OpenAPI Plugins

API-class plugins are backed by OpenAPI specifications. Harbor parses the spec and exposes each operation as a callable tool for agents.

How they work

Each API plugin definition includes a base URL and a list of tools. Each tool maps to an HTTP operation with a method, path, description, and parameters (query and body).

When an agent calls harbor p.<slug> <action> [args...], Harbor matches the action, injects credentials from secrets, executes the HTTP request, and returns the result.

Inspecting available operations

harbor plugins tools modal

Shows each tool with its HTTP method, path, description, and parameters (name, type, required, default value).

Running

harbor p.modal volume list
harbor p.exa search --query "latest AI news"
harbor p.gh issue list

Auth

API plugins declare which secrets they need. The operator configures those secrets in the dashboard. If required secrets aren't configured, the plugin shows as missing_secrets in harbor status and as "Needs setup" in the dashboard.

Common patterns:

• Bearer token — injected as Authorization: Bearer <value>
• API key — injected as a header or query parameter
• Multiple keys — some plugins need 2+ secrets (e.g. MODAL_TOKEN_ID + MODAL_TOKEN_SECRET)

Note: API and CLI plugin definitions are currently managed at the control-plane level, not registered through the dashboard UI. The dashboard manages plugin setup — configuring secrets and granting agent access.