harness-mcp

SUSPICIOUS. The purpose largely matches Harness/Jira automation, and primary API data flows are to expected first-party services, but the install path is internally inconsistent: the skill tells users to run an npm package name that does not match Harness's official documented MCP package. Because that external MCP process receives a Harness API key and the skill enables autonomous repo/PR/pipeline/Jira actions, the overall risk is high enough to treat as suspicious rather than benign.