CLOUD HARNESS MCP
GitHub★ Star Connect Agent →
STREAMABLE HTTP MCP // SINGLE-OWNER REMOTE HARNESS

Autonomous Coding.
Isolated Sandboxes.
Zero Credential Leaks.

Cloud Harness MCP gives Claude Code, Cursor, Codex, and ChatGPT full execution power over isolated repository clones inside bounded Docker executors — without ever exposing Docker host sockets or GitHub App secrets.

Initialize Harness ⚡ View Architecture Diagram ↓
52+
Structured Tools
100%
Non-Root Sandboxes
0s
TTL Residual Leak

agent@claude-code:~$ call mcp.workspace_open({

"repositoryUrl": "https://github.com/org/core-infra",

"idempotencyKey": "task_448f_09a1"

})


[200 OK] Streamable HTTP Connection Established (14ms)

├── Ingress: Cloudflare Access OAuth token validated

├── Runner: Ephemeral GitHub broker minted stdin-only push key

├── Docker: Spawned non-root executor (TTL: 1800s, net: none)

└── Workspace Ready: ws_8f93e120da


agent@claude-code:~$ call mcp.exec_run({

"workspaceId": "ws_8f93e120da",

"command": "npm test -- --bail"

})

✓ Test suite completed in 1.42s (0 host leaks, 0 socket mounts)

// Hardened Topology

Live Architecture Signal Matrix

Explore how authenticated MCP requests navigate the isolated boundary layers with live packet animation.

● LIVE BOUNDARY TRACE — AUTHENTICATED CONTROL VS ISOLATED EXECUTION PACKET FLOW: ACTIVE
01 // INGRESS PERIMETER AI Client / IDE Claude • Cursor • Codex Ingress Proxy Cloudflare Access / SSO 02 // TRUSTED CONTROL PLANE Stateless MCP Zod Validations Trusted Runner Policy & Docker Auth SQLite State Encrypted Records GitHub Broker 60s Stdin Tokens 03 // EXECUTION PLANE (TTL SANDBOX) Non-Root Docker Executor UID 1000 • Read-Only Root • Net: None Isolated Repo Clone & AST Engine Ephemeral Git Helper Stdin Auth Push → GitHub Origin
← Swipe horizontally to view complete architecture blueprint →
Plane 01 // Ingress Proxy

Stateless Ingress & SSO

Cloudflare Access OAuth or Gateway API tokens are validated at the perimeter. The ingress proxy has zero secrets and never joins the backend Docker network.

  • ✓ Managed OAuth via GitHub/Google SSO
  • ✓ Static Bearer tokens for headless CI
  • ✓ Rate-limited loopback forwarding
Plane 02 // Trusted Control

Policy & Lifecycle Runner

Maintains SQLite state records, verifies TTL limits, and negotiates short-lived GitHub App tokens piped directly over stdin to temporary git helpers.

  • ✓ Idempotent workspace orchestration
  • ✓ Secrets never touch disk or env vars
  • ✓ Principal authorization checks
Plane 03 // Execution Plane

Non-Root Docker Sandbox

Every workspace lives in an isolated container. Default network mode is none, root filesystem is read-only, and memory/CPU limits are strictly enforced.

  • ✓ Non-root UID execution only
  • ✓ Auto-purged upon workspace_close
  • ✓ No access to host Docker daemon
// Lifecycle Dynamics

Bounded Coding Workflow

A high-velocity, deterministic sequence from workspace boot to safe git push and automatic sandbox purging.

● SEQUENCE TRACE — TIME-LIMITED WORKSPACE LIFECYCLE 4-STAGE CONTINUOUS VERIFICATION
AI Client Control Plane Docker Executor GitHub Origin 1. workspace_open(repoUrl, idempotencyKey) 2. Ephemeral Git Clone (Token over stdin) 3. Spawn Non-Root Container (TTL: 30m, Net: None) 4. Returns opaque workspaceId 5. grep_search / files_apply_patch / shell_open / tasks_run 6. Real-time stream results (Zero host leaks) 7. git_push(refspec, forceWithLease) 8. Broker push via short-lived stdin helper 9. workspace_close → Container & volumes destroyed (0 residual state)
← Swipe horizontally to view full sequence workflow →
// Comprehensive Surface

52+ Precision Coding & Agent Tools

From file manipulation and AST code intelligence to repository automation and autonomous multi-agent swarm orchestration.

symbols_search LIVE

Search LSP symbols, declarations, and definitions across TypeScript, Go, Python, and Rust.

files_apply_patch LIVE

Apply line-anchored atomic text patches with conflict detection and rollback.

grep_search LIVE

Rust-powered regex search with cross-line multiline support and gitignore respect.

shell_open & shell_io LIVE

Interactive persistent PTY shell sessions supporting full terminal interaction and ANSI signals.

tasks_run & tasks_graph LIVE

Dispatch DAG multi-stage tasks with topological barriers, artifact tracking, and timeouts.

worktrees_create LIVE

Spawn instant isolated branch worktrees allowing subagents to work without Git collisions.

git_push LIVE

Push commits through stdin-fed short-lived GitHub App tokens with force-with-lease safety.

skills_list & skills_run LIVE

Discover and execute repository-defined custom skills, automated code reviewers, and linters.

hooks_list & hooks_run LIVE

Run repository lifecycle hooks (pre-commit, post-build, security-scan) in isolated sandboxes.

deployments_run LIVE

Trigger owner-reviewed repository deployment recipes directly from AI agent context.

memories_read & write LIVE

Store and recall durable repository decisions and conventions across agent sessions.

agents_spawn COMING SOON

Instantly boot autonomous subagent peers within dedicated micro-workspaces.

agents_delegate COMING SOON

Delegate bounded sub-tasks to specialized subagents with strict output schemas.

agents_inbox & wait COMING SOON

Peer-to-peer asynchronous messaging and coordination across distributed agent fleets.

// Plug & Play

Connect Any AI Coding Agent

Compatible with all modern MCP-enabled IDEs, terminals, and web agents in seconds.

Claude Code Setup

Connect via Streamable HTTP with your operator API key. Claude Code will instantly acquire all remote execution capabilities.

  • → Full worktree & subagent task graph support
  • → Non-root execution ensures your local machine stays clean
  • → Auto-reconnect with session recovery
claude mcp add cloud-harness \
  --transport http \
  https://api.harness.zuey.me/mcp \
  --header "Authorization: Bearer YOUR_OPERATOR_KEY"
// Zero-Trust Security Guarantees

Hardened Single-Owner Invariants

Designed intentionally for one trusted operator or team. Arbitrary execution capability inside shared-kernel executors with strict boundary separation.

🔒 No Docker Host Socket Mounting

The API and Ingress proxy never receive Docker socket mounts or host volume binds. Docker daemon control remains strictly localized to the trusted Runner daemon.

🔑 Zero-Disk GitHub App Credentials

GitHub App private keys reside exclusively in runner control memory. Installation tokens are short-lived (60s) and piped over stdin to an ephemeral git helper.

🛡️ Non-Root Docker Sandboxes

Executors run as UID 1000 with read-only root filesystems, memory/CPU caps, and network mode none by default.

⏱️ Automatic TTL Cleanup & Zero Residuals

Workspaces are destroyed immediately upon workspace_close or when TTL expires, leaving zero leftover state, containers, or leaked temp files.

Ready to Upgrade Your AI Agent Fleet?

Deploy Cloud Harness MCP in under 5 minutes with Docker Compose or connect your existing agent to our managed control plane.

Read Getting Started Guide ↗ Star on GitHub ★