About Harbor AIops
Harbor AIops is a governed MCP server and CLI for Harbor registry operations. Its 39 tools cover registry inspection and selected guarded tag operations, with audited calls and bounded results.
Key features
- 01健康、容量与仓库数据检查
- 02漏洞报告与扫描指标查看
- 03成员、配额和策略信息查询
- 04GC、复制与保留任务查看
- 05受控标签创建与删除
- 06调用审计及结果边界控制
Use cases
- 01检查 Harbor 健康状况和容量
- 02查看制品扫描与漏洞报告
- 03排查垃圾回收和复制任务
- 04预览并核验标签变更
MCP support
它提供 39 个用于 Harbor 容器仓库运维的 MCP 工具及对应命令行操作。每次调用都会审计；列表结果有数量上限，部分标签操作支持预演和后置核验。
Configuration
Local server config is the same for every client. Copy it into your client’s MCP config file.
Tools
39Saved tool list · updated 6d ago
| Parameter | Type | Required | Description |
|---|---|---|---|
| target | any | No |
Details
From the project READMEHarbor AIops
Governed Harbor container-registry operations with 39 MCP tools and corresponding CLI commands. Every call is audited and budgeted by the bundled governance harness. Artifact scan, tag creation and high-risk tag deletion have dry-run previews; uncertain results are reported as outcomeUnknown.
What it checks
- Component health and system volume use.
- Projects, repository inventory, artifacts, tags, vulnerability reports, quotas and project audit logs.
- Registry statistics, project members, tag immutability rules, labels and robot metadata (secrets redacted).
- Latest registry-wide and scheduled scan metrics, plus bounded artifact scan report logs.
- Guarded deletion of one proven, mutable tag with an absence post-check.
- Garbage collection execution history.
- GC execution details and bounded plain-text logs.
- Replication policies, executions, tasks and bounded task logs.
- Retention policy, execution, tasks and bounded task logs by actual IDs.
harbor_diagnosecombines health, volume, GC and replication observations. Failed probes appear as errors withdata: null.
Lists have items, returned, limit, and measured truncated fields. They are capped at 500 records per call.
Setup from source
Requires Python 3.11+, uv, and a Harbor instance. Install locally with uv sync --dev. Run uv run harbor-aiops init to configure an HTTPS target and encrypt its password, or create ~/.harbor-aiops/config.yaml with a targets list:
targets:
- name: primary
host: harbor.example.com
username: robot$ops
scheme: https
port: 443
verify_ssl: true
timeout: 30
Run uv run harbor-aiops secret set primary, then uv run harbor-aiops doctor and uv run harbor-aiops diagnose. The MCP entry point is uv run harbor-aiops-mcp. Set HARBOR_AIOPS_MASTER_PASSWORD for noninteractive secret-store access. TLS verification is enabled by default; ca_file accepts a custom CA PEM.
Scope and verification
The scan-artifact command starts an asynchronous scan and reports an unknown final outcome until its status is checked. create-tag proves the tag was absent and checks that it appeared after the write. delete-tag requires an exact mutable tag on the specified digest, previews the target and confirms absence after deletion. Neither tag write mints an undo token because immutability and later artifact changes can make the inverse unsafe. Retention execution, replication restart, GC start/stop, artifact deletion and policy changes remain outside this release until their actual outcomes and recovery paths can be verified on disposable Harbor. See verification. Missing operations and live-environment feedback are welcome as issues or PRs.
Development
uv run pytest -q, uv run ruff check ., and uv run bandit -r harbor_aiops -ll are local checks. Root handbook gates must pass before release.
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.