harness_upgrade_mode · Harness Engineering MCP

WHAT IT DOES

What harness_upgrade_mode does on Harness Engineering MCP

AI agents use harness_upgrade_mode to create or update resources in Harness Engineering MCP — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Harness Engineering MCP environment.

WHY IT NEEDS A POLICY

Why harness_upgrade_mode needs a policy

This tool modifies configuration files and generates new files under .harness/, which is a reversible write operation. It changes the governance mode of the harness system but does not execute arbitrary code, delete data, or involve financial transactions. Misuse could alter engineering governance settings, causing medium blast radius.

From the tool's definition Upgrade harness mode... Updates .harness/config.json and generates additional files required by the new mode under .harness/.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

harness_upgrade_mode Rate-limited

harness_upgrade_mode stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "harness_upgrade_mode": {
      "limits": [
        {
          "counter": "harness_upgrade_mode_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Harness Engineering MCP, so you can run agents against it safely.

FAQ

Questions about harness_upgrade_mode

What does the harness_upgrade_mode tool do? +

Upgrade harness mode (solo → small-team → mid-team → org) with zero migration cost. Updates .harness/config.json and generates additional files required by the new mode under .harness/. It is categorised as a Write tool in the Harness Engineering MCP MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on harness_upgrade_mode? +

Register the Harness Engineering MCP server in PolicyLayer and add a rule for harness_upgrade_mode: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Harness Engineering MCP. Nothing to install.

What risk level is harness_upgrade_mode? +

harness_upgrade_mode is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit harness_upgrade_mode? +

Yes. Add a rate_limit block to the harness_upgrade_mode rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block harness_upgrade_mode completely? +

Set action: deny in the PolicyLayer policy for harness_upgrade_mode. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides harness_upgrade_mode? +

harness_upgrade_mode is provided by the Harness Engineering MCP server (movebrickschi/harness-engineering-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.