Harness MCP Server
for AI Agents

Create a new Feature Flags SDK API key for an environment. Use Server keys for backend SDKs and Client keys for frontend or mobile SDKs.

Retrieve all Feature Flags SDK API keys for a specific environment, including their type, name, and metadata.

Retrieve detailed metadata for a specific SDK API key, including its type, name, and expiration status.

Delete an SDK API key, immediately revoking access for all Feature Flag SDKs that use it.

Create a new environment in a project to serve as a deployment target for feature flag targeting and release management.

Retrieve a paginated list of all environments in a project, providing the environment identifiers needed for feature flag and deployment actions.

Retrieve full details for a specific environment by its identifier, including name, type, tags, and configuration metadata.

Update an existing environment by replacing all fields. Provide complete values for every field, not just the ones being changed, as this is a full replacement operation.

Delete an environment from a project, permanently removing all environment-specific feature flag states, targeting rules, and variation maps.

Create a new feature flag in a project with specified variations, kind, and default serving behavior.

Retrieve all feature flags for a project with optional filtering by name, kind, status, and pagination support.

Retrieve a single feature flag by identifier with full configuration details including variations, targeting rules, and environment state.

Modify a feature flag using instruction-based patching to toggle state, update targeting rules, add targets to variations, or change serving configuration.

Delete a feature flag by identifier, removing it from the project and all SDK evaluations.

List Harness user groups mapped to the StackOne IAM unified group schema.

Retrieve a single Harness user group by identifier, mapped to the StackOne IAM unified group schema.

List Harness organizations within the account, mapped to the StackOne IAM unified organization schema.

Retrieve a single Harness organization by identifier, mapped to the StackOne IAM unified organization schema.

List Harness roles (both built-in and custom) mapped to the StackOne IAM unified role schema.

Retrieve a single Harness role by identifier, mapped to the StackOne IAM unified role schema.

List Harness users mapped to the StackOne IAM unified user schema. Returns each user's UUID, email, name, status, and MFA flag; role assignments are included when expand contains "roles".

Retrieve a single Harness user by UUID, mapped to the StackOne IAM unified user schema. Role assignments are included when expand contains "roles".

Retrieve a paginated list of pending invitations at account, organization, or project scope, showing who has been invited but has not yet accepted.

Retrieve a single pending invitation by its invite ID, returning the full invite details including email, role bindings, invite type, and approval status.

Delete a pending invitation by its identifier, permanently canceling the invitation so the invitee can no longer accept it.

Create a new organization in the Harness account with a unique identifier, name, and optional description and tags.

Retrieve a paginated list of all organizations accessible under the authenticated account, with optional filtering by identifiers, search term, and sort order.

Retrieve the full details of a single organization by its unique identifier, including name, description, tags, and metadata.

Replace all fields of an existing organization. Provide values for every field, not just the fields being changed, as this performs a full replacement.

Permanently delete an organization and all its contained resources, including projects, feature flags, targets, and segments.

Create a new project within an organization to serve as a container for feature flags, targets, segments, and other module resources.

Retrieve a paginated list of all projects the authenticated user is a member of, with optional filtering by organization, module type, and search term.

Retrieve the full details of a specific project by its unique identifier, including enabled modules, color, and tags.

Update an existing project by replacing all fields. Provide the complete project object with every field, not just the changed ones.

Permanently delete a project and all its contained resources including feature flags, targets, segments, and environments. This action is irreversible.

Assign a role to a principal (user, user group, or service account) within a resource group at a specific scope, granting that principal the role's permissions.

Retrieve a paginated list of role assignments at a given scope, showing which principals (users, user groups, service accounts) hold which roles on which resource groups.

Retrieve the full details of a single role assignment by its identifier, including the assigned role, resource group, principal, scope, and management flags.

Remove a role assignment, revoking the assigned role's permissions from the principal (user, user group, or service account) at the specified scope.

Create a custom role with specific permissions and allowed scope levels for fine-grained access control.

Retrieve a paginated list of roles with their permissions, scope levels, and assignment counts, with optional filtering by name and management type.

Retrieve the full details of a single role including its permission identifiers, allowed scope levels, and management metadata.

Update a role's name, permissions, scope levels, description, and tags via full replacement. Requires all fields to be provided.

Permanently delete a role by its identifier. Returns the deleted role object on success.

Create a new target group (segment) with explicit target inclusion/exclusion and rule-based targeting clauses for a given project and environment.

Retrieve all target groups (segments) for an environment with optional filtering by name or identifier and configurable sorting and pagination.

Retrieve full details for a specific target group including its included/excluded targets, targeting rules, and version metadata.

Modify a target group using instruction-based patch operations to add or remove included and excluded targets.

Delete a target group (segment) permanently from the specified environment, removing all target associations.

Create a service account at account, organization, or project scope, usable as a SERVICE_ACCOUNT principal in role assignments.

Retrieve service accounts at account, organization, or project scope, resolving a service account's name or email to the identifier required by role assignment actions.

Retrieve a single service account by identifier, including its token count and role assignment metadata.

Update a service account's name, email, description, or tags by replacing the full object.

Delete a service account by identifier, removing its role assignments and API keys.

Create a new tag for organizing and categorizing feature flags within a project. Tags are auto-created when attached to feature flags, but this action lets you pre-define them.

Retrieve all tags available for categorizing feature flags in a given project and environment. Returns one row per tag-to-flag association, so entries repeat; de-duplicate client-side.

Retrieve a specific tag by identifier. Returns only the tag's identifier and name; to find which flags use the tag, call list_features with the tags filter.

Delete a tag and automatically remove it from all feature flags it was associated with.

Create a new feature flag target representing a user, service, or entity for flag evaluation in a specific environment.

Retrieve a paginated list of all feature flag targets for a specific environment, with optional filtering and sorting.

Retrieve the full details for a specific target, including its custom attributes and associated segments.

Permanently remove a target from the environment, stopping all feature flag evaluations for this target.

Create a new user group at account, organization, or project scope with optional initial members, notification channels, and SSO linking.

Retrieve a paginated list of user groups at account, organization, or project scope, with optional filtering by name, scope inheritance, and SSO group linkage.

Retrieve the full details of a single user group by its identifier, including the member user list, notification configurations, and SSO linking status.

Update an existing user group via full replacement (PUT). All fields must be provided, not just the changed ones -- omitted optional fields will be cleared.

Permanently delete a user group by its identifier. Member users are not deleted from the account.

Invite one or more users to the account, organization, or project by email address, with optional role bindings and user group assignments at time of invitation.

Retrieve a paginated list of users in the account, organization, or project scope, with optional filtering by name, email, specific UUIDs, and parent scope inheritance.

Retrieve a single user's full profile and role assignments by UUID, including every role binding with its resource group, scope level, and management flags.

Update the authenticated caller's user profile by replacing the full user object. Call get_user first, then resend all fields.

Remove a user from the specified account, organization, or project scope, revoking all their role assignments and access at that scope without deleting their Harness account.