bestagentkits

Cloud Harness MCP — Development skill for Claude Code

Development community

Remote coding harness exposed as a secure Streamable HTTP MCP server.

How to install Cloud Harness MCP

This entry records only its repository, not the path inside it, so there is no exact command to give. Open bestagentkits/cloud-harness-mcp and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Cloud Harness MCP does

Remote coding harness exposed as a secure Streamable HTTP MCP server.

Alternatives in Development

MCP Proxy — A bridge between Streamable HTTP and stdio MCP transports 2.4k ★
API — All methods are exposed as MCP tools 1.7k ★
Projectmem — Open-source coding agent memory 766 ★

README

Cloud Harness MCP

![Cloud Harness MCP — isometric cutaway of the authenticated control plane and isolated coding workspaces](docs/assets/cloud-harness-architecture-banner.png)

Cloud Harness MCP is an MIT-licensed remote coding harness exposed through authenticated Streamable HTTP MCP. It opens an isolated clone in a TTL-limited Docker executor and gives a trusted owner or named mutually trusted operators structured workspace, file, code-intelligence, command, shell, session, dependency-task, Git, worktree, skill, hook, memory, and repository-defined deployment tools.

[!WARNING] This is a private service for one security domain. Its operators must trust one another because it is intentionally capable of arbitrary command execution inside a shared-kernel executor. Principal isolation is not a hostile multi-tenant sandbox. Read the [security model](docs/security-model.md) before operating it.

The Managed OAuth MCP URL is:

https://harness.zuey.me/mcp

Static-header clients use dashboard-managed API keys at the separate gateway:

https://api.harness.zuey.me/mcp

Architecture

MCP is the northbound control protocol; the harness is the execution runtime. The split keeps Internet-facing request handling away from Docker authority and keeps repository credentials out of long-lived executors.

flowchart LR
  OAuthClient["Managed OAuth client"] -->|"Access OAuth"| Nginx["nginx + loopback ingress"]
  StaticClient["Static-header client"] -->|"managed API key"| Gateway["Cloudflare Worker gateway"]
  Gateway -->|"Access service assertion + API key"| Nginx

  subgraph Control["Trusted control plane"]
    Nginx --> API["Stateless MCP API"]
    API -->|"private authenticated RPC"| Runner["Runner · policy · lifecycle"]
    Runner --> Store[("SQLite workspace state")]
    Runner --> Docker["Docker authority"]
    Runner --> Broker["GitHub App broker"]
  end

  subgraph Execution["TTL-bound execution plane"]
    Docker --> Executo