the caller token; variable-set RBAC permissions are Experimental until iac-server enforces them.",
+                },
+                update: {
+                    method: "PUT",
+                    path: "/iacm/api/orgs/{org}/projects/{project}/variable-set/{variableSetId}",
+                    pathBuilder: variableSetItemPath,
+                    operationPolicy: { risk: "medium_write", retryPolicy: "do_not_retry" },
+                    bodyBuilder: (input) => input.body,
+                    bodySchema: variableSetUpdateSchema,
+                    skipScopeBodyInjection: true,
+                    responseExtractor: variableSetExtract,
+                    description: "Update an IaCM variable set by identifier (variable_set_id / resource_id). " +
+                        "HTTP PUT with full-replacement semantics for collections (same behavior as iac-server): " +
+                        "required body fields are name, terraform_variables, and environment_variables " +
+                        "(send maps from harness_get, or {} to clear). " +
+                        "connectors and terraform_variable_files are also full-replacement — omit or [] clears them; " +
+                        "prefer get-then-put and resend current values to keep them. " +
+                        "Response is the updated VariableSet resource. " +
+                        "MCP forwards the caller token; variable-set RBAC permissions are Experimental until iac-server enforces them.",
+                },
             },
         },
         // ─── Terraform Resources / Outputs / DataSources ───────────────────────
@@ -299,14 +925,27 @@ export const iacmToolset = {
             resourceType: "iacm_module",
             displayName: "IaCM Module Registry",
             description: "Terraform modules registered in the Harness IaCM module registry. " +
-                "Modules have a name, version, provider, source_repo, tags, and invocation_count. " +
+                "Modules have a name, system/provider, version metadata, source_repo, tags, and invocation_count. " +
                 "PAGINATION: Results are capped at 30 per page (1-based). " +
                 "Response includes has_more (true = more pages exist) and page_count (items on THIS page only). " +
                 "IMPORTANT: page_count is NOT the total module count. " +
                 "To find the true total, paginate until has_more=false and sum the page_counts. " +
-                "Use harness_get with the numeric id field (from list) to fetch full module details.",
+                "Use harness_get with the numeric/UUID id from list (NOT the module name). " +
+                "Use harness_create with body.name + body.system to register a module. " +
+                "Use harness_update with id/resource_id plus body.name + body.system (get-then-put for optionals). " +
+                "Create/update return the module resource. Registry RBAC (iac_registry_view / iac_registry_edit) is Active.\n" +
+                "SCOPE: modules live at account, org, or project scope. Every operation (list/get/create/update) sends the same " +
+                "scope_org/scope_project query params, so a module is visible where it was created. " +
+                "Set resource_scope='account' (or pass neither org_id nor project_id) for the account registry, " +
+                "resource_scope='org' with org_id for an org module, or resource_scope='project' with org_id + project_id for a project module. " +
+                "When resource_scope is omitted, org_id/project_id are used only if explicitly passed — configured HARNESS_ORG/HARNESS_PROJECT " +
+                "defaults are NOT applied, so an ambient project config cannot silently turn an account module into a project one. " +
+                "NOTE: body.org / body.project (when present) locate the module's Git connector and are independent of this visibility scope.",
             toolset: "iacm",
             scope: "account",
+            supportedScopes: ["account", "org", "project"],
+            scopeOptional: true,
+            scopeParams: { org: "scope_org", project: "scope_project" },
             identifierFields: ["id"],
             listFilterFields: [
                 {
@@ -340,6 +979,8 @@ export const iacmToolset = {
                     operationPolicy: { risk: "read", retryPolicy: "safe" },
                     responseExtractor: moduleListExtract,
                     description: "List Terraform modules in the IaCM module registry (30 per page; page >= 1). " +
+                        "Scope: defaults to the account registry; pass resource_scope='org' + org_id or resource_scope='project' + org_id/project_id " +
+                        "(or the ids alone) to list modules registered at that scope — the same scope accepted by create/update. " +
                         "Response fields: items (module objects), page_count (THIS page only), has_more, pagination_note. " +
                         "CRITICAL: page_count is the count for this page only — NEVER report it as the total module count. " +
                         "If has_more=true, call again with page+1. " +
@@ -350,11 +991,146 @@ export const iacmToolset = {
                     path: "/iacm/api/modules/{moduleId}",
                     pathParams: { id: "moduleId" },
                     operationPolicy: { risk: "read", retryPolicy: "safe" },
-                    responseExtractor: (raw) => raw,
+                    responseExtractor: moduleExtract,
                     description: "Get full details for a specific IaCM module. " +
-                        "IMPORTANT: id must be the numeric id from the list response (e.g. '4640'), " +
+                        "IMPORTANT: id must be the numeric/UUID id from the list response (e.g. '4640'), " +
                         "NOT the module name (e.g. 'buha-module-v2'). " +
-                        "Always call harness_list on iacm_module first to get the numeric id, then call harness_get.",
+                        "Always call harness_list on iacm_module first to get the id, then call harness_get. " +
+                        "For org/project modules pass the same resource_scope (or org_id/project_id) used to list them.",
+                },
+                create: {
+                    method: "POST",
+                    path: "/iacm/api/modules",
+                    operationPolicy: { risk: "medium_write", retryPolicy: "do_not_retry" },
+                    bodyBuilder: (input) => input.body,
+                    bodySchema: moduleCreateSchema,
+                    skipScopeBodyInjection: true,
+                    responseExtractor: moduleExtract,
+                    description: "Create a module in the IaCM module registry. Required body fields: name, system. " +
+                        "Optional body fields include repository metadata, tags, storage_type, and onboarding pipeline settings. " +
+                        "Scope: omit org_id/project_id (or set resource_scope='account') for an account module; pass resource_scope='org' + org_id " +
+                        "or resource_scope='project' + org_id/project_id to register it at org/project scope — these become scope_org/scope_project " +
+                        "query params, never body fields. List/get accept the same scope, so the module is discoverable where it was created. " +
+                        "Returns the module resource (includes id for later get/update). " +
+                        "Registry RBAC is Active (iac_registry_edit). medium_write — requires confirmation.",
+                },
+                update: {
+                    method: "PUT",
+                    path: "/iacm/api/modules/{moduleId}",
+                    pathParams: { id: "moduleId" },
+                    operationPolicy: { risk: "medium_write", retryPolicy: "do_not_retry" },
+                    bodyBuilder: (input) => input.body,
+                    bodySchema: moduleUpdateSchema,
+                    skipScopeBodyInjection: true,
+                    responseExtractor: moduleExtract,
+                    description: "Update a module in the IaCM module registry by numeric/UUID id (id / resource_id). " +
+                        "Required body fields: name, system. " +
+                        "Pass the same scope you created the module at (resource_scope, or org_id/project_id) so the request targets the right registry — " +
+                        "these become scope_org/scope_project query params, never body fields. " +
+                        "Prefer harness_get then PUT the full desired module — omitting optional fields may clear them. " +
+                        "Returns the module resource. Registry RBAC is Active (iac_registry_edit). medium_write — requires confirmation.",
+                },
+            },
+        },
+        // ─── Provider Registry ─────────────────────────────────────────────────
+        {
+            resourceType: "iacm_provider",
+            displayName: "IaCM Provider Registry",
+            description: "Private Terraform/OpenTofu providers registered in the Harness IaCM provider registry. " +
+                "SCOPE: account-only — the IaCM provider-registry API has no scope_org/scope_project params " +
+                "(unlike iacm_module). Ambient org_id/project_id and HARNESS_ORG/HARNESS_PROJECT are ignored. " +
+                "Providers are identified by numeric/string id (not type alone). " +
+                "USER FLOW: harness_create → response is { id } only → harness_get/harness_list with that id → " +
+                "harness_update for versions (not metadata). " +
+                "IMPORTANT: there is no metadata PUT /providers/{id}. harness_update is version-oriented: " +
+                "omit params.version to create a new version (POST), or pass params.version to update an existing version (PUT). " +
+                "Version create/update may return an empty body (HarnessClient normalizes to success). " +
+                "Provider-registry RBAC (iac_providerregistry_*) is Experimental. " +
+                "PAGINATION: Results are capped at 30 per page (1-based). page_count is THIS page only.",
+            toolset: "iacm",
+            scope: "account",
+            identifierFields: ["id"],
+            listFilterFields: [
+                { name: "search_term", description: "Filter providers by partial name match", type: "string" },
+                {
+                    name: "sort",
+                    description: "Sort order",
+                    type: "string",
+                    enum: ["name,ASC", "name,DESC", "updated,ASC", "updated,DESC"],
+                },
+                { name: "page", description: "Page number (1-based). Default: 1.", type: "number" },
+                { name: "size", description: "Page size (mapped to API limit). Default: 30.", type: "number" },
+            ],
+            operations: {
+                list: {
+                    method: "GET",
+                    path: "/iacm/api/providers",
+                    queryParams: {
+                        page: "page",
+                        size: "limit",
+                        search_term: "searchTerm",
+                        sort: "sort",
+                    },
+                    pageOneIndexed: true,
+                    operationPolicy: { risk: "read", retryPolicy: "safe" },
+                    responseExtractor: providerListExtract,
+                    description: "List providers in the account-scoped IaCM provider registry (30 per page; page >= 1). " +
+                        "org_id/project_id are ignored — this API has no scope_org/scope_project. " +
+                        "Response fields: items, page_count (THIS page only), has_more, pagination_note.",
+                },
+                get: {
+                    method: "GET",
+                    path: "/iacm/api/providers/{providerId}",
+                    pathParams: { id: "providerId" },
+                    operationPolicy: { risk: "read", retryPolicy: "safe" },
+                    responseExtractor: providerExtract,
+                    description: "Get a provider by id. Use the id from harness_create (response.id) or harness_list — " +
+                        "not the provider type string alone. Account-scoped; org_id/project_id are ignored.",
+                },
+                create: {
+                    method: "POST",
+                    path: "/iacm/api/providers/{type}",
+                    pathBuilder: providerCreatePath,
+                    operationPolicy: { risk: "medium_write", retryPolicy: "do_not_retry" },
+                    bodyBuilder: providerCreateBody,
+                    bodySchema: providerCreateSchema,
+                    skipScopeBodyInjection: true,
+                    responseExtractor: providerExtract,
+                    description: "Create a provider registry entry. Required body.type becomes the path segment; optional body.description is sent as JSON. " +
+                        "Response is { id } only — not the full provider. Follow up with harness_get " +
+                        "(resource_type=iacm_provider, id=<id>) or harness_list before version updates. " +
+                        "Account-scoped (no org/project query params). " +
+                        "Provider-registry RBAC is Experimental (iac_providerregistry_edit). medium_write — requires confirmation.",
+                },
+                update: {
+                    method: "PUT",
+                    path: "/iacm/api/providers/{providerId}/version/{version}",
+                    methodBuilder: providerVersionMethod,
+                    pathBuilder: providerVersionPath,
+                    operationPolicy: { risk: "medium_write", retryPolicy: "do_not_retry" },
+                    bodyBuilder: providerVersionBody,
+                    bodySchema: providerUpdateSchema,
+                    skipScopeBodyInjection: true,
+                    responseExtractor: providerExtract,
+                    paramsSchema: {
+                        fields: [
+                            {
+                                name: "id",
+                                required: true,
+                                description: "Provider id from create/list (also accepted as resource_id) — not the type string",
+                            },
+                            {
+                                name: "version",
+                                required: false,
+                                description: "When set, updates that existing version via PUT. When omitted, creates a new version via POST (include body.version).",
+                            },
+                        ],
+                    },
+                    description: "Version-oriented provider update — NOT a metadata PATCH. Use the id from harness_create/harness_list (not type). " +
+                        "Create version: omit params.version and pass body.version + protocol + gpg_key_id (POST /providers/{id}/version). " +
+                        "Update version: pass params.version with body.protocol + gpg_key_id (PUT /providers/{id}/version/{version}). " +
+                        "Version writes may return an empty 201/204 body; HarnessClient returns { status: \"SUCCESS\", message: \"No content\" }. " +
+                        "Account-scoped (no org/project query params). Provider-registry RBAC is Experimental. medium_write — requires confirmation.",
                 },
             },
         },