Atlas / MCP servers / swsgbl / hmharness

hmharnessBLOCK

Name: hmharness
Author: swsgbl

mcp/swsgbl/hmharness

MCP server by swsgbl · agent framework · ai agent · arkts · Audited 2026-10-11

为鸿蒙 (HarmonyOS/OpenHarmony) 开发全流程而生的自进化智能体框架——零依赖内核、自进化一等公民、MCP 生态借力、模拟器与工具链无头全控。Self-evolving agent framework for the full HarmonyOS lifecycle.

Verdict

BLOCK

Grade

Trust score

60 /100

Exposed tools

84 71r · 11w · 2d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

为鸿蒙 (HarmonyOS/OpenHarmony) 开发全流程而生的自进化智能体框架,已升级为跨环境 Cognitive Runtime。 零依赖内核 + 自进化一等公民 + MCP 生态借力 + 认知层(世界模型/校准/探索/迁移)——不继承任何上游运行时能力,全部自持或经标准协议外借。

English · [](https://github.com/swsgbl/hmharness/actions/workflows/ci.yml) [](https://www.npmjs.com/package/@hmharness/cli)

特性一览

Read from source at commit 9275e895eb53OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add web --env ARC3_API_KEY=${ARC3_API_KEY} --env ARC_API_KEY=${ARC_API_KEY} --env HMH_API_KEY=${HMH_API_KEY} --env HMH_DESKTOP_TOKEN=${HMH_DESKTOP_TOKEN} -- npx -y @hmharness/[email protected]

claude-desktop

{
  "mcpServers": {
    "web": {
      "command": "npx",
      "args": [
        "-y",
        "@hmharness/[email protected]"
      ],
      "env": {
        "ARC3_API_KEY": "${ARC3_API_KEY}",
        "ARC_API_KEY": "${ARC_API_KEY}",
        "HMH_API_KEY": "${HMH_API_KEY}",
        "HMH_DESKTOP_TOKEN": "${HMH_DESKTOP_TOKEN}"
      }
    }
  }
}

Exposed tools (84)

71 read · 11 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`OAuth`	read	Authenticate with OAuth
`a`	read
`avg_duration`	read	average evaluation duration
`avg_score`	read	average numeric score
`broken`	read	always fails
`browser_click`	read	Click an element by its browser_snapshot ref. After the click, re-snapshot (or browser_screenshot) to see the new state.
`browser_navigate`	read	Navigate the BrowserOS tab to an http(s) URL, wait for load. First use auto-starts a DEDICATED BrowserOS instance (own profile; the user\
`browser_open`	read	Open a URL in the user\
`browser_read`	read	Read the current page as text (title, URL, visible innerText, capped ~12k chars). Prefer this over screenshot for content extraction; use browser_screenshot for layout/visual state.
`browser_screenshot`	read	Screenshot the current page to a PNG file; returns the path — then call see_image with it to actually look. Use when layout/visual state matters; for text content prefer browser_read.
`browser_scroll`	read	Scroll the current page: down \| up \| top \| bottom (step ~600px). Snapshot again after scrolling — new elements become visible and get refs.
`browser_snapshot`	read	List the visible interactive elements of the current page with stable refs ([N] tag text). Click/type target these refs. Re-snapshot after any navigation or DOM change. For visual/layout questions use browser_screenshot + see_image instead.
`browser_tabs`	read	Manage tabs of the driven browser: list (default) \| new [url] \| activate <target_id> \| close <target_id>. Navigate/click/type/read always act on the ACTIVE tab.
`browser_type`	read	Type text into an input/textarea/contenteditable by its browser_snapshot ref (native setter + input/change events — React/Vue compatible). submit=true presses submit (form.requestSubmit, else Enter).
`cfg-floor`	read	d
`cognitive_query`	read	Query the cognitive layer\
`desktop_click`	read	Click the mouse at screen coordinates (left click). ALWAYS desktop_screenshot + see_image FIRST to find the right coordinates, then click, then screenshot again to verify. Coordinates are pixels from top-left of the primary display.
`desktop_screenshot`	read	Screenshot the primary display to a PNG file and return its path. Immediately follow with see_image on that path to actually look at it. Use for: checking a GUI app state, reading dialogs/errors, verifying what a desktop automation step did.
`desktop_type`	read	Type text (or a key combo like ENTER, TAB, ^a, {F5}) into the focused window. Use after desktop_click to focus a field. Standard SendKeys syntax.
`echo`	read	Echo back the given text.
`edit_file`	write	Surgical search-replace edit. Provide old_string (must appear exactly once in the file) and new_string to replace it. Prefer this over write_file for changes to existing files. old_string must be unique - if it appears more than once, the edit is refused (make it more specific).
`evidence_coverage`	read	fraction of results with evidence
`evil`	read
`extension_page_act`	read	在用户真实浏览器的标签页里执行一次页面操作:click(点击选择器)/type(输入文本,React 兼容)/scroll(滚动)/select(设置下拉值)。⚠️ 这会在用户真实浏览器、用户已登录的页面上动手 — 每次调用都必须获得用户批准。先 extension_page_read 看清页面再操作。
`extension_page_read`	read	读取用户真实浏览器某个标签页的内容(标题/URL/用户选区/标题大纲/表单/链接/正文,只读,约8k字符上限)。tabId 省略时读活动标签页。受保护页面(chrome:// 等)或未授权站点会诚实报错。对布局/视觉问题用 browser_screenshot 类工具,不要用这个。
`extension_status`	read	hmh 浏览器扩展桥的状态:桥是否运行、是否已配对、扩展是否连接、目标浏览器。排查 extension_* 工具问题时先调用这个。
`extension_tabs`	read	列出用户真实浏览器当前打开的标签页(标题/URL/是否活动)。只读。与 browser_tabs(专用实例)不同,这里看到的是用户日常浏览器里的真实标签页。
`greet-loud`	read	shout
`greet-uppercase`	read	uppercase the greeting
`half-good`	read	d
`harmony_build`	read	Build a HarmonyOS project with hvigor (assembleHap). Accepts an optional project path (defaults to walking up from cwd for build-profile.json5). Long-running: allow several minutes. Reports the build result tail and the produced .hap path.
`harmony_cjpm_build`	read	Build a Cangjie (cjpm) package with cjpm build. Looks for cjpm.toml at/above the given path (default cwd). Injects CANGJIE_HOME derived from the resolved cjpm.exe - the classic Windows pitfall. Long-running: allow minutes.
`harmony_cjpm_test`	write	Run Cangjie unit tests (cjpm test) in the project at/above the given path. Same CANGJIE_HOME injection as harmony_cjpm_build.
`harmony_devices`	read	List connected HarmonyOS devices/emulators (targets) via hdc. Returns the raw target list: index, state and connect string. Use before any device operation to learn the target id.
`harmony_emulator_create`	write	Create (deploy) a NEW emulator instance - no DevEco GUI. Two sources: clone an existing deployed device (from=...), or materialize a CATALOG VARIANT (model=
`harmony_emulator_delete`	destructive	Delete a deployed emulator instance (data dir, lists entry, ini). Refuses while it is running. Destructive - requires approval.
`harmony_emulator_list`	read	List HarmonyOS emulators: deployed devices (name/type/version/resolution + running state) and installed system images. Read-only. Pair with harmony_emulator_start / harmony_devices.
`harmony_emulator_start`	write	Start a deployed emulator headlessly (spawns Emulator.exe directly - no DevEco GUI). Boots take 30-90s; the tool polls until the device appears in hdc (max 3 min). Heavy: each instance uses ~4 GB RAM.
`harmony_emulator_stop`	write	Stop running emulator(s) by terminating their exact Emulator.exe process (matched via -hvd name; state on disk is preserved like a power loss - Android-style cold stop). With a name, stops only that instance; with no name, stops ALL running emulators. Requires approval.
`harmony_install`	write	Install a .hap onto a connected HarmonyOS device via hdc (mutates the device - requires approval). Without a path, installs the newest .hap in the current project build output. Tries
`harmony_launch`	read	Launch an app on a connected HarmonyOS device via
`harmony_lint`	read	Lint a HarmonyOS/ArkTS project with the official codelinter CLI (probe-based). If codelinter is not installed, returns install guidance instead of failing. Install options: DevEco Studio
`harmony_logs`	read	Fetch recent device logs via
`harmony_ops_issue_comment`	read	Comment on a GitHub issue (PUBLICATION - requires human approval via the gate). Never closes, never edits others\
`harmony_ops_issue_create`	write	Create a GitHub issue (PUBLICATION - requires human approval via the gate). AI drafts the title/body; the approval prompt is the publication decision. A keeper identity footer is appended automatically.
`harmony_ops_issue_list`	read	List GitHub issues for a repo (owner/name) via gh. Read-only. Returns number, title, author, updated time as JSON lines. Draft input for issue triage - pair with harmony_ops_issue_view before proposing replies.
`harmony_ops_issue_view`	read	Read one GitHub issue with its comments (gh issue view). Read-only.
`harmony_ops_pr_draft`	read	Open a DRAFT pull request (PUBLICATION - requires human approval). Always --draft; the body becomes the plan card (what/why/how to test). Keeper identity footer appended.
`harmony_ops_radar_brief`	read	Read the latest saved ecosystem radar brief (markdown).
`harmony_ops_radar_scan`	read	Scan the OpenHarmony/HarmonyOS ecosystem radar: pull release feeds (OpenHarmony docs/ArkUI/ArkTS/Ability runtime), diff against the last snapshot, and produce a Chinese brief (model-written, template fallback when the model is down). Read-only for the outside world; results land under HMH_HOME/ops/.
`harmony_ops_status`	read	Ops keeper status: scan count, last scan time, watched sources.
`harmony_project_create`	write	Scaffold a buildable HarmonyOS project (stage model, ArkTS) - fully parametric, no DevEco IDE needed. Options: extra pages (PascalCase, e.g. [
`harmony_project_profile`	read	One-call project inventory: modules (type/pages/abilities/deviceTypes), har dependencies, resource + source counts, bundle/SDK, and config health (issue count from schema check). The
`harmony_schema_check`	read	Validate a HarmonyOS project\
`harmony_toolchain_check`	read	Check the local HarmonyOS development toolchain: hdc (devices), hvigorw (build) and ohpm (packages), with resolved paths and versions where available.
`harmony_uninstall`	destructive	Uninstall a bundle from a connected device via hdc (destructive - requires approval).
`hmh_ping`	read	Test connectivity: returns pong plus the call counter.
`list_dir`	read	List a directory: names with d/- prefix and size.
`lsp_call_hierarchy`	read	Who calls this symbol, and what does it call (incoming/outgoing). Args: file, line (1-based), character (1-based), direction=incoming\|outgoing
`lsp_definition`	read	Go to definition of the symbol at a position. Args: file, line (1-based), character (1-based)
`lsp_diagnostics`	read	Get live language-server diagnostics for a file (errors/warnings). source:lsp — this is FEEDBACK, not build/test proof. Args: file (relative to workspace or absolute)
`lsp_hover`	read	Hover info (types/docs) for a symbol at a position. Args: file, line (1-based), character (1-based)
`lsp_implementation`	read	Find implementations of the interface/method at a position. Args: file, line (1-based), character (1-based)
`lsp_references`	read	Find references to the symbol at a position. Args: file, line (1-based), character (1-based)
`lsp_symbols`	read	Document symbols (outline) for a file. Args: file
`my_metric`	read	test
`noop`	read	noop
`nope`	read
`ops_notify`	write	Send a notification to a configured chat channel (Feishu/DingTalk custom bot or generic JSON webhook). Configure once in HMH_HOME config.json: channels: { name: { type, url, secret? } }. Use to report task completion, build results, device-test verdicts -
`page_act`	read	操作用户当前标签页(click 点击 / type 输入 / scroll 滚动 / select 选择)。动作会在用户眼前执行;不确定时先用 page_read 看页面、再问用户。
`page_read`	read	读取用户当前浏览器标签页:标题、URL 与正文文本的精简提取。回答任何关于
`pass_rate`	read	fraction of evaluations that passed
`poke`	read	no-op
`read_file`	read	Read a text file. Returns the full content (truncated at 60k chars).
`remember`	read	Persist a note to long-term memory (survives restarts, loaded into future sessions). Use for user preferences, project facts, and hard-won lessons - not transient details.
`rlm_workspace`	read	Persistent structured workspace for THIS task: variables survive between calls (unlike your context window).
`run_command`	write	Run a shell command (one line, cmd on Windows / sh elsewhere) with a timeout. Prefer focused commands; read output carefully before deciding next steps.
`see_image`	read	Look at an image file (png/jpg/webp) with the configured vision model and answer a question about it, or describe it. Use for UI screenshots, rendered pages, photos of device screens - anything visual. Requires a vision provider in config.
`slow`	read	sleeps 150ms
`spawn_agent`	read	fake
`web_fetch`	read	Fetch a web page and return its readable text (HTML stripped, entities decoded, bounded to ~12k chars). Use after web_search to read a result, or for any docs page / raw file URL.
`web_search`	read	Search the web (DuckDuckGo, no key). Returns top results as: title \| url \| snippet. Use for current events, docs, versions - anything not knowable offline.
`write_file`	write	Write a text file (creates or overwrites). Use for code, config, docs.
`x`	read

Trust audit

BLOCKgrade D · trust 60/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (12 observation(s))
Network: declared (6 observation(s))
Shell: declared (5 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

<tool:ops_notify>:1

Send a notification to a configured chat channel (Feishu/DingTalk custom bot or generic JSON webhook). Configure once in HMH_HOME config.json: channels: { name: { type, url, secret? } }. Use to report

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

packages/domain-harmony/src/vmenv.ts:235

sshKey: { type: 'string', description: 'for check: path to the SSH key (default ~/.ssh/VM_KEY)' },

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

packages/sandbox/src/redteam.ts:44

{ id: 'pt-006', payload: '~/.ssh/id_rsa', description: 'SSH key access' },

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

packages/sandbox/src/redteam.ts:168

{ name: 'ssh-key', regex: /id_rsa|id_ed25519|\.pem/i },

Why it matters. touches a credential store

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

packages/web/src/server.ts:2323

console.log(`auth:   未配对设备需要 ?key=<web.token> 链接;已配对手机凭 cookie/局域网位置直连`);

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

scripts/publish.cjs:127

console.log('publishing as:', who, '(auth: ' + (TOKEN ? 'NODE_AUTH_TOKEN' : 'npm login session') + ')');

MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

packages/extension/src/adapters.ts:43

export const EXTENSION_KEY = 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4q3ILDDKZOiEgNrQDc7ljtWiTzt3tSsbgnpgvTgZNh7L4BjU+4Evad1arNin/IN6LKyS7pyJoFL6vaEApk+KZdRJQ8a6Um4IanqAIz+OLDm5NjpHqlvlPBREHb5bDA

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

harmony_emulator_delete, harmony_uninstall

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.binary · CWE-1104

docs/plans/hmharness_V2.0_施工蓝图.docx

hmharness_V2.0_施工蓝图.docx

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

docs/plans/hmharness_V2_V3_路线图.docx

hmharness_V2_V3_路线图.docx

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.hidden_file · CWE-1104

.research-repo.md

.research-repo.md

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose