hara-mcp
OfficialThis server is a read-only, closed-world MCP gateway for Hara that exposes four tools for inspecting and safely exercising a Hara execution host.
hara_runtime_get — Return the selected compatible execution host, exact runtime build, pure sandbox profile, resource limits, and observed availability/state.
hara_eval — Evaluate inline Hara source in a fresh restricted, no-network, no-browser, non-persistent sandbox and receive output, diagnostics, and execution evidence.
hara_call — Call an already-loaded fully qualified Hara Var with transfer-safe arguments, without concatenating arguments into source.
hara_check — Run bounded reader, compile, namespace, lint, or test checks and get structured diagnostics.
The tools are non-destructive and closed-world: no browser, network, persistent filesystem, package, process, provider, database, shell, or external-effect authority is enabled.
Request cancellation and wall-clock deadlines are propagated through the MCP request signal; with the loopback relay enabled, they become idempotent cancel commands to an enrolled host.
The server can also expose a 127.0.0.1-only health endpoint and loopback relay for local development host enrollment, polling, command acknowledgement, result submission, and cancellation.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@hara-mcpCheck the current Hara runtime status"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
hara-mcp
Language-owned MCP gateway and execution-host coordination for Hara.
The architecture and six-phase delivery plan are tracked in issue #1. The gateway scaffold is issue #8; the active loopback-relay slice is issue #10.
Current status
This branch contains the MCP gateway, a closed four-tool catalogue, fail-closed host selection, and the first authenticated loopback relay for an outbound execution host. It does not provide a production endpoint or prove real Hara execution.
Two development paths exist, and they are deliberately mutually exclusive:
a disabled-by-default deterministic transport fixture for MCP schema and routing tests;
a
127.0.0.1-only relay that lets an enrolled host register, poll for one bounded request, acknowledge commands, submit a terminal result, and receive cancellation.
Phase 1 remains open until an unpacked Hara Chrome host executes a request in a fresh restricted Rust/Wasm Sandbox. A relay transport result is not semantic evidence.
Related MCP server: nodus-mcp-server
Development
Node.js 22 is required.
npm ci
npm run checkStart the stdio MCP server with no registered host:
npm run devEnable the deterministic transport fixture for MCP Inspector development only:
HARA_MCP_ENABLE_TEST_FIXTURE=1 npm run devStart the stdio server and loopback host relay:
HARA_MCP_LOOPBACK_TOKEN='replace-with-a-random-development-token' \
HARA_MCP_LOOPBACK_PORT=8765 \
HARA_MCP_LOOPBACK_ORIGIN='chrome-extension://your-extension-id' \
npm run devHARA_MCP_LOOPBACK_TOKEN is required whenever another loopback setting is present. The token must contain at least 16 non-whitespace bytes. It authenticates the local HTTP transport only; it must never enter an execution request, descriptor, result, MCP response, diagnostic, or log.
HARA_MCP_LOOPBACK_ORIGIN is optional. When configured, requests carrying an Origin header must match it exactly. Wildcards are prohibited. The relay always binds exactly to 127.0.0.1 and refuses wildcard, LAN, or public bind addresses.
Probe the relay process without exposing host or run details:
curl --fail --silent http://127.0.0.1:8765/v0/healthThe health response proves only that the local relay process is answering. Host readiness remains derived from an authenticated, current-generation heartbeat and is reported separately by hara_runtime_get.
See the loopback relay guide for the host protocol and lifecycle.
MCP catalogue
The initial catalogue is exactly:
hara_runtime_get
hara_eval
hara_call
hara_checkAll four tools are declared read-only, non-destructive, and closed-world. No option enables browser, network, persistent filesystem, package, process, provider, database, shell, or external-effect authority.
MCP request cancellation is propagated through the SDK request signal to the selected execution host. The loopback relay converts it into a distinct, idempotent cancel command. Requested wall-clock deadlines use the same path.
Boundaries
Hara owns execution semantics and the canonical Sandbox/LiveSession lifecycle.
Hara Chrome is an enrolled execution host, not an MCP server.
The loopback relay is a temporary Phase 1 transport adapter, not a second Hara runtime protocol.
mcp.greenways.airemains a Greenways application ingress and consumes the lower-level Hara host protocol directly when needed.MCP client credentials, loopback transport credentials, and execution-host/device credentials terminate at independent boundaries.
Exact command redelivery is allowed until acknowledgement; the host must de-duplicate by command and request identity.
See the architecture note and AGENTS.md before making changes.
Available Tools
4 toolshara_callCall a qualified Hara VarBRead-only
Invoke an already-loaded fully qualified Hara Var with transfer-safe arguments in a fresh restricted sandbox. Arguments are never concatenated into source.
| Name | Required | Description | Default |
|---|---|---|---|
| limits | No | ||
| source | No | ||
| symbol | Yes | ||
| arguments | No | ||
| namespace | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| result | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate it's read-only and non-destructive. The description adds that it runs in a fresh restricted sandbox and that arguments are never concatenated into source, which provides security context. However, it doesn't detail error behaviors, output format, or side effects beyond annotations. It doesn't contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, two sentences, front-loaded with the verb 'Invoke' and key context. Every word adds value, no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 5 parameters including nested `limits` and a complex recursion, the description lacks sufficient detail. It doesn't explain why `source` is a parameter (seems redundant with 'already-loaded' but maybe it's the source form), or how `limits` affect execution. Output schema exists, but that doesn't cover parameter guidance. The description leaves too much to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description doesn't explain any parameters individually. It mentions 'transfer-safe arguments' and 'qualified Hara Var' but doesn't specify what `namespace`, `symbol`, `source`, or `limits` mean. With 5 parameters and many nested, the description should compensate but doesn't.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool invokes a loaded Hara Var with transfer-safe arguments in a restricted sandbox, which is clear and specific enough. It distinguishes from siblings like hara_eval (which likely evaluates expressions) by focusing on calling a pre-loaded qualified variable, though it doesn't explicitly name these differences.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies this tool is for invoking already-loaded vars, not loading them (distinguishing from hara_runtime_get and hara_eval), and mentions transfer-safe arguments for safety. However, it doesn't provide explicit criteria or when-not-to-use compared to alternatives, though context signals could help.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hara_checkCheck Hara sourceARead-only
Run a bounded reader, compile, namespace, lint, or test check in the same fresh restricted pure sandbox profile and return structured diagnostics.
| Name | Required | Description | Default |
|---|---|---|---|
| limits | No | ||
| source | Yes | ||
| profile | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| result | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, but the description adds valuable context: the check is 'bounded', runs in a 'fresh restricted pure sandbox profile', and returns 'structured diagnostics'. This goes beyond the annotations, though the 'same sandbox profile' reference is slightly ambiguous without knowing what it is the same as.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, dense sentence that front-loads the action, enumerates the check types, and conveys the key context (bounded, fresh sandbox, structured diagnostics) without wasted words. Every clause adds meaningful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core purpose, check types, sandbox environment, and output nature, and an output schema exists to explain return values. However, it omits the semantics of the `limits` parameter, gives no guidance on error/failure behavior, and the 'same fresh restricted pure sandbox' phrasing is unclear without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description needed to compensate, but it only mentions 'bounded' without explaining the `limits` object or its wallMs/outputBytes fields. It does restate the profile enum values, but those are already present in the schema. The `source` parameter semantics are implied by the title, not detailed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Run') and resource ('check' on Hara source), enumerates the exact check varieties (reader, compile, namespace, lint, test), and clarifies the sandbox context and output type. This clearly differentiates it from sibling tools like hara_eval or hara_call by emphasizing diagnostics-producing checks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: whenever a bounded compile/lint/test/namespace/reader check is needed. However, it does not explicitly state when not to use it or name alternatives like hara_eval or hara_call, leaving the decision to the agent's inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hara_evalEvaluate Hara sourceARead-only
Evaluate inline Hara source in a fresh restricted, no-network, no-browser, non-persistent sandbox on an enrolled compatible host.
| Name | Required | Description | Default |
|---|---|---|---|
| limits | No | ||
| source | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| result | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark readOnlyHint=true and destructiveHint=false, but the description adds crucial behavioral details: 'fresh restricted, no-network, no-browser, non-persistent sandbox' and 'enrolled compatible host.' This goes beyond the annotations and helps the agent understand side effects and prerequisites.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the core purpose and environment details. It is concise with no filler or redundant content, earning the highest score for structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the execution environment and prerequisites ('enrolled compatible host') but does not explain parameter details, return behavior, or failure modes. Since an output schema exists, return value explanation is less critical, but the absence of parameter guidance creates a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. However, it does not mention 'source' or 'limits' at all. While the schema is self-explanatory for some (source is a string, limits has wallMs/outputBytes), the description adds no meaning, leaving agents to infer parameter semantics from names alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Evaluate' with the resource 'inline Hara source' and clearly states the environment (fresh restricted, no-network, no-browser, non-persistent sandbox). This distinguishes it from siblings like hara_call or hara_check, which imply different operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for evaluating inline code snippets in a safe, isolated environment, but does not explicitly contrast with alternatives (e.g., when to use hara_call vs hara_eval). The provided context is clear but lacks explicit exclusions or alternative tool references.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hara_runtime_getGet Hara runtimeARead-only
Return the selected compatible Hara execution host, exact runtime build, pure sandbox profile, limits, and observed availability.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| host | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already indicates this is a non-destructive read operation. The description adds transparency by enumerating the specific data returned (host, build, sandbox profile, limits, availability), which is helpful context but does not go beyond the annotation's safety indication.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence packed with specific technical terms (execution host, runtime build, sandbox profile, limits, availability). There is no redundancy or fluff; every word contributes to the meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and a simple getter role, the description sufficiently conveys what is returned. However, it does not specify the format or structure of the return value, and no output schema is provided, so some ambiguity remains. Still, the core purpose is clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters in the schema, so coverage is 100% by default. The description does not mention any parameters (as none exist), but it also does not add any extra context about how the tool selects the runtime, which could be relevant. Since schema coverage is full, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Return') and specifies the resource (Hara runtime information) with distinct attributes (execution host, runtime build, sandbox profile, limits, availability). This distinguishes it from sibling tools like hara_eval and hara_call, which likely perform evaluations or calls.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus the siblings (hara_eval, hara_call, hara_check). It does not state that this should be called before evaluating or calling, nor does it mention any alternatives. This leaves the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
4 tool updates
v0.1.0-alpha.0- First observed
hara_call - First observed
hara_check - First observed
hara_eval - First observed
hara_runtime_get
TDQS
Each tool serves a distinct purpose: eval executes inline source, call invokes a loaded var, check runs diagnostics, and runtime_get provides environment info. There is no meaningful overlap among the four tools.
Three tools follow a clean verb pattern (hara_eval, hara_call, hara_check), but hara_runtime_get uses a noun-verb ordering that slightly deviates. The prefix is consistent, and the naming remains intuitive overall.
Four tools is a tight, focused set for a niche language runtime server. Each tool earns its place without redundancy or bloat.
The core execution and checking workflow is well covered. A minor gap is the lack of an explicit var-loading or listing mechanism, but since call assumes pre-loaded vars, this may be handled externally.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Hosted MCP memory and agent control plane for durable conversations, jobs, and operations.
Governed data discovery, exact queries, decisions, simulations, and runtime utilities over MCP.
Guarded MCP server for agent-readable business truth, provenance, readiness, and discovery.
Hosted runtime for persistent agent teams, durable workflows, memory, schedules, and goals.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceExposes MCP tools that enable remote LLMs to query local Docker containers, OS processes, and system services in real time.-
- AlicenseNot gradedqualityBmaintenanceExposes the Nodus orchestration runtime as MCP tools for memory management, goal/workflow execution, and sandboxed code execution.MIT
- FlicenseNot gradedqualityCmaintenanceA production-oriented MCP runtime providing orchestration tools for IDE and agent integrations, including task management, diagnostics, and token usage reporting.-
- FlicenseNot gradedqualityCmaintenanceA runtime for inspectable agent workflows that provides MCP tools, bounded Python execution, session memory, and deterministic evaluation.-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/hara-lang/hara-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server