Harbor Registry MCP server

harbor-registry-mcp

<!-- mcp-name: io.github.mshegolev/harbor-registry-mcp -->

MCP server for Harbor Registry. Lets an LLM agent (Claude Code, Cursor, OpenCode, etc.) list projects, repositories and artifacts, run storage reports, find cleanup candidates, and delete untagged or old artifacts — all with safety rails (dry-run by default for bulk delete).

Python, FastMCP, stdio transport.

Works with any Harbor 2.x instance — SaaS or self-hosted / on-prem.

Why another Harbor MCP?

A couple of community Harbor MCPs exist (nomagicln/mcp-harbor, bupd/harbor-mcp-server) but they expose only the basic list/get endpoints. This one adds storage reports, cleanup candidates, delete untagged, and delete old artifacts with dry-run — the operations DevOps engineers actually need to reclaim disk space.

Design highlights

• Tool annotations — read-only tools get readOnlyHint: True; destructive ones (harbordelete) carry destructiveHint: True so MCP clients ask for confirmation.
• Dry-run by default on both bulk cleanups (harbordeleteuntagged, harbordeleteoldartifacts) — the agent must pass dryrun=False to execute.
• Structured output — every tool returns a typed payload (TypedDict) + a markdown summary.
• Structured errors — 401 / 403 / 404 / 429 / 5xx mapped to actionable hints.
• Pydantic input validation for every argument.
• Vulnerability snapshot — harborlistartifacts surfaces scan status and counts if withscanoverview is enabled.

Features (8 tools)

Discovery & inspection

• harborlistprojects — projects with repo counts and visibility
• harborlistrepos — repositories in a project
• harborlistartifacts — artifacts in a repository with tags/size/scan status
• harborstoragereport — full project storage breakdown (all repos × all artifacts)

Cleanup planning

• harborcleanupcandidates — suggest what to delete (untagged, never-pulled, old versions)

Cleanup execution (destructive)

• harbordeleteartifact — delete a single artifact by tag or digest
• harbordeleteuntagged — delete all untagged artifacts in a project/repo (dry-run default)
• harbordeleteold_artifacts — keep N latest per repo, delete the rest (dry-run default)

Installation

Requires Python 3.10+.

# via uvx (recommended)
uvx --from harbor-registry-mcp harbor-registry-mcp

# or via pipx
pipx install harbor-registry-mcp

Configuration

claude mcp add harbor -s project \
  --env HARBOR_URL=https://harbor.example.com \
  --env HARBOR_USERNAME='robot$your-robot' \
  --env HARBOR_PASSWORD=your-robot-token \
  --env HARBOR_SSL_VERIFY=true \
  -- uvx --from harbor-registry-mcp harbor-registry-mcp

Or in .mcp.json:

{
  "mcpServers": {
    "harbor": {
      "type": "stdio",
      "command": "uvx",
      "args": ["--from", "harbor-registry-mcp", "harbor-registry-mcp"],
      "env": {
        "HARBOR_URL": "https://harbor.example.com",
        "HARBOR_USERNAME": "robot$your-robot",
        "HARBOR_PASSWORD": "${HARBOR_PASSWORD}",
        "HARBOR_SSL_VERIFY": "true"
      }
    }
  }
}

Check:

claude mcp list
# harbor: uvx --from harbor-registry-mcp harbor-registry-mcp - ✓ Connected

Environment variables

Shortened. The full README is on GitHub.