Create Secret

What it does

When your agent uses it

• Asked to create a secret
• Store credentials
• Manage API keys
• Set up SSH keys

Example prompts

• “/create-secret”

Requirements

• Compatibility (from SKILL.md): Requires Harness MCP v2 server (harness-mcp-v2)

Workflow steps

4 steps, taken from the step headings in SKILL.md.

1. 1Determine Requirements
2. 2Check for Existing Secrets
3. 3Create the Secret
4. 4Verify Creation

What it can do on your machine

Read from SKILL.md and the folder at commit c25faee. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are yaml).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • DB_PASSWORD

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Requires Harness MCP v2 server (harness-mcp-v2)

  From compatibility in the SKILL.md frontmatter.

Context cost

Create Secret loads about 1.7k tokens when it runs, and up to ~2.4k if it reads all its reference files. Until then it costs about 145 tokens; SKILL.md has 504 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~145

When it runs · the whole SKILL.md, loaded when a task matches

~1.7k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~2.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from harness/harness-skills at commit c25faee, republished under its Apache-2.0 licence (© harness). 504 words, ~1,729 tokens.

name

create-secret

description

Generate Harness Secret definitions and manage secrets via MCP v2 tools. Supports SecretText, SecretFile, SSHKey, and WinRmCredentials types with configurable secret managers (Harness built-in, HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager). Use when asked to create a secret, store credentials, manage API keys, set up SSH keys, configure WinRM credentials, rotate secrets, or reference secrets in pipelines. Trigger phrases: create secret, secret text, secret file, SSH key, API key, password, credentials, secret manager, store secret.

compatibility

Requires Harness MCP v2 server (harness-mcp-v2)

metadata.author

Harness

metadata.version

1.0.0

metadata.mcp-server

harness-mcp-v2

license

Apache-2.0

secret:
  identifier: my_api_key
  name: My API Key
  description: API key for external service
  type: SecretText
  spec:
    secretManagerIdentifier: harnessSecretManager
    valueType: Inline
    value: <secret_value>

harness_list(
  resource_type="secret",
  org_id="<org>",
  project_id="<project>",
  search_term="<keyword>"
)

harness_create(
  resource_type="secret",
  org_id="<org>",
  project_id="<project>",
  body={
    "secret": {
      "identifier": "my_api_key",
      "name": "My API Key",
      "type": "SecretText",
      "spec": {
        "secret_manager_identifier": "harnessSecretManager",
        "value_type": "Inline",
        "value": "<value>"
      }
    }
  }
)

harness_get(
  resource_type="secret",
  resource_id="my_api_key",
  org_id="<org>",
  project_id="<project>"
)

# Project-level secret
<+secrets.getValue("my_api_key")>

# Org-level secret
<+secrets.getValue("org.my_api_key")>

# Account-level secret
<+secrets.getValue("account.my_api_key")>

connector:
  spec:
    authentication:
      spec:
        tokenRef: github_pat   # secret identifier

variables:
  - name: DB_PASSWORD
    type: Secret
    value: <+secrets.getValue("db_password")>

/create-secret
Create a SecretText for a GitHub personal access token at the project level
using the Harness built-in secret manager

/create-secret
Create an SSH key secret for deploying to production servers as the "deploy" user

/create-secret
Create a secret that references the database password stored in HashiCorp Vault
at secret/data/production/database#password

/create-secret
Show me all secrets in the payments project

/create-secret
Create WinRM NTLM credentials for the Windows deployment servers

© harness, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in skills/create-secret of harness/harness-skills.

• SKILL.md
• references/secret-types.md

Open the folder on GitHubat commit c25faee