Ctrlk
Sign UpGet a DemoContact Us
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Harness MCP Server

Use the Harness MCP Server to discover, create, and update IaCM workspaces, variable sets, modules, and providers from AI-powered tools using natural language.

Harness Infrastructure as Code Management (IaCM) is integrated with the Harness Model Context Protocol (MCP) Server, which lets AI-powered tools (such as Claude Desktop, Windsurf, Cursor, and VS Code) interact with Harness APIs using natural language. IaCM exposes five resource types to the Harness MCP Server so you can discover, create, and update workspaces, variable sets, modules, and providers without leaving your IDE. Earlier versions of the integration supported read-only access. Now, the MCP Server also creates and updates these entities, so you can run full IaCM workflows end to end.

The MCP Server acts as a local proxy between your IDE and Harness APIs. When you ask your AI assistant a question or give it an instruction about IaCM resources, the MCP Server translates your request into a REST API call using your API key, executes the operation in Harness, and returns the result formatted by the AI assistant (not raw JSON). All operations respect your existing IaCM role-based access control (RBAC) permissions.

What you will learn from this topic

  • IaCM resource types in MCP: The five IaCM resource types available via the Harness MCP Server and what operations each supports.

  • Natural language prompts: How to discover, create, and edit IaCM resources using natural language instead of writing API calls directly.

  • Required permissions: Which IaCM RBAC permissions are needed for read and write operations.

  • Example prompts: Sample prompts for listing, creating, and editing workspaces, variable sets, modules, and providers.

Before you begin

This guide assumes basic familiarity with IaCM workspaces and resources. If you are new to IaCM, go to Get started with IaCM to learn core concepts.

Setup prerequisites

  • Harness AI enabled at the account level. Go to Enable Harness AI below.

  • Harness MCP Server installed and configured for your IDE or CLI. Go to Harness MCP Server to install and configure MCP for your IDE (Windsurf, Cursor, VS Code, Claude Desktop, etc.).

  • Harness API key with access to the IaCM project and workspaces you want to work with. Go to Add and manage API keys to create a key with IaCM access.

Enable Harness AI

The Harness AI setting must be enabled at the account level before the MCP Server can connect to Harness APIs.

  1. Go to Account Settings.

  2. Under General, select Default Settings.

  3. Select the Harness AI tile and enable the Harness AI setting.

  4. Optional: Enable Allow Overrides to control Harness AI per project.

For UI navigation details, go to Harness navigation 2.0 to understand how to access account settings.

IaCM resource types in the Harness MCP Server

IaCM exposes five resource types to the Harness MCP Server. The table below shows which operations each resource type supports.

Resource type
List
Get
Create
Update
Delete

iacm_workspace

x

x

x

x

No

iacm_resource

x

x

No

No

No

iacm_variable_set

x

x

x

x

No

iacm_module

x

x

x

x

No

iacm_provider

x

x

x

x

No

Notes

  • iacm_resource is read-only. It lists Terraform or OpenTofu-managed resources and outputs for a workspace.

  • iacm_workspace supports creation from scratch and from an existing workspace template.

  • iacm_provider updates use the provider version API to add new versions.

  • Delete is not supported for any IaCM resource type through MCP.

Go to Resource types for the full operations reference across all Harness MCP resource types.

Required permissions

All MCP operations use your Harness API key and apply your existing IaCM RBAC role assignments. No additional permissions are required beyond what you already use in the IaCM UI.

Operation
Required permission

List, Get

View on the resource type at the relevant scope (account, org, or project)

Create

Create/Edit on the resource type at the relevant scope

Update

Create/Edit on the resource type at the relevant scope

If an operation fails with a permissions error, confirm that your API key's service account or user account holds the correct role at the correct scope. Go to Harness RBAC documentation to review role assignments.

All write operations are logged in the Harness API Activity audit trail. To view them, go to your project in Harness, select Activity (or Audit Trail, depending on your Harness version), and filter by API calls.

Discovering IaCM resources

The following prompts use read operations to retrieve information about existing IaCM resources. These operations require View permission on the relevant resource type.

List workspaces

Ask your AI assistant to list workspaces in a project or get details about a specific workspace.

Example prompts

What the AI returns: The AI assistant formats the response as a readable summary, typically showing workspace names, provisioner types (Terraform/OpenTofu/Terragrunt), versions, connectors, state backend configuration, repository, and branch.

List resources and outputs

Ask your AI assistant to fetch resources for a specific workspace. The workspace must have been provisioned at least once so that Harness has recorded its resource state.

Example prompts

What the AI returns: The AI assistant shows Terraform or OpenTofu resources managed by that workspace (resource type, name, attributes) and any outputs defined in the configuration. Outputs are key-value pairs such as database endpoints or S3 bucket names.

List variable sets

Ask your AI assistant to list variable sets at account, org, or project scope.

Example prompts

What the AI returns: The AI assistant shows variable set names, scope, and the variable keys defined in each set. Secret variable values are never returned.

List modules and providers

Ask your AI assistant to list modules or providers in the Harness IaCM private registries.

Example prompts

Creating and updating IaCM resources

The following prompts use write operations to create or update IaCM resources. These operations require Create/Edit permission on the relevant resource type.

Create a workspace

You can create a workspace from scratch by describing the configuration. At minimum, provide a name, provisioner type, provisioner version, and Git connector.

Example prompt

What happens: The AI assistant constructs the workspace configuration and creates the workspace via the IaCM API. The workspace appears in the Harness IaCM UI immediately. No pipeline is triggered by the creation itself.

Create a workspace from a template

If your account has workspace templates configured, you can create workspaces from a template. You can override specific fields (such as the Git repository or branch) at creation time.

Example prompt

What happens: The AI assistant looks up the template, applies your overrides, and creates the workspace. Fields not overridden inherit the template defaults.

Create or update a variable set

Variable sets group reusable variables and secrets that you can attach to multiple workspaces. You can create or update variable sets at account, org, or project scope.

Example prompts

Secret variables are write-only

Secret variable values are write-only through MCP. You can create a secret variable by specifying the secret reference path, but the value is never returned in any read or list operation.

Publish a module

You can add a module to the Harness IaCM private module registry by providing the module name, provider, version, and Git source.

Example prompt

What happens: The AI assistant registers the module version in the module registry. It is then available for workspaces to reference as a source.

Register or update a provider

You can add a new provider or add a version to an existing provider in the Harness IaCM private provider registry.

Example prompt

What happens: The AI assistant adds the version to the provider registry using the provider version API. Existing provider versions are not modified.

Troubleshooting

MCP query to IaCM fails with authentication error

The MCP Server uses your Harness API key (set in the MCP Server environment, for example HARNESS_API_KEY). Ensure the key is valid, has not expired, and has access to the IaCM project. Go to Account Settings > API Keys to verify the key scope and regenerate if needed.

MCP query returns no workspaces or resources even though they exist in IaCM

Access follows IaCM RBAC. If your API key holds View permission on Project A but not Project B, queries return only Project A data. Confirm your role has at least Viewer permission on the project and workspaces. Go to Harness RBAC documentation to understand role assignments.

MCP write operation fails with a permissions error

Create and update operations require Create/Edit permission on the relevant IaCM resource type at the appropriate scope (account, org, or project). If your API key belongs to a service account, confirm the service account has been assigned a role that includes Create/Edit for the resource type. Go to Harness RBAC documentation to review role assignments.

Where to view IaCM MCP operation audit logs in Harness

All MCP calls to IaCM are logged in the Harness audit logs under API Activity. To view them, go to your project in Harness, select Activity (or Audit Trail, depending on your Harness version), and filter by API calls. The logs show the timestamp, user, endpoint called, and result.

Related concepts

  • Go to Harness MCP Server to install and configure the MCP Server for your IDE, manage API keys, and explore other Harness modules exposed via MCP.

  • Go to Resource types to review the full list of Harness MCP resource types and supported operations.

  • Go to IaCM workspaces to learn how workspaces store Terraform state, connect to infrastructure providers, and manage resources.

  • Go to Variable sets to create and manage reusable variable sets across workspaces.

  • Go to IaCM module registry to publish and manage reusable Terraform modules in the Harness private module registry.

PreviousPlatform Integrations
NextContinuous Delivery (CD)

Last updated

Was this helpful?