oreondev/harbor-mcp

A Model Context Protocol server for Harbor, the open-source container registry. It lets AI assistants such as Claude, Cursor and VS Code answer questions about a running Harbor: projects and quotas, repositories and artifacts, vulnerability scan results, robot accounts, replication health and garbage collection.
Documentation: https://www.oreonit.com/harbor-mcp/
This is an independent community project. It is not affiliated with or endorsed by the Harbor project or the CNCF; Harbor is a trademark of The Linux Foundation.
## Status
Changes per release are in the release notes. The read tools work over stdio and streamable HTTP, and are tested against a fake Harbor, Harbor 2.15 on every pull request and Harbor 2.12 to 2.15 nightly, as an administrator and as the read-only robot below. The design is in docs/DESIGN.md.
Read-only towards Harbor: fourteen tools covering projects, repositories, artifacts, vulnerabilities, robots, members, registries, replication, webhooks, garbage collection and agent skills stored in Harbor. Write tools (scan, start replication, add a label, create a project) will come later, only with an explicit opt-in. No tool deletes anything in Harbor.
Opt-in skill install: with HARBOR_MCP_SKILLS_DIR set, harbor_install_skill writes a skill from Harbor into that directory on your machine, signed skills only by default.
Secrets stay out of the conversation: Harbor credentials, robot secrets and webhook authorization headers never appear in tool results, logs or errors.
stdio for desktop clients, and streamable HTTP with a bearer token for running in a cluster.
A signed multi-arch image, ghcr.io/oreondev/harbor-mcp, listed in the official MCP Registry as io.github.oreondev/harbor-mcp.
Uses the Harbor client of harbor-resource-operator, the Kubernetes operator that manages Harbor projects, robot accounts and replication as code.
## Tools
| Tool | Answers |
| harbor_system_info | Harbor version, authentication mode, and the user or robot the server acts as |
| harbor_list_projects, harbor_get_project | projects; quota, CVE allowlist, retention and immutability of one |
| harbor_list_repositories, harbor_list_artifacts | repositories; artifacts with tags, size, push and pull times and scan summary |
| harbor_get_vulnerabilities | the vulnerabilities of one artifact, worst first |
| harbor_list_members, harbor_list_robots | who has access: members with roles, robot accounts with permissions and expiry |
| harbor_list_registries, harbor_list_replications | replication endpoints and policies, with the last run |
| harbor_list_webhooks, harbor_get_gc | webhook policies; the garbage collection schedule |
| harbor_list_skills, harbor_get_skill | agent skills stored in a project as OCI artifacts; one skill's SKILL.md and files, digest and signature status |
| harbor_install_skill | installs a skill into HARBOR_MCP_SKILLS_DIR (registered only when that is set) |
Pushing, signing and installing skills, and the extra pull permission reading them needs: docs/skills.md.
## Set up a read-only Harbor identity
Run the server as a system robot account that can only read. docs/read-only-robot.json is the request body for Harbor's API, with the permissions the tools need (the end-to-end tests use the same file):