> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/infrastructure-as-code-management/3.0/platform/platform-integrations/iacm-mcp.md).
# Harness MCP Server
Use the Harness MCP Server to discover, create, and update IaCM workspaces, variable sets, modules, and providers from AI-powered tools using natural language.
Harness **Infrastructure as Code Management (IaCM)** is integrated with the [Harness Model Context Protocol (MCP) Server](https://developer.harness.io/harness-ai/untitled-1/use-harness-ai/ide-and-integrations/mcp-server/harness-mcp-server), which lets AI-powered tools (such as Claude Desktop, Windsurf, Cursor, and VS Code) interact with Harness APIs using natural language. IaCM exposes **five resource types** to the Harness MCP Server so you can discover, create, and update workspaces, variable sets, modules, and providers without leaving your IDE. Earlier versions of the integration supported read-only access. Now, the MCP Server also creates and updates these entities, so you can run full IaCM workflows end to end.
The MCP Server acts as a local proxy between your IDE and Harness APIs. When you ask your AI assistant a question or give it an instruction about IaCM resources, the MCP Server translates your request into a REST API call using your API key, executes the operation in Harness, and returns the result formatted by the AI assistant (not raw JSON). All operations respect your existing IaCM role-based access control (RBAC) permissions.
***
## What you will learn from this topic
* **IaCM resource types in MCP**: The five IaCM resource types available via the Harness MCP Server and what operations each supports.
* **Natural language prompts**: How to discover, create, and edit IaCM resources using natural language instead of writing API calls directly.
* **Required permissions**: Which IaCM RBAC permissions are needed for read and write operations.
* **Example prompts**: Sample prompts for listing, creating, and editing workspaces, variable sets, modules, and providers.
***
## Before you begin
This guide assumes basic familiarity with IaCM workspaces and resources. If you are new to IaCM, go to [Get started with IaCM](/infrastructure-as-code-management/3.0/new-to-iacm/get-started.md) to learn core concepts.
### Setup prerequisites
* **Harness AI enabled** at the account level. Go to [Enable Harness AI](#enable-harness-ai) below.
* **Harness MCP Server installed and configured** for your IDE or CLI. Go to [Harness MCP Server](https://developer.harness.io/harness-ai/untitled-1/use-harness-ai/ide-and-integrations/mcp-server/harness-mcp-server) to install and configure MCP for your IDE (Windsurf, Cursor, VS Code, Claude Desktop, etc.).
* **Harness API key** with access to the IaCM project and workspaces you want to work with. Go to [Add and manage API keys](https://developer.harness.io/platform/use-harness-platform/automation/api/add-and-manage-api-keys) to create a key with IaCM access.
### Enable Harness AI
The Harness AI setting must be enabled at the account level before the MCP Server can connect to Harness APIs.
1. Go to **Account Settings**.
2. Under **General**, select **Default Settings**.
3. Select the **Harness AI** tile and enable the **Harness AI** setting.
4. Optional: Enable **Allow Overrides** to control Harness AI per project.
For UI navigation details, go to [Harness navigation 2.0](https://developer.harness.io/platform/new-to-harness-platform/get-started/harness-ui-overview#harness-navigation-version-20) to understand how to access account settings.
***
## IaCM resource types in the Harness MCP Server
IaCM exposes five resource types to the Harness MCP Server. The table below shows which operations each resource type supports.
| Resource type | List | Get | Create | Update | Delete |
| ------------------- | :--: | :-: | :----: | :----: | :----: |
| `iacm_workspace` | x | x | x | x | No |
| `iacm_resource` | x | x | No | No | No |
| `iacm_variable_set` | x | x | x | x | No |
| `iacm_module` | x | x | x | x | No |
| `iacm_provider` | x | x | x | x | No |
### Notes
* `iacm_resource` is read-only. It lists Terraform or OpenTofu-managed resources and outputs for a workspace.
* `iacm_workspace` supports creation from scratch and from an existing workspace template.
* `iacm_provider` updates use the provider version API to add new versions.
* Delete is not supported for any IaCM resource type through MCP.
Go to [Resource types](https://developer.harness.io/harness-ai/untitled-1/use-harness-ai/ide-and-integrations/mcp-server/resource-types) for the full operations reference across all Harness MCP resource types.
***
## Required permissions
All MCP operations use your Harness API key and apply your existing IaCM RBAC role assignments. No additional permissions are required beyond what you already use in the IaCM UI.
| Operation | Required permission |
| --------- | ------------------------------------------------------------------------------ |
| List, Get | **View** on the resource type at the relevant scope (account, org, or project) |
| Create | **Create/Edit** on the resource type at the relevant scope |
| Update | **Create/Edit** on the resource type at the relevant scope |
If an operation fails with a permissions error, confirm that your API key's service account or user account holds the correct role at the correct scope. Go to [Harness RBAC documentation](https://developer.harness.io/platform/use-harness-platform/platform-access-control) to review role assignments.
All write operations are logged in the Harness API Activity audit trail. To view them, go to your project in Harness, select **Activity** (or **Audit Trail**, depending on your Harness version), and filter by API calls.
***
## Discovering IaCM resources
The following prompts use read operations to retrieve information about existing IaCM resources. These operations require **View** permission on the relevant resource type.
### List workspaces
Ask your AI assistant to list workspaces in a project or get details about a specific workspace.
#### Example prompts
```
List all workspaces in project "my-project"
```
```
Show me details for workspace "prod-aws-us-east"
```
**What the AI returns**: The AI assistant formats the response as a readable summary, typically showing workspace names, provisioner types (Terraform/OpenTofu/Terragrunt), versions, connectors, state backend configuration, repository, and branch.
### List resources and outputs
Ask your AI assistant to fetch resources for a specific workspace. The workspace must have been provisioned at least once so that Harness has recorded its resource state.
#### Example prompts
```
Get resources for workspace "prod-aws-us-east"
```
```
Show me the outputs for workspace "prod-aws-us-east"
```
**What the AI returns**: The AI assistant shows Terraform or OpenTofu resources managed by that workspace (resource type, name, attributes) and any outputs defined in the configuration. Outputs are key-value pairs such as database endpoints or S3 bucket names.
### List variable sets
Ask your AI assistant to list variable sets at account, org, or project scope.
#### Example prompts
```
List all variable sets in project "my-project"
```
```
Show me the account-level variable sets
```
**What the AI returns**: The AI assistant shows variable set names, scope, and the variable keys defined in each set. Secret variable values are never returned.
### List modules and providers
Ask your AI assistant to list modules or providers in the Harness IaCM private registries.
#### Example prompts
```
List modules in the module registry
```
```
Show me available versions for module "vpc-networking"
```
```
List providers in the provider registry
```
***
## Creating and updating IaCM resources
The following prompts use write operations to create or update IaCM resources. These operations require **Create/Edit** permission on the relevant resource type.
### Create a workspace
You can create a workspace from scratch by describing the configuration. At minimum, provide a name, provisioner type, provisioner version, and Git connector.
#### Example prompt
```
Create a workspace named "prod-aws-us-east" in project "my-project" using Terraform 1.5.7,
connected to the "aws-prod" connector, with an S3 state backend in bucket "tf-state-prod"
and Git repository "my-org/infra-repo" on branch "main"
```
**What happens**: The AI assistant constructs the workspace configuration and creates the workspace via the IaCM API. The workspace appears in the Harness IaCM UI immediately. No pipeline is triggered by the creation itself.
### Create a workspace from a template
If your account has workspace templates configured, you can create workspaces from a template. You can override specific fields (such as the Git repository or branch) at creation time.
#### Example prompt
```
Create a workspace from the "standard-aws-vpc" template in project "my-project",
name it "staging-vpc", and override the Git repository to "my-org/staging-infra"
```
**What happens**: The AI assistant looks up the template, applies your overrides, and creates the workspace. Fields not overridden inherit the template defaults.
### Create or update a variable set
Variable sets group reusable variables and secrets that you can attach to multiple workspaces. You can create or update variable sets at account, org, or project scope.
#### Example prompts
```
Create a variable set named "aws-us-east-creds" at the project level in "my-project"
with environment variable AWS_REGION set to "us-east-1"
```
```
Add a variable TF_LOG=DEBUG to the variable set "debug-flags" in project "my-project"
```
{% hint style="info" %}
**Secret variables are write-only**
Secret variable values are write-only through MCP. You can create a secret variable by specifying the secret reference path, but the value is never returned in any read or list operation.
{% endhint %}
### Publish a module
You can add a module to the Harness IaCM private module registry by providing the module name, provider, version, and Git source.
#### Example prompt
```
Publish module "vpc-networking" for provider "aws" version "1.3.0"
from repository "my-org/tf-modules" on tag "v1.3.0"
```
**What happens**: The AI assistant registers the module version in the module registry. It is then available for workspaces to reference as a source.
### Register or update a provider
You can add a new provider or add a version to an existing provider in the Harness IaCM private provider registry.
#### Example prompt
```
Add version "5.31.0" of the "aws" provider to the provider registry
```
**What happens**: The AI assistant adds the version to the provider registry using the provider version API. Existing provider versions are not modified.
***
## Troubleshooting
MCP query to IaCM fails with authentication error
The MCP Server uses your Harness API key (set in the MCP Server environment, for example `HARNESS_API_KEY`). Ensure the key is valid, has not expired, and has access to the IaCM project. Go to **Account Settings** > **API Keys** to verify the key scope and regenerate if needed.
MCP query returns no workspaces or resources even though they exist in IaCM
Access follows IaCM RBAC. If your API key holds View permission on Project A but not Project B, queries return only Project A data. Confirm your role has at least Viewer permission on the project and workspaces. Go to [Harness RBAC documentation](https://developer.harness.io/platform/use-harness-platform/platform-access-control) to understand role assignments.
MCP write operation fails with a permissions error
Create and update operations require **Create/Edit** permission on the relevant IaCM resource type at the appropriate scope (account, org, or project). If your API key belongs to a service account, confirm the service account has been assigned a role that includes Create/Edit for the resource type. Go to [Harness RBAC documentation](https://developer.harness.io/platform/use-harness-platform/platform-access-control) to review role assignments.
Where to view IaCM MCP operation audit logs in Harness
All MCP calls to IaCM are logged in the Harness audit logs under API Activity. To view them, go to your project in Harness, select **Activity** (or **Audit Trail**, depending on your Harness version), and filter by API calls. The logs show the timestamp, user, endpoint called, and result.
***
## Related concepts
* Go to [Harness MCP Server](https://developer.harness.io/harness-ai/untitled-1/use-harness-ai/ide-and-integrations/mcp-server/harness-mcp-server) to install and configure the MCP Server for your IDE, manage API keys, and explore other Harness modules exposed via MCP.
* Go to [Resource types](https://developer.harness.io/harness-ai/untitled-1/use-harness-ai/ide-and-integrations/mcp-server/resource-types) to review the full list of Harness MCP resource types and supported operations.
* Go to [IaCM workspaces](/infrastructure-as-code-management/3.0/platform/workspaces/workspace-overview.md) to learn how workspaces store Terraform state, connect to infrastructure providers, and manage resources.
* Go to [Variable sets](/infrastructure-as-code-management/3.0/platform/iacm-connectors-variables/variable-sets.md) to create and manage reusable variable sets across workspaces.
* Go to [IaCM module registry](/infrastructure-as-code-management/3.0/registry/module-registry/module-registry.md) to publish and manage reusable Terraform modules in the Harness private module registry.
{% @harness-feedback/feedback %}