Cloud Harness MCP Repository

Remote coding, under one owner

Keep the controls close.

Cloud Harness MCP gives one trusted owner a narrow, observable route into a time-limited repository workspace.

Start safely Choose a client
Live boundary traceOne owner. One bounded workspace.
Owner request enters a bounded Cloud Harness workspace A request moves from the owner client through the control plane into a non-root executor. The animated packet represents an authenticated operation, not a credential flow. TRUSTED CONTROL EXECUTION OWNER MCP client RUNNER policy WORKSPACE non-root · TTL AUTHENTICATED REQUEST STRUCTURED RESULT

Repository code is an input, not a peer.

Commands, dependencies, hooks, skills, and Git metadata execute only in the executor. The control plane stays separate from Docker authority and repository credentials.

Getting started

Set up one approved client, open one bounded workspace, then keep every later operation scoped to its opaque ID.

  1. Connect

    Keep the token local

    Choose a supported client path. Cloud-hosted connectors need the documented OAuth gateway.

  2. Open

    Use a clean repository URL

    Call workspace_open with a credential-free HTTPS URL and fresh idempotency key.

  3. Work

    Keep the workspace ID

    Use the returned opaque workspaceId for files, code, commands, and Git.

  4. Close

    End the execution window

    Close shells, sessions, and unwanted tasks before workspace_close.

Read the full start guide

How it works

A request moves through a deliberately narrow lane. The animation traces direction; the labels describe the real boundary.

Request and result trace authenticated operation structured result
Cloud Harness request lifecycle An owner client sends an authenticated operation through the credential-free ingress and stateless API to the runner. The runner manages a non-root time-limited executor. The result returns through the same trusted request path. PUBLIC EDGE TRUSTED CONTROL EXECUTION PLANE OWNER MCP client INGRESS no secret MCP API stateless RUNNER policy + lifecycle EXECUTOR non-root · TTL DEFAULT NETWORK: NONE NO DOCKER SOCKET NO CONTROL CREDENTIALS
Ingress bridges and forwards. The API validates requests. Runner alone owns policy and lifecycle. The executor only receives the bounded workspace.
On narrow screens, use the arrow keys to pan this diagram horizontally.
  1. The owner client sends an authenticated operation through credential-free ingress and the stateless MCP API.
  2. The runner applies policy and manages the workspace lifecycle.
  3. The non-root executor performs repository work until close or TTL cleanup.
  4. A structured result returns to the owner through the same trusted path.
Read the MCP lifecycle

Coding workflow

Open a workspace with intent, do the work inside it, then end the execution window cleanly.

Bounded coding loopOptional origin-only transfer stays outside execution.
Cloud Harness coding workflow workspace_open creates an opaque workspace identity. File, code, command, shell, session, and task operations run in the executor. Optional remote Git transfer pauses the executor and uses a separate helper with a short-lived token. workspace_close removes the executor and workspace. CONTROL LIFECYCLE EXECUTION WORKSPACE ORIGIN-ONLY TRANSFER OPEN workspace_open WORK files · code · commands HELPER short-lived token ORIGIN GitHub CLOSE workspace_close NO TOKEN · NETWORK DEFAULT: NONE
The executor works locally. Remote Git becomes a deliberate handoff through a sibling helper, not executor egress.
On narrow screens, use the arrow keys to pan this diagram horizontally.

The executor has no network by default and never receives GitHub App or deployment credentials.

MCP tools

Every public tool stays inside the owner-bound workspace. Inputs, limits, and approval hints live in the contract source.

Workspace lifecycle

workspace_openworkspace_listworkspace_statusworkspace_close

Files and code intelligence

files_listfiles_readfiles_writefiles_apply_patchfiles_deletefiles_movefiles_mkdirgrep_searchsymbols_searchsymbols_references

Commands and shells

exec_runshell_openshell_ioshell_close

Sessions and tasks

sessions_listsessions_opensessions_iosessions_closetasks_listtasks_runtasks_statustasks_canceltasks_graph

Git and worktrees

git_statusgit_diffgit_loggit_branchgit_checkoutgit_addgit_commitgit_fetchgit_pullgit_pushgit_mergegit_rebaseworktrees_listworktrees_createworktrees_remove

Repository extensions

skills_listskills_readskills_runhooks_listhooks_runmemories_listmemories_readmemories_writedeployments_listdeployments_run

Read tool semantics

Architecture

Authority is separated by role. The motion marks the request path, not a permission path into the executor.

Trust boundary map request path isolated Git handoff
Cloud Harness architecture and authority boundaries Credential-free ingress bridges the public loopback edge to the private MCP API. Trusted control holds the API, runner, state, Docker authority, and optional Git helper. The execution plane holds the non-root executor. The optional Git helper, not the executor, can use temporary network access and a short-lived GitHub App token. PUBLIC EDGE TRUSTED CONTROL EXECUTION PLANE OWNER client INGRESS loopback API MCP RUNNER lifecycle STATE SQLite DOCKER runner only EXECUTOR non-root workspace GIT HELPER short-lived token GITHUB origin EXECUTOR EGRESS DEFAULT: NONE REQUEST RESULT
Authority stays separated by role. The runner can reach Docker and an ephemeral helper. The executor cannot.
On narrow screens, use the arrow keys to pan this diagram horizontally.
  1. The owner connects to credential-free ingress, then the private stateless MCP API.
  2. The trusted runner owns workspace state, Docker authority, and optional Git helpers.
  3. The non-root executor has no Docker socket, control-plane credentials, or default network.
  4. Optional remote Git transfer uses the helper and never gives credentials to the executor.
Inspect the system architecture

Choose the safe path

Connect your MCP client

Keep the owner token in local private configuration. Cloud-hosted connector flows need an OAuth-capable gateway for this static-bearer deployment.

Local or API pathOAuth gateway required
ChatGPTOAuth gateway required

Create a custom MCP app only after an OAuth-capable gateway fronts this service. Do not place the owner bearer token in an app definition or chat.

Full ChatGPT guidance ↗
CodexLocal bearer configuration

Store CLOUD_HARNESS_MCP_TOKEN in your local environment, then add the remote MCP server in a private Codex configuration. Verify with /mcp or codex mcp list.

Full Codex guidance ↗
Claude Desktop appOAuth gateway required

The hosted connector flow cannot directly use this static bearer deployment. Put an OAuth-capable gateway in front, or use Claude Code with a local authorization header.

Full Claude Desktop guidance ↗
Claude CodeLocal authorization header

Keep the token in your shell and register the remote HTTP server in user scope with a local Authorization header. Confirm availability from /mcp.

Full Claude Code guidance ↗
Gemini CLILocal authorization header

Register the remote HTTP server with a header that reads the local environment token. Restart the CLI or use its MCP management command to verify the entry.

Full Gemini CLI guidance ↗
CursorLocal private configuration

Add the remote server to the global Cursor MCP configuration, or a trusted project only. Restart Cursor and confirm the server appears in the available tools.

Full Cursor guidance ↗
Google AntigravityLocal private configuration

Use the MCP Servers panel to open the global configuration, then add the remote endpoint and a local private header. Confirm the server is enabled before using it.

Full Antigravity guidance ↗
GrokWeb: gateway. API: supported.

Grok web is not a documented direct static-bearer route. The xAI Responses API can provide authorization for a remote MCP tool; allowlist only the tools the request needs.

Full Grok guidance ↗

Read this before use

A private harness, not a tenant boundary.

Cloud Harness MCP is for one authenticated, trusted owner using owner-approved repositories. It is not an anonymous service, shared team sandbox, or hostile multi-tenant platform.

Read the security model
Untrusted input
Repository content and supplied commands may execute inside the executor.
Network
Executor networking is none by default. Bridge mode is an explicit weakening.
Git credentials
Executors have no GitHub App token, deployment credential, SSH key, or Git push tool.
Lifetime
Close or TTL cleanup removes the executor and workspace directory.

Open. Work. Close.

Choose the client path that matches its authentication model, then start with a credential-free HTTPS repository URL and a fresh idempotency key.

Choose a client Tool semantics