harness Skills

>- Configure Harness AI-powered operations (AIDA) via MCP. Set up predictive failure analysis with ML models for memory leaks, disk exhaustion, connection pool saturation, and latency degradation. Configure intelligent alert correlation and noise reduction to reduce alert volume. Use when asked to set up predictive failure analysis, configure AI-powered alerting, reduce alert noise, or enable ML-based anomaly detection. Do NOT use for pipeline debugging AIDA, predictive failure, alert correlation, noise reduction, anomaly detection, AI ops, predictive analysis, alert fatigue, ML alerting, intelligent alerting.

Analyze cloud costs, find optimization opportunities, and track anomalies using Harness CCM via MCP. Use when user says "cloud costs", "analyze costs", "cost optimization", "reduce spending", "cost report", or asks about cloud bills.

>- Approve pending Harness STO security exemptions (waivers) at their current scope or elevate them to Project, Org, or Account scope. Users say "approve" for both in-scope approval and higher-scope elevation — do not require the word "promote". Supports approving one exemption or a mixed list where each row has a different approval scope. Default workflow lists pending exemptions in chat (paginated preview) so the user picks by row number — no copying from the Harness UI. Use when a user wants to approve, sign off on, or clear pending exemptions, waive approvals, org-wide approval, or account-wide approval. clear pending exemption, approve for org, approve for account, org-wide approval, account-wide approval, pending exemptions.

>- Generate audit reports and compliance trails using Harness audit trail data via MCP v2 tools. Track user actions, resource changes, authentication events, and access patterns across accounts, organizations, and projects. Use when asked to audit activity, generate compliance reports, investigate security incidents, review user actions, check change logs, or produce SOC2/GDPR/HIPAA change log, access audit, security investigation, who changed what, audit events.

Create and manage chaos experiments using Harness Chaos Engineering via MCP. Run resilience tests like pod deletion, CPU stress, and network faults. Use when user says "chaos experiment", "chaos engineering", "resilience test", "chaos test", or wants to test system reliability.

>- Use when asked to set up PR attestation, install harness-scs attestation hook, configure agent attestor, troubleshoot why agent attestation isn't uploading, or reconfigure an existing attestation hook (different SCM, new cosign key, updated Harness identity). why isn't my agent attestation uploading, set up agent attestation, configure PR signing, install attestation hook, configure claude attestation.

>- Add container image scanning steps to existing Harness pipelines using Harness STO scanners. Supports Harness SCA (default), Aqua Trivy, Grype, Snyk, Prisma Cloud, Anchore, Black Duck, and Wiz. Supports Docker Hub, ECR, GCR, and other Third-Party registries as well as Harness and Local registries. Can insert the scan step into an existing CI stage or create a dedicated SecurityTests stage. Use when asked to add container scanning, configure image scanning, set up SCA for Docker images, scan container images for vulnerabilities, or add container security checks to a pipeline. for container, scan container before deploy, add Trivy scan, add Grype scan, add Snyk container scan.

>- Add Dynamic Application Security Testing (DAST) steps to existing Harness pipelines using Harness STO scanners. Supports API DAST / Traceable (default), Burp Suite Enterprise, ZAP (OWASP), Nikto, and Nmap. Scans running application instances for vulnerabilities including API security issues, injection flaws, misconfigurations, and exposed services. Can insert the scan step into an existing CI or SecurityTests stage or create a dedicated SecurityTests stage. Use when asked to add DAST scanning, configure dynamic application testing, set up API security scanning, scan a running application, or add runtime security testing to a pipeline. scan running app, add Burp Suite scan, add ZAP scan, add Nikto scan, runtime security scan, API security scan.

>- Configure code scanning in Harness pipelines using STO security scanners. Helps identify where to inject SAST/SCA scanning steps into existing pipelines, recommends appropriate scanners, and configures them with proper connector references. Use when asked to add code scanning, configure security scans, set up SAST/SCA, configure repo scan, set up SAST, add security scan, configure vulnerability scanning, integrate scanner.

>- Add secret detection scanning steps to existing Harness pipelines using STO security scanners. Detects exposed credentials, API keys, tokens, and sensitive data in code repositories. Supports Harness Code (default, native, unified SAST/SCA/secret detection), Gitleaks (standalone secret scanner, open-source), Semgrep, Snyk, SonarQube, Checkmarx, Fossa, Aqua Trivy, and Wiz. Only works with existing pipelines that have a codebase connector configured. Use when asked to add secret scanning, detect exposed secrets, find leaked API keys, configure secret detection, or scan code for credentials. scan for exposed API keys, add Gitleaks, secret scanning pipeline.

>- Create and update Harness AI agent instances - standalone templates for agentic workflows in pipelines. Use when asked to create agent, update agent, modify agent spec, build autonomous systems, or work with AI agents.

Generate Harness Connector YAML for integrations and create/test via MCP. Use when user says "create connector", "git connector", "aws connector", "docker connector", "cloud connector", or wants to connect Harness to external services.

>- Generate Harness Environment YAML for deployment targets and create via MCP. Supports PreProduction and Production types with environment variables, manifest overrides, and multi-environment setup (dev, staging, prod). Use when asked to create an environment, set up staging, configure production, define environment, setup dev, setup staging, setup production, environment variables, environment overrides.

Generate Harness Infrastructure Definition YAML for deployment targets and create via MCP. Use when user says "create infrastructure", "infrastructure definition", "k8s cluster config", "deployment target", or wants to configure where workloads run.

>- Generate Harness v0 Pipeline YAML for CI/CD workflows and create them via MCP. Supports CI stages (build, test, Docker push), CD stages (Kubernetes, Helm, ECS, serverless), approval gates, parallel execution, matrix strategies, and failure rollback. Use when asked to create a pipeline, build pipeline, deployment pipeline, CI/CD workflow, or set up Harness pipelines. Do NOT use for v1 simplified pipelines Harness pipeline, Kubernetes deploy pipeline.

>- Generate Harness v1 simplified Pipeline YAML using the new concise syntax with flat structure, ${{ }} expressions, script field, and action steps. Supports CI stages (run, run-test, background), CD stages (service/environment with action steps for K8s, Helm, ECS), approval (stage-level and inline), parallel execution, matrix/for/while strategies, caching, volumes, and templates. Use when asked for a v1 pipeline, simplified pipeline, new pipeline format, or when user specifically requests v1 syntax. Do NOT use for pipeline format, create v1, modern pipeline syntax.

>- Create OPA governance policies for Harness via MCP. Define policies that enforce compliance rules on pipelines, services, environments, feature flags, artifacts, code repositories, templates, SBOM, security tests, Terraform, GitOps, connectors, secrets, and more. Use when asked to create, write, fix, or explain an OPA policy, Rego rule, deny rule, governance policy, compliance rule, or compliance rule, rego policy, deny rule, enforce policy, security policy, supply chain governance.

>- Add an SBOM (Software Bill of Materials) generation step to an existing Harness pipeline using Harness SCS SscaOrchestration (SBOM Orchestration). Supports container images and code Syft or cdxgen, SPDX or CycloneDX, optional SBOM attestation. Only works with existing pipelines. Use when asked to create an SBOM, generate a bill of materials, add SBOM to a pipeline, scan a container image or repo for components, or set up SBOM Orchestration. scan for dependencies, SBOM Orchestration, add Generate SBOM step.

>- Generate Harness Secret definitions and manage secrets via MCP v2 tools. Supports SecretText, SecretFile, SSHKey, and WinRmCredentials types with configurable secret managers (Harness built-in, HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager). Use when asked to create a secret, store credentials, manage API keys, set up SSH keys, configure WinRM credentials, secret file, SSH key, API key, password, credentials, secret manager, store secret.

>- Generate Harness Service YAML for deployable workloads and create via MCP. Supports Kubernetes, Helm, ECS, Serverless, SSH, and WinRm deployment types with artifact sources from Docker Hub, ECR, GCR, ACR, Nexus, and S3. Use when asked to create a service, define a Kubernetes service, set up a Helm chart service definition, Kubernetes service, Helm service, ECS service, deployment service, artifact source.

Generate Harness Trigger YAML for automated pipeline execution and create via MCP. Use when user says "create trigger", "webhook trigger", "cron trigger", "scheduled build", "artifact trigger", or wants pipelines to run automatically.

>- resolve schema+instance (from context or via API discovery), confirm DB engine type, generate Liquibase YAML, and present for HITL review with Accept / Deny / Accept & Commit actions. Supports update mode (refine existing changeset) and error-recovery mode (fix a failed migration).

>- Diagnose Harness pipeline executions via MCP. Analyzes any execution (failed or successful) to produce structured reports with stage/step breakdown, timing, bottlenecks, failure details, chained pipeline drill-down, and execution logs. Use when asked to debug a pipeline, investigate a failure, find out why a build failed, analyze pipeline errors, check execution logs, review execution performance, or failure, pipeline error, execution logs, fix pipeline, execution bottleneck, slow pipeline.

>- Assess deployment readiness via Harness MCP. Run pre-deployment readiness checks with go/no-go recommendations, analyze environment drift between source and target environments, and provide data-driven canary rollout decisions. Use when asked to check if a service is ready to deploy, compare environments before deployment, or decide whether to promote a canary. Do NOT use for running pipelines (use run-pipeline instead) or debugging failures (use debug-pipeline instead). canary decision, promote canary, rollback canary, go no-go, deployment checklist, production readiness, canary analysis.

Generate DORA metrics and engineering performance reports using Harness SEI via MCP. Track deployment frequency, lead time, change failure rate, and MTTR. Use when user says "DORA metrics", "deployment frequency", "lead time", "engineering metrics", or asks about team performance.

>- Add an SBOM Policy Enforcement (SscaEnforcement / CdSscaEnforcement) step to an existing Harness pipeline to verify SBOM attestations and apply OPA SBOM policy sets. Supports CI, Security, and CD (Deployment) including CI-only pipelines — if no Deploy stage exists, add one via Phase 3b (service, environment, infra, containerized step group) then place CdSscaEnforcement before deploy. Supports container images and repositories from Artifact Registry, Third-Party registries (docker, ECR, GCR, GAR, ACR), and Git. Matches Pipeline Studio SBOM Policy Enforcement UI. Only works with existing pipelines (may append a Deploy stage). Use when asked to enforce SBOM policies, add SBOM policy enforcement, verify SBOM attestation in pipeline, or block non-compliant components. SscaEnforcement, add policy enforcement after SBOM.

>- Add an SLSA Verification (SlsaVerification) step to an existing Harness pipeline to verify SLSA provenance attestations and optionally enforce OPA policy sets on provenance data. Supports CI and CD (Deployment) including CI-only pipelines — append a Deploy stage via Phase 3b when verifying before deploy. Supports Docker, ECR, GCR, GAR, ACR, HAR, and Local artifacts. Only works with existing pipelines. Use when asked to verify SLSA, enforce SLSA policies, add SLSA verification step, validate SLSA attestation, or gate deploy on SLSA provenance. SlsaVerification, verify SLSA attestation, add SLSA verify step.

>- Create Harness STO security exemptions (waivers) for vulnerabilities found by SAST, SCA, DAST, Vulnerabilities tab of a specific pipeline execution (Target, Pipeline, or Project scope) and the All Issues page (Project scope only). Supports single creates with per-row error tolerance and bulk creates of up to 100 issues in one all-or-none transaction. The requester is derived automatically from the authenticated user. Use when a user wants to exempt a vulnerability, waive a CVE, suppress a security finding, mark a finding as a false positive, accept the risk, or exempt several vulnerabilities at once. exemption, suppress security issue, false positive, accept risk, ignore CVE, bulk exempt.

>- provenance and optionally attest with Cosign (keyless, key-based, or Vault). Supports container images (Docker, ECR, GCR, GAR, ACR, HAR) and Harness Local Stage artifacts. Place after image build/push; run sequentially after SBOM steps, not in parallel. Only works with existing pipelines. Use when asked to generate SLSA, add SLSA provenance, SLSA Generation step, attest SLSA, or configure SLSA Level 3 provenance in a pipeline. SlsaGeneration, provenance step, SLSA attestation, add provenance step.

Monitor GitOps application health, sync status, and manage ArgoCD deployments via Harness MCP. Use when user says "gitops status", "argocd status", "application sync", "gitops health", "is my app in sync", or asks about GitOps applications.

>- Incident response and analysis via Harness MCP. Correlate incidents with recent deployments, assess blast radius and downstream service impact, and generate comprehensive postmortem documents. Use when asked to investigate an incident, determine if a deployment caused an issue, assess blast radius, or create a postmortem. Do NOT use for pipeline debugging incident, deployment correlation, blast radius, postmortem, root cause, service impact, outage analysis, rollback decision, incident timeline, deployment caused, which deploy.

>- Manage Harness Artifact Registry (AR) via MCP. Configure private registries for Docker, Helm, Maven, npm, and PyPI artifacts, set up upstream proxies for caching public images, configure RBAC and cross-region replication, and define security scanning policies with CVE thresholds and license compliance checks. Use when asked to set up an artifact registry, configure Docker or Helm repositories, manage artifact security scanning, or set up replication. Do NOT use artifact registry, docker registry, helm repository, artifact security, image scanning, private registry, artifact replication, CVE threshold, license compliance, SBOM.

>- Manage Harness Cloud Development Environments (CDE) via MCP. Configure on-demand development environments with pre-installed tooling, design standardized workspace templates for teams, set up auto-hibernation and cost controls, and manage environment lifecycle. Use when asked to set up cloud dev environments, create workspace templates, configure remote development, development, workspace template, dev environment, gitpod, codespace, auto-hibernation, developer workspace, ephemeral environment.

>- Monitor and manage Harness Delegates via MCP. List delegates and check health status, manage delegate registration tokens (create, revoke, delete), and find which delegates are associated with a token. Use when asked about delegate status, delegate health, delegate connectivity, delegate tokens, or delegate token, delegate connectivity, delegate troubleshooting, delegate down.

>- Manage Harness Feature Flags (FME / Split.io) via MCP. List flags by workspace, get flag details, create flags, kill or restore flags per environment, archive or unarchive flags, and delete flags. Use when asked to create a feature flag, kill/restore a flag, list flags, check flag status, enable or disable a feature, flag, create flag, feature rollout, archive flag, FME flag.

>- Manage Harness deployment freeze windows via MCP. Create, list, get, update, and delete project-level freeze windows; toggle them Enabled/Disabled; and get or enable/disable the project-level global freeze. Use when asked about freeze windows, deployment freezes, change freezes, release blackouts, deployment freeze, change freeze, release blackout, maintenance window, holiday freeze, pause deployments, block pipeline execution, global freeze.

>- Manage Harness Infrastructure as Code Management (IaCM) via MCP. Configure Terraform workspaces with remote state and RBAC, set up continuous drift detection with auto-remediation, design multi-tier change approval workflows, and estimate infrastructure costs before deployment. Use when asked to manage Terraform workspaces, detect infrastructure drift, set up approval workflows for infrastructure changes, or estimate Terraform costs. Do NOT use for creating Harness infrastructure definitions (use create-infrastructure instead) or OPA policies infrastructure cost, IaCM, state management, change approval, terraform plan, infracost, infrastructure governance.

>- Manage Harness Internal Developer Portal (IDP) resources via MCP. Create service catalog templates, configure self-service environment provisioning workflows, generate service documentation, create Architecture Decision Records (ADRs), and design developer onboarding workflows. Use when asked to set up a service catalog, create self-service workflows, generate service docs, write ADRs, or onboard new developers. Do NOT use for service scorecards (use scorecard-review instead). Trigger architecture decision, service documentation, catalog template, developer experience, backstage.

>- Manage Harness Code pull requests via MCP. List, create, update, and merge PRs; add reviewers and submit review decisions (approve / request changes); post, update, and delete comments; read the discussion timeline; and check CI status. Use when asked to open a PR, merge a PR, approve a PR, leave a code review comment, request changes, assign reviewers, or inspect PR checks and activity. PR comments, PR checks, PR activity, code review.

>- Manage Harness RBAC roles, role assignments, permissions, and resource groups via MCP v2 tools. List, create, update, and delete custom roles. View role assignments and permissions for users, groups, and service accounts. Use when asked to manage access control, assign roles, check permissions, create custom roles, review RBAC configuration, onboard users, or audit access. resource group, who has access, grant access, revoke access.

>- Assist with Harness Service Reliability Management (SRM) tasks that the MCP server currently reports from deployment/execution history, and drafting operational runbooks. Use when asked about SLOs, error budgets, burn-rate alerts, on-call handover, runbooks, or incident triage. Do NOT use for DORA metrics (use dora-metrics instead) or chaos experiments (use runbook, service reliability, incident response, on-call shift.

>- Manage Harness Software Supply Chain Assurance (SSCA) via MCP. Configure automated SBOM generation with CycloneDX or SPDX formats, set up artifact signing and attestation with Cosign, define supply chain security policies using OPA, and track SLSA provenance levels. Use when asked to generate SBOMs, sign artifacts, enforce supply chain policies, track software provenance, or manage SLSA compliance. Do NOT use for OPA pipeline governance policies (use create-policy instead) or vulnerability scanning (use security-report instead). signing, cosign, provenance, attestation, CycloneDX, SPDX, supply chain policy.

>- Manage Harness users, user groups, and service accounts via MCP. List and search users, create and manage user groups for team-based access, create service accounts for API automation, and view available permissions. Use when asked to list users, create a user group, manage service accounts, check who has access, or set up team permissions. Do NOT use for role assignments or resource groups team permissions, add user to group, create service account.

>- Migrate Harness pipelines from v0 to v1 simplified format via MCP tools. Converts expressions from angle-bracket to ${{ }} syntax, lowercases type names, simplifies structure, and preserves variables, failure strategies, and conditional logic. Use when asked to migrate a pipeline, convert v0 to v1, pipeline, convert to v1, upgrade pipeline, v0 to v1, modernize pipeline, simplified format.

>- Optimize Harness CI/CD pipeline performance via MCP. Configure parallel test execution with Test Intelligence, design multi-layer caching strategies, analyze pipeline bottlenecks with stage-level timing breakdowns, optimize cache hit rates, and design monorepo CI pipelines with selective builds. Use when asked to speed up pipelines, improve cache hit rates, set up parallel testing, optimize build times, or configure monorepo builds. Do NOT use for creating new pipelines (use create-pipeline instead) or debugging failures (use debug-pipeline instead). build optimization, caching strategy, monorepo pipeline, pipeline bottleneck, build speed.

>- Analyze pull request impact on Harness pipelines via MCP. Assess PR pipeline impact by identifying which pipelines, services, and environments are affected by code changes. Perform security-focused PR reviews checking for secrets, vulnerabilities, and compliance. Track PRs from merge through deployment to production verification. Use when asked to PR impact, pull request analysis, PR security review, PR to production, merge impact, deployment tracking, code change impact, PR pipeline, which pipelines affected.

>- Execute and monitor Harness pipeline runs via MCP tools. Find pipelines, provide runtime inputs, trigger executions, monitor progress, handle approvals, retry failures, and abort running or stuck executions. Use when asked to run a pipeline, execute a deployment, trigger a build, start a pipeline, deploy a run pipeline, execute pipeline, deploy, start build, trigger pipeline, check execution, approve deployment, retry failed pipeline, abort execution, stop pipeline, interrupt execution, kill stuck pipeline.

Review service maturity scorecards and compliance using Harness IDP via MCP. Check production readiness, security, and documentation scores. Use when user says "scorecard", "service maturity", "production readiness", "compliance score", or asks about service health scores.

Generate security compliance reports using Harness SCS and STO via MCP. Analyze vulnerabilities, SBOMs, and manage exemptions. Use when user says "security report", "vulnerabilities", "SBOM", "security scan", "compliance check", or asks about application security.

>- Advanced engineering analytics via Harness Software Engineering Insights (SEI) MCP. Configure sprint velocity and estimation accuracy tracking, engineering investment allocation breakdowns, sprint planning with capacity forecasts, and release readiness assessments. Use when asked about sprint analytics, investment allocation, sprint planning, capacity forecasting, or release velocity, sprint analytics, investment allocation, capacity planning, sprint forecast, release readiness, engineering productivity, estimation accuracy, sprint planning, scope creep, code quality trends.

>- Add an Artifact Signing (SscaArtifactSigning) step to an existing Harness pipeline to Cosign-sign container or local-stage artifacts with keyless, key-based, or Vault signing. Supports Third-Party registries (Docker, ECR, GCR, GAR, ACR), Harness Artifact Registry (HAR), and Harness Local Stage artifacts. Place after image build/push; optionally upload .sig to the registry. Only works with existing pipelines. Use when asked to sign artifacts, add artifact signing, Cosign sign image, attach signature to registry, or configure SscaArtifactSigning. SscaArtifactSigning, attach signature, sign container image, HAR signing.

>- Track Harness template dependencies, usage, and adoption via MCP v2 tools. Find which pipelines or other templates reference a given template, analyze update impact, identify unused templates, and compare version adoption. Use when asked about template usage, template references, template dependencies, impact analysis before updating a template, finding unused templates, or tracking references, template dependencies, template impact, unused templates, template adoption. Do NOT use for creating or updating templates (use create-template instead).

>- Add an Artifact Verification (SscaArtifactVerification) step to an existing Harness pipeline to verify Cosign signatures on container or local-stage artifacts. Supports CI, Security, and CD Deploy (containerized step group). Supports Third-Party registries (Docker, ECR, GCR, GAR, ACR), Harness Artifact Registry (HAR), and Harness Local Stage artifacts. Only works with existing pipelines. Use when asked to verify signed artifacts, verify artifact signature, verify-sign, validate Cosign signature, or configure SscaArtifactVerification. SscaArtifactVerification, verify signed image, verify Cosign, HAR verification.