> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-ai/untitled-1/use-harness-ai/ide-and-integrations/mcp-server/hosted-mcp.md).

# Harness Hosted MCP

Harness provides a **hosted MCP** endpoint for **Harness SaaS** customers. You add the hosted URL to your MCP-compatible client, and when you first connect, you complete **OAuth through Harness ID** (browser or embedded sign-in, depending on the client). After authentication, the server runs MCP **on your behalf** using your Harness user identity, including **RBAC** and permissions from the platform. You do **not** configure a Harness API key in the client for this flow.

Hosted MCP requires **OAuth to be enabled** on your Harness account. Contact [**Harness Support**](https://support.harness.io) to enable OAuth before you use Hosted MCP. Without OAuth enabled, you receive authentication errors even when your Harness login credentials are valid.

If your account authenticates through a SAML or OIDC Identity Provider, sign-in also requires an MCP-specific ACS URL (SAML) or redirect URI (OIDC) in that Identity Provider. Add it by following [Single Sign-On (SSO) for Harness MCP](/harness-ai/use-harness-platform/authentication/single-sign-on-for-harness-mcp.md) before you configure a client.

{% hint style="info" %}
**SAAS ONLY**

Hosted MCP with OAuth is available for **Harness SaaS** accounts only. If you run the MCP server self-hosted or open source, use an API key instead. Go to [Configure your AI client](/harness-ai/use-harness-ai/harness-ai/connect-with-ai/harness-mcp-server/configure-ai-clients.md) to set up API key authentication. **OAuth for open source and self-hosted MCP is coming soon.**
{% endhint %}

***

### Hosted endpoint <a href="#hosted-endpoint" id="hosted-endpoint"></a>

For the primary Harness SaaS control plane, you can use the following URL:

`https://mcp.harness.io/mcp`

If your organization uses a dedicated SaaS cluster or a non-default region, confirm the MCP base URL with [Harness Support](mailto:support@harness.io). The MCP path is typically `/mcp` on that host.

#### Authentication flow <a href="#authentication-flow" id="authentication-flow"></a>

The following flow of control describes how authentication works with hosted MCP configuration:

1. Save the hosted MCP configuration in your client using the URL above.
2. When prompted, sign in with your **Harness email and password** through Harness ID.
3. You may be asked to **confirm your password** on a second Harness ID screen.
4. After a successful login, you return to your editor or terminal. The client loads MCP tools exposed for your account. **Which tools appear depends on your Harness licensing**, consistent with the capabilities of the open source MCP server.

***

### OAuth client ID <a href="#oauth-client-id" id="oauth-client-id"></a>

When a client asks for an OAuth **client ID** for Harness hosted MCP, use **`mcp-client`**. For example, with Claude Code's `--client-id` flag or in Cursor's `auth` block.

***

### Configure a client for hosted MCP <a href="#configure-a-client-for-hosted-mcp" id="configure-a-client-for-hosted-mcp"></a>

Each client below points at the hosted URL instead of running a local process.

#### Cursor <a href="#cursor" id="cursor"></a>

Add a hosted MCP entry in Cursor's MCP settings (for example, **Settings** > **MCP**), using the HTTP URL and client ID:

```json
{
  "mcpServers": {
    "harness-hosted": {
      "url": "https://mcp.harness.io/mcp",
      "auth": {
        "CLIENT_ID": "mcp-client"
      }
    }
  }
}
```

After you enable the server, Cursor prompts you to connect and complete Harness ID authentication. For more information, see [Cursor MCP documentation](https://cursor.com/docs/context/mcp).

#### Claude Code <a href="#claude-code" id="claude-code"></a>

```bash
claude mcp add --transport http \
  --client-id mcp-client \
  harness-hosted-mcp https://mcp.harness.io/mcp
```

For more information, see [Claude Code MCP documentation](https://docs.claude.com/en/docs/claude-code/mcp).

#### Windsurf <a href="#windsurf" id="windsurf"></a>

In your Windsurf MCP configuration (for example, `~/.codeium/windsurf/mcp_config.json` on macOS and Linux, or `%USERPROFILE%\.codeium\windsurf\mcp_config.json` on Windows), add a server entry that points at the hosted URL and supplies the client ID:

```json
{
  "mcpServers": {
    "harness-hosted": {
      "url": "https://mcp.harness.io/mcp",
      "auth": {
        "CLIENT_ID": "mcp-client"
      }
    }
  }
}
```

For more information, see [Windsurf MCP documentation](https://docs.windsurf.com/windsurf/cascade/mcp#model-context-protocol-mcp).

#### Visual Studio Code <a href="#visual-studio-code" id="visual-studio-code"></a>

Add an HTTP MCP server in `.vscode/mcp.json` (workspace) or your [user MCP configuration](https://code.visualstudio.com/docs/copilot/chat/mcp-servers). VS Code negotiates OAuth with the server when supported:

```json
{
  "servers": {
    "harness-hosted": {
      "type": "http",
      "url": "https://mcp.harness.io/mcp"
    }
  },
  "inputs": []
}
```

Accept any trust prompt for the server, then follow Copilot chat prompts to sign in with Harness when authentication is required. For more information, see [VS Code MCP configuration reference](https://code.visualstudio.com/docs/copilot/reference/mcp-configuration).

***

### Troubleshooting <a href="#troubleshooting" id="troubleshooting"></a>

<details>

<summary>Invalid credentials error when connecting to Hosted MCP through OAuth</summary>

OAuth has not been enabled for your Harness account. This is the most common issue when first setting up Hosted MCP, and it occurs even when the same credentials work for a normal Harness login. Contact Harness Support to request OAuth enablement and account data migration, then retry the connection once support confirms the migration is complete.

</details>

<details>

<summary>Hosted MCP sign-in fails at the SAML or OIDC Identity Provider with a reply URL or redirect URI mismatch</summary>

The MCP-specific ACS URL (SAML) or redirect URI (OIDC) is missing from your Identity Provider, so the IdP rejects the MCP authentication response even though Harness platform login works. In Harness, go to Account Settings > Security and Governance > Authentication, edit your SAML or OIDC provider, and copy the value from Additional Reply URL for MCP (Optional). Add that exact value to your Harness application in the IdP, then retry the connection. For per-IdP steps, see /docs/platform/authentication/single-sign-on-for-harness-mcp.

</details>

***

### Next steps <a href="#next-steps" id="next-steps"></a>

* [Tools reference](/harness-ai/use-harness-ai/harness-ai/connect-with-ai/harness-mcp-server/tools-reference.md): Review tools available through the hosted endpoint.
* [Approvals and safety](/harness-ai/use-harness-ai/harness-ai/connect-with-ai/harness-mcp-server/approvals-and-safety.md): Understand how write operations request confirmation.
* [Self-hosted deployment](/harness-ai/use-harness-ai/harness-ai/connect-with-ai/harness-mcp-server/self-hosted-deployment.md): Run the server yourself with Docker or Kubernetes instead.