Skip to main content

Harness Hosted MCP

Last updated on

Harness provides a hosted MCP endpoint for Harness SaaS customers. You add the hosted URL to your MCP-compatible client, and when you first connect, you complete OAuth through Harness ID (browser or embedded sign-in, depending on the client). After authentication, the server runs MCP on your behalf using your Harness user identity, including RBAC and permissions from the platform. You do not configure a Harness API key in the client for this flow.

Hosted MCP requires OAuth to be enabled on your Harness account. Contact Harness Support to enable OAuth before you use Hosted MCP. Without OAuth enabled, you receive authentication errors even when your Harness login credentials are valid.

SaaS only

Hosted MCP with OAuth is available for Harness SaaS accounts only. If you run the MCP server self-hosted or open source, use an API key instead. Go to Configure your AI client to set up API key authentication. OAuth for open source and self-hosted MCP is coming soon.

Hosted endpoint​

For the primary Harness SaaS control plane, you can use the following URL:

https://mcp.harness.io/mcp

If your organization uses a dedicated SaaS cluster or a non-default region, confirm the MCP base URL with Harness Support. The MCP path is typically /mcp on that host.

Authentication flow​

The following flow of control describes how authentication works with hosted MCP configuration:

  1. Save the hosted MCP configuration in your client using the URL above.
  2. When prompted, sign in with your Harness email and password through Harness ID.
  3. You may be asked to confirm your password on a second Harness ID screen.
  4. After a successful login, you return to your editor or terminal. The client loads MCP tools exposed for your account. Which tools appear depends on your Harness licensing, consistent with the capabilities of the open source MCP server.

OAuth client ID​

When a client asks for an OAuth client ID for Harness hosted MCP, use mcp-client. For example, with Claude Code's --client-id flag or in Cursor's auth block.

Configure a client for hosted MCP​

Each client below points at the hosted URL instead of running a local process.

Cursor​

Add a hosted MCP entry in Cursor's MCP settings (for example, Settings > MCP), using the HTTP URL and client ID:

{
  "mcpServers": {
    "harness-hosted": {
      "url": "https://mcp.harness.io/mcp",
      "auth": {
        "CLIENT_ID": "mcp-client"
      }
    }
  }
}

After you enable the server, Cursor prompts you to connect and complete Harness ID authentication. For more information, see Cursor MCP documentation.

Claude Code​

claude mcp add --transport http \
  --client-id mcp-client \
  harness-hosted-mcp https://mcp.harness.io/mcp

For more information, see Claude Code MCP documentation.

Windsurf​

In your Windsurf MCP configuration (for example, ~/.codeium/windsurf/mcp_config.json on macOS and Linux, or %USERPROFILE%\.codeium\windsurf\mcp_config.json on Windows), add a server entry that points at the hosted URL and supplies the client ID:

{
  "mcpServers": {
    "harness-hosted": {
      "url": "https://mcp.harness.io/mcp",
      "auth": {
        "CLIENT_ID": "mcp-client"
      }
    }
  }
}

For more information, see Windsurf MCP documentation.

Visual Studio Code​

Add an HTTP MCP server in .vscode/mcp.json (workspace) or your user MCP configuration. VS Code negotiates OAuth with the server when supported:

{
  "servers": {
    "harness-hosted": {
      "type": "http",
      "url": "https://mcp.harness.io/mcp"
    }
  },
  "inputs": []
}

Accept any trust prompt for the server, then follow Copilot chat prompts to sign in with Harness when authentication is required. For more information, see VS Code MCP configuration reference.

Troubleshooting​

Invalid credentials error when connecting to Hosted MCP through OAuth

OAuth has not been enabled for your Harness account. This is the most common issue when first setting up Hosted MCP, and it occurs even when the same credentials work for a normal Harness login. Contact Harness Support to request OAuth enablement and account data migration, then retry the connection once support confirms the migration is complete.

Next steps​