Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Harness Security Testing (BYOK) — connector documentation

  • MCP endpoint: https://byok-harness-sto.connectorbay.com/mcp
  • REST API: POST https://byok-harness-sto.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-harness-sto.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Harness Security Testing Harness personal access token or service account token, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-harness-sto.connectorbay.com/health · Tool schemas: https://byok-harness-sto.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-harness-sto · agent@connectorbay.com

What Harness Security Testing (BYOK) is for

Harness Security Testing (BYOK) lets an AI assistant read your own Harness Security Testing data through the Harness Security Testing API with a key you supply (Harness personal access token or service account token). Read-only: 9 tools (list_targets, get_target, get_target_overview, list_scans, get_scan, get_scan_issue_counts, list_issues, list_scanner_products, get_issue_trend). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to app.harness.io. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Harness Security Testing. Harness Security Testing and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which security scan targets does my Harness project have?"
  • "What is scan target tgt_abc123 in Harness STO?"
  • "What is the vulnerability picture for Harness STO target tgt_abc123?"
  • "Which security scans ran for Harness pipeline execution AbCdEf123?"
  • "What did Harness STO scan scan_1 cover?"
  • "How many critical and high issues did Harness STO scan scan_1 find?"

What it does

  • list_targets: List the security scan targets (repositories, container images, instances, configurations) of a Harness project.
  • get_target: Get one scan target: name, type (container, repository, instance, configuration), URL and baseline variant.
  • get_target_overview: Get a scan target's overview: issue and occurrence counts by severity, new and remediated deltas, package counts and last scan time.
  • list_scans: List security scans of the account with product, status (Pending, Running, Succeeded, Failed), pipeline, execution and target variant. Filter by pipeline execution ID.
  • get_scan: Get one security scan: status, product, pipeline, stage, branch and repository details, coverage and artifact image.
  • get_scan_issue_counts: Get the issue counts of one scan by severity (critical, high, medium, low, info), plus new, ignored and policy failure counts.
  • list_issues: List deduplicated security issues of the account with title, severity, scan type (SAST, SCA, SECRET ...), status, target and occurrence count. Filter by scanner product ID.
  • list_scanner_products: List the scanner products Harness STO supports, with name and whether each is enabled.
  • get_issue_trend: Get the daily count of baseline issues for a project over the last days (up to 90), with detections and remediations.

BYOK key

You bring your own Harness Security Testing Harness personal access token or service account token (https://developer.harness.io/docs/platform/automation/api/add-and-manage-api-keys/). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to app.harness.io over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Notices

Only accounts served from app.harness.io are supported; clusters on other Harness hosts are not. Needs the STO module on the Harness account.

Data sources

Live from the Harness Security Testing API (app.harness.io) with a BYOK key; documentation: https://apidocs.harness.io/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Harness Security Testing. Harness Security Testing and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Harness Security Testing account.

Built for: Worldwide. Languages: English.