Harbor

io.github.oreondevPublished by GitHub account oreondevv0.1.1Updated Nov 5, 2026

Read-only access to a Harbor registry: projects, artifacts, vulnerabilities, robots and replication.

The publisher's own server: Harbor Notes

VerifiedSTDIODesktop onlyCloud & InfrastructureDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Read-only MCP server for a Harbor container registry, letting an assistant inspect projects, artifacts, vulnerabilities, robots and replication.

What you can do
  • Inspect the registry itself: version, authentication mode and the identity the server acts as
  • List projects and read one project's quota, CVE allowlist, retention and immutability settings
  • List repositories and artifacts with tags, size, push and pull times and scan summary
  • Fetch an artifact's vulnerabilities, worst first
  • Review access: project members with roles, and robot accounts with permissions and expiry
  • Check replication endpoints and policies with the last run, webhook policies and the garbage collection schedule
When to use it
Useful when you want an assistant to answer questions about a running Harbor registry — what images exist, which artifacts have open CVEs, who can access a project, or whether replication and garbage collection are healthy — without giving it write access.
Requirements
Runs as a local process over stdio, typically via the published container image (Docker) or a downloaded binary. Needs HARBOR_URL, HARBOR_USERNAME and HARBOR_PASSWORD (a read-only system robot account is recommended). Optional: HARBOR_CA_FILE, HARBOR_INSECURE_SKIP_VERIFY, HARBOR_MCP_RATE, and HARBOR_MCP_HTTP_TOKEN for HTTP mode. Network access to the Harbor instance.
Before you install
Requires Harbor credentials in environment variables; a robot secret is shown only once at creation. An administrator account also works but grants the assistant far more than needed, so prefer a read-only robot. HARBOR_INSECURE_SKIP_VERIFY disables TLS verification of Harbor. All twelve tools are read-only and no tool deletes anything; write tools are planned only behind an explicit opt-in.

Installation

In SourceWeft

  1. Open Harbor in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Harbor MCP server

A Model Context Protocol server for Harbor, the open-source container registry. It lets AI assistants such as Claude, Cursor and VS Code answer questions about a running Harbor: projects and quotas, repositories and artifacts, vulnerability scan results, robot accounts, replication health and garbage collection.

Documentation: https://www.oreonit.com/harbor-mcp/

This is an independent community project. It is not affiliated with or endorsed by the Harbor project or the CNCF; Harbor is a trademark of The Linux Foundation.

Status

Changes per release are in the release notes. The twelve read tools work over stdio and streamable HTTP, and are tested against a fake Harbor, Harbor 2.15 on every pull request and Harbor 2.12 to 2.15 nightly, as an administrator and as the read-only robot below. The design is in docs/DESIGN.md.

  • Read-only: twelve tools covering projects, repositories, artifacts, vulnerabilities, robots, members, registries, replication, webhooks and garbage collection. Write tools (scan, start replication, add a label, create a project) will come later, only with an explicit opt-in. No tool deletes anything.
  • Secrets stay out of the conversation: Harbor credentials, robot secrets and webhook authorization headers never appear in tool results, logs or errors.
  • stdio for desktop clients, and streamable HTTP with a bearer token for running in a cluster.
  • A signed multi-arch image, ghcr.io/oreondev/harbor-mcp, listed in the official MCP Registry as io.github.oreondev/harbor-mcp.
  • Uses the Harbor client of harbor-resource-operator, the Kubernetes operator that manages Harbor projects, robot accounts and replication as code.

Tools

ToolAnswers
harbor_system_infoHarbor version, authentication mode, and the user or robot the server acts as
harbor_list_projects, harbor_get_projectprojects; quota, CVE allowlist, retention and immutability of one
harbor_list_repositories, harbor_list_artifactsrepositories; artifacts with tags, size, push and pull times and scan summary
harbor_get_vulnerabilitiesthe vulnerabilities of one artifact, worst first
harbor_list_members, harbor_list_robotswho has access: members with roles, robot accounts with permissions and expiry
harbor_list_registries, harbor_list_replicationsreplication endpoints and policies, with the last run
harbor_list_webhooks, harbor_get_gcwebhook policies; the garbage collection schedule

Set up a read-only Harbor identity

Run the server as a system robot account that can only read. docs/read-only-robot.json is the request body for Harbor's API, with the permissions the tools need (the end-to-end tests use the same file):

sh
curl -u admin -H 'Content-Type: application/json' -d @docs/read-only-robot.json \  https://harbor.example.com/api/v2.0/robots

Harbor shows the secret once, in the response; the user name is robot$harbor-mcp. An administrator account also works, but gives the assistant more than it needs.

Use it

Configuration comes from environment variables; each except HARBOR_CA_FILE can instead be read from a file named by <NAME>_FILE, for mounted secrets:

VariableMeaning
HARBOR_URLHarbor base URL, for example https://harbor.example.com (required)
HARBOR_USERNAME, HARBOR_PASSWORDthe robot name and secret (required)
HARBOR_CA_FILEextra CA bundle (PEM) for Harbor's certificate
HARBOR_INSECURE_SKIP_VERIFYtrue to skip TLS verification of Harbor
HARBOR_MCP_RATErequests per second to Harbor, default 10
HARBOR_MCP_HTTP_TOKENbearer token for HTTP mode

One-click install (the client asks for the URL and credentials, or you fill them in afterwards):

[Install in VS Code] [Add to Cursor]

Claude Code, with the image (replace 0.1.1 with the latest release):

sh
claude mcp add harbor -e HARBOR_URL=https://harbor.example.com -e 'HARBOR_USERNAME=robot$harbor-mcp' -e HARBOR_PASSWORD=... \  -- docker run -i --rm -e HARBOR_URL -e HARBOR_USERNAME -e HARBOR_PASSWORD ghcr.io/oreondev/harbor-mcp:0.1.1

Claude Desktop, Cursor and other clients that read an mcpServers file:

json
{  "mcpServers": {    "harbor": {      "command": "docker",      "args": ["run", "-i", "--rm", "-e", "HARBOR_URL", "-e", "HARBOR_USERNAME", "-e", "HARBOR_PASSWORD",               "ghcr.io/oreondev/harbor-mcp:0.1.1"],      "env": {        "HARBOR_URL": "https://harbor.example.com",        "HARBOR_USERNAME": "robot$harbor-mcp",        "HARBOR_PASSWORD": "..."      }    }  }}

Without Docker, download a binary from the releases (or go install github.com/oreondev/harbor-mcp/cmd/harbor-mcp@latest) and use harbor-mcp as the command.

HTTP mode

For a shared server, for example a Deployment next to Harbor, start it with -http and a token:

sh
docker run -d -p 8080:8080 -e HARBOR_URL -e HARBOR_USERNAME -e HARBOR_PASSWORD -e HARBOR_MCP_HTTP_TOKEN \  ghcr.io/oreondev/harbor-mcp:0.1.1 -http :8080claude mcp add --transport http harbor https://harbor-mcp.example.com/mcp -H "Authorization: Bearer $HARBOR_MCP_HTTP_TOKEN"

MCP is served at /mcp and every request needs the token; GET /healthz is open for probes. Without a token the server only listens on a loopback address. Put TLS in front of it (an ingress or a mesh).

Verify the image

sh
cosign verify ghcr.io/oreondev/harbor-mcp:0.1.1 \  --certificate-identity-regexp '^https://github.com/oreondev/harbor-mcp/\.github/workflows/release\.yml@' \  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Maintainers

Maintained by Oreon IT. Issues and pull requests are welcome.

Security

Report vulnerabilities privately; see SECURITY.md.

Licence

Apache-2.0.

Source: README.md at commit d4b969f

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the package type cannot run in the sandbox.

Version history

2
  1. v0.1.1LatestNov 5, 2026
  2. v0.1.0Nov 5, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Harbor integrations

Harbor Notes

my.harborOfficial publisher

Search, read, write and organize your notes and tasks in Harbor, an Evernote-compatible notes app.

Streamable HTTPWeb executableAuth
Productivity & WorkflowCredential requiredOct 25, 2026

Harbor AIops

Published by GitHub account AIops-tools

Governed Harbor container-registry operations: 39 audited MCP tools to inspect projects, artifacts, scans, GC and replication, plus guarded tag writes.

STDIODesktop only
Cloud & InfrastructureNot validated · the server did not startNov 5, 2026

Harbor

Published by GitHub account 7jb28c9mtk-web

Remote Harbor MCP server that lets an assistant read your portfolio, program and project data and add tasks, risks and check-ins.

Streamable HTTPWeb executableAuth
Productivity & WorkflowCredential requiredOct 26, 2026

Agent Harbor pay-per-call tools

Published by GitHub account yandyman

Agent Harbor pay-per-call tools's hosted MCP server; no sign-in required; Streamable HTTP; 10 tools.

Streamable HTTPWeb executable
Files & Storage10 toolsOct 25, 2026

BioHarbor

Published by GitHub account danielLuo2

BioHarbor is a local MCP server that lets an AI agent run real bioinformatics compute — sequence stats, translation, ORF finding, MMseqs2 homology search and…

STDIODesktop only
Cloud & InfrastructureNot validated yetOct 31, 2026