Harbor MCP

@boltinno/harbor-mcp is a community Model Context Protocol server for Harbor Container Registry. It offers agent-friendly administrative workflows instead of mirroring hundreds of REST endpoints. Version 0.1 targets Harbor 2.15.2 and the official Harbor API v2.0, with stdio as its primary transport.

Features

• Registry health, statistics, and inventory
• Project creation, inspection, listing, and guarded removal
• Repository and artifact discovery, including tags, scan overview, and accessories
• Signature/accessory-based artifact trust summaries
• Robot account lifecycle, structured project permissions, expiry, enable/disable, and one-time secret rotation
• Read-only MCP resources and reusable security/trust prompts
• Secure defaults: TLS verification, bounded requests, sanitized failures, no stdout logging

See the client evaluation for the API coverage and why this release uses an internal REST adapter.

Run with npx

Node.js 20 or newer is required. After publication to npm:

HARBOR_API_BASE=https://registry.example.com/api/v2.0 \
HARBOR_AUTH_USER=mcp-user \
HARBOR_AUTH_PASS=your-secret \
npx -y @boltinno/harbor-mcp

MCP client configuration (including Claude Desktop and other stdio clients):

{
  "mcpServers": {
    "harbor": {
      "command": "npx",
      "args": ["-y", "@boltinno/harbor-mcp"],
      "env": {
        "HARBOR_API_BASE": "https://registry.example.com/api/v2.0",
        "HARBOR_AUTH_USER": "mcp-user",
        "HARBOR_AUTH_PASS": "your-secret"
      }
    }
  }
}

MCPHub can use the same command, arguments, and environment map in its server configuration.

Configuration

| Variable | Required | Default | Meaning | | ------------------------ | -------- | ------- | ---------------------------------------------- | | HARBOR_API_BASE | Yes | — | Harbor base URL ending in /api/v2.0 | | HARBOR_AUTH_USER | Yes | — | Dedicated Harbor user or robot username | | HARBOR_AUTH_PASS | Yes | — | Password or robot secret | | HARBOR_VERIFY_TLS | No | true | Set to false only for controlled development | | HARBOR_REQUEST_TIMEOUT | No | 30000 | Request timeout in milliseconds |

Basic authentication is supported. Create a least-privilege Harbor identity for the operations an agent may perform. Credentials, request bodies, and returned robot secrets are never logged. New robot secrets are only included in the direct response to robot_create or robot_rotate_secret; the caller must store them securely. No diagnostic output is written to stdout because it is reserved for MCP.

Tools

| Domain | Tools | | -------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | Registry | registry_health, registry_inventory | | Projects | project_list, project_inspect, project_create, project_remove | | Content | repository_list, artifact_list, artifact_inspect, artifact_trust_status, artifact_remove, tag_list, tag_create, tag_remove | | Robots | robot_list, robot_inspect, robot_create, robot_configure_access, robot_rotate_secret, robot_revoke |

Destructive tools require a literal confirm: true. Robot permissions use readable resource:action values, such as repository:pull, rather than Harbor's nested access records. Common supported resources include repository, artifact, tag, scan, scanner, accessory, member, and quota; supported actions are pull, push, create, read, update, delete, list, operate, scanner-pull, and stop. Set a robot's level to system for access spanning projects or project for a project-scoped account.

artifact_trust_status reports signature accessories exposed by Harbor. This is evidence recorded by the registry, not cryptographic verification; use Cosign or Notation to verify content independently.

Resources and prompts

• registry://health
• registry://projects
• registry://projects/{project}
• audit_registry_security — guides a read-only registry security review
• inspect_artifact_trust — guides interpretation of artifact trust metadata

Development

npm ci
npm run lint
npm run typecheck
npm test
npm run build

Tests mock HTTP and require no Harbor instance. A live integration suite may be added later and must remain opt-in through explicit environment variables.

Publishing

The package exposes the harbor-mcp executable and is configured for public scoped publication with npm provenance. The release-triggered GitHub Actions workflow runs all checks and uses npm trusted publishing (OIDC); no npm token belongs in this repository. Maintainers must configure the package and GitHub npm environment before publishing. This repository does not publish automatically outside an explicit GitHub Release.

Compatibility and roadmap

The tested contract is Harbor 2.15.2. Scanner availability, signature metadata, authorization, and optional features vary between installations. Planned v0.2 work includes project members and users, quotas, retention and tag-immutability policies, system configuration, registries, replication, scanners, audit logs, and safe garbage-collection/job workflows.

Contributing

Issues and focused pull requests are welcome. Keep the project generic, public, and independent of any customer or product-specific policy. Add tests for behavior and run every quality command above. Security reports should avoid including credentials or registry data in public issues.

License

Licensed under the Apache License, Version 2.0. Copyright © 2026 BoltINNO.