Team Fleet Sync

Harbor’s fleet sync lets teams share a canonical set of MCP server definitions through a git repository. Every teammate pulls the same server configs — without sharing raw API keys.

How it works

Fleet repo — a git repository at ~/.harbor/fleet/ containing harbor-fleet.toml. Only server definitions are committed: command, args, env var names (as vault:KEY references), URLs, headers, and tool filters.
Secrets stay local — raw values never leave your machine. Fleet configs use vault:KEY_NAME references that each teammate provisions independently.
3-way merge — pulling the fleet merges upstream changes into your local config without overwriting per-machine settings (enabled state, host connections, tool overrides).
Drift detection — Harbor tracks a SHA-256 hash of each server’s definition after every pull. If you hand-edit a fleet-managed server, it is flagged as locally modified and skipped on the next pull until you resolve it.

Setup (one person per team)

1. Initialize the fleet and link a remote:

harbor crew init --git [email protected]:your-org/fleet.git

2. Share your existing servers:

# Mark servers as fleet-managed and push
harbor crew push github linear slack

This writes harbor-fleet.toml to the fleet repo and pushes to the remote. 3. Invite teammates: Send them the git URL. They run:

harbor crew join [email protected]:your-org/fleet.git

join clones the fleet and automatically runs pull, adding all fleet servers to their local config.

Day-to-day workflow

# Pull upstream changes
harbor crew pull

# Preview before applying
harbor crew pull --dry-run

# Check git sync status and per-server state
harbor crew status

# Stow missing vault secrets after a pull
harbor crew provision

Provisioning secrets

Fleet servers reference secrets by name (vault:GITHUB_TOKEN, vault:SLACK_TOKEN). After pulling a fleet for the first time, run:

harbor crew provision

This scans the fleet config for vault: references that aren’t yet in your keychain and prompts you to enter each value (input is hidden). Secrets are stored in your OS keychain — they never touch the git repo. To preview what’s missing without entering values:

harbor crew provision --dry-run

Resolving conflicts

Locally modified server

If you’ve edited a fleet-managed server since your last pull, Harbor skips it on the next pull to protect your changes:

warn: 1 server(s) skipped (locally modified since last pull):
  ≠ github
hint: To accept upstream changes: `harbor undock github` then `harbor crew pull`.
      To share your version with the team: `harbor crew push github`.

Choose one:

Accept upstream — harbor undock github && harbor crew pull
Share your version — harbor crew push github

Source conflict

If a server exists locally with a non-fleet source (e.g., you docked it manually before the fleet existed), it will also be skipped:

warn: 1 server(s) skipped (non-fleet source):
  ! github — server already exists with source "native:github"

Run harbor undock github then harbor crew pull to let the fleet version take over.

Desktop app

The desktop app surfaces fleet state without requiring the CLI:

Fleet badge — server cards show a blue fleet chip for fleet-managed servers.
Modified badge — an amber modified chip appears when a server has drifted from its last-pulled definition.
Crew section — in Settings → Crew, you can see the fleet remote URL, git ahead/behind status, and trigger a pull with the Pull button.

The fleet config file

harbor-fleet.toml is human-readable TOML. You can edit it directly and push:

[fleet]
name = "acme-team"
description = "Shared MCP servers for the Acme engineering team"

[servers.github]
description = "GitHub — repos, issues, and code search"
command = "npx"
args = ["-y", "@modelcontextprotocol/server-github"]

[servers.github.env]
GITHUB_PERSONAL_ACCESS_TOKEN = "vault:github_token"

[servers.slack]
description = "Slack — channels and messages"
url = "https://mcp.slack.com/v1/mcp"

[servers.slack.headers]
Authorization = "Bearer vault:slack_token"
tool_allowlist = ["send_message", "search_messages"]

Never put raw secret values in harbor-fleet.toml. Use vault:KEY_NAME references. Each teammate stows their own copy of the secret with harbor crew provision or harbor chest set KEY value.

Without a remote

Fleet sync also works locally (no git remote required) — useful for sharing configs between machines via any file sync tool, or just keeping a versioned history of your server setup:

harbor crew init   # no --git flag
harbor crew push
harbor crew status

Add a remote later with:

harbor crew init --git <url>

Get Started

Desktop App

CLI

Guides

Configuration

Development

Team Fleet Sync

How it works

Setup (one person per team)

Day-to-day workflow

Provisioning secrets

Resolving conflicts

Locally modified server

Source conflict

Desktop app

The fleet config file

Without a remote

​How it works

​Setup (one person per team)

​Day-to-day workflow

​Provisioning secrets

​Resolving conflicts

​Locally modified server

​Source conflict

​Desktop app

​The fleet config file

​Without a remote

How it works

Setup (one person per team)

Day-to-day workflow

Provisioning secrets

Resolving conflicts

Locally modified server

Source conflict

Desktop app

The fleet config file

Without a remote