Cloud Harness MCP
An MCP server that opens a remote repository clone in an isolated container and gives the agent files, commands, Git and tasks.
- 106 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The server executes arbitrary commands in an executor with a shared kernel and a key grants full authority
- Works with your repositories and can push changes to GitHub
Install
- Works in
Manual install
npx skills add bestagentkits/cloud-harness-mcp --skill cloudharnessThe skill install command from the README. The skill does not connect MCP or set credentials, those are configured separately in the client.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The server executes arbitrary commands in an executor with a shared kernel and a key grants full authority
- Works with your repositories and can push changes to GitHub
This is third-party code. Review the repository files before installing.
What it does
Cloud Harness MCP works as a remote coding environment reachable over authenticated Streamable HTTP. A `workspace_open` call with a repository address creates an isolated clone in a time-limited Docker container, and the agent gets tools for files and patches, code and symbol search, commands and interactive shells, task graphs, Git and worktrees, skills, hooks, memory and repository-defined deployments. Git transfer goes through a separate helper: the GitHub App token is short-lived and never reaches the executor, and pushing to the remote needs write access on the app installation. There is also a local mode `cloud-harness-mcp --transport stdio --workspace /path/to/project` where the server works directly in a chosen folder. The repository holds a `cloudharness` skill describing every operation, bound and recovery path.
Who it is for. Teams and solo developers who want agent work to run on a separate server and connect Claude Code, Codex or Cursor to it.
Good fit when
- Agent code should run on a server rather than a laptop.
- Each task gets a clean isolated clone of the repository.
- Pushes to GitHub go through an app with a limited token instead of your keys.
- Several projects or clients connect to one server.
- A local mode with path confinement in a chosen folder is needed.
Not a fit when
- An environment with mutually distrusting users: operator isolation is not built for a hostile multi-tenant model.
- You have no Docker and no wish to administer a service.
- A local agent without a remote environment is enough.
Example request
Open a workspace for https://github.com/example/app, run the tests, make a fix and show the diff without pushing to GitHub.MCP
- Transport
- http, stdio
- Authentication
- API key
Environment variables
CLOUD_HARNESS_MCP_TOKENrequired, secret- Client access token: a dashboard key or owner token. Keep it only in private client configuration.
Limitations
The service is built for one security domain: operators must trust one another because commands run in an executor with a shared kernel. An API key grants the creator's full authority including arbitrary commands, with no per-tool scopes. Running it needs Node.js 24 or newer, Docker Engine and Docker Compose v2, and `.env` secrets must be filled with independent random values. Local mode supports Linux and macOS, Windows needs WSL, and path confinement is not an OS sandbox. The repository was last updated on 6 November 2026 and uses the MIT licence.
How to disable. Remove the server entry in the MCP client settings, revoke keys in the dashboard and stop the service with `docker compose down`. In local mode the server never deletes project folders.
FAQ
How do remote and local modes differ?
Remote creates a clone in a time-limited Docker container, while local works directly in a chosen folder over stdio and never deletes it.
How does code reach GitHub?
Through a separate Git helper: a short-lived GitHub App token never reaches the executor, and push needs write access on the app installation.
Are there per-tool permissions?
No. Every key grants the creator full authority including arbitrary commands in the executor; keys can be created, revoked and replaced.
Which clients connect?
Claude Code, Codex, Cursor and other MCP clients through OAuth or a key header; ChatGPT needs an internet-reachable address.
What does self-hosting need?
Node.js 24 or newer, npm, Docker Engine and Compose v2; then `npm ci`, a copy of `.env.example` and `docker compose` image builds.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server built into the Harness terminal for macOS: agents read sessions and panes, and input is enabled by a separate flag
A secure MCP runtime through which an agent operates local machines, servers and containers
An MCP server giving ChatGPT and agents a terminal, files, Playwright and remote machines inside an isolated workspace.
The Coder MCP server manages workspaces and templates, edits files, runs commands and drives Coder agent chats.
The docker mcp CLI plugin and gateway: MCP servers from Docker's catalog in isolated containers behind one connection point
MCP SSH Manager
mcp-ssh-manager
Managing several SSH connections from Claude Code and Codex: commands, file transfer, databases and backups
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Cloud Harness MCP (this card) | no | API key | 106 | |
| SSH MCP | no | API key | 875 | runs commands on existing remote servers over SSH; here a repository clone in a limited container for each task |
| MetaMCP | no | API key | 2,762 | a gateway that merges several MCP servers into one address; here the code executor itself with Git and tasks |
README in short
The README draws an architecture with separate control and execution planes, lists tools by group and warns about security boundaries.