Settings reference
Every tab of the Mac app's Settings window, what each field does, and where it's stored.
Open SI Fabrik → Settings… (⌘,). The window has seven tabs. A connected server's Server Settings uses the same tabs; see Server Settings for the differences.
General#
Symphony HTTP API & MCP tool server
| Field | Description |
|---|---|
| Port | The loopback port for SI Fabrik's HTTP API and the agents' MCP tools endpoint. Default 7878. If the port is busy, an ephemeral port is used. |
| Apply & Restart Server | Restarts the server on the new port. |
| Status | The server's base URL (http://127.0.0.1:7878), or the error that stopped it. |
| Requests served | Requests and tool calls since launch. |
The server is loopback only. It serves /api/v1/state, /api/v1/<issue>, POST /api/v1/refresh and the per-session MCP endpoints that let agents update tickets without seeing tracker credentials. See HTTP API.
Notifications: Notify when an agent attempt fails.
Data: Reveal buttons for Application Support (~/Library/Application Support/Harness) and Logs (~/Library/Logs/Harness).
Credentials#
| Field | Description |
|---|---|
| Anthropic API key (sk-ant-…) | Used by Claude Code in sandboxes. |
| Claude Code OAuth token | A long-lived token from claude setup-token. |
| OpenAI API key | Only needed for runner.kind: codex in a sandbox. |
Credentials never enter sandboxes: Docker and Cloudflare sandboxes get a placeholder, and SI Fabrik's relay adds the real credential to their model traffic. When agents run on the host without these, Claude Code uses your existing login. If you defined a Claude key in Environment instead, the tab shows Using the Claude key defined in Settings → Environment. All values are stored in your login Keychain. Tracker credentials go in Environment. See Agent credentials.
Model Gateway#
| Section | Fields |
|---|---|
| LiteLLM proxy | Route all agents through this gateway by default, Base URL, Virtual key (sk-…), Auth header (Bearer or x-api-key), Test Connection |
| Claude Code | Opus slot, Sonnet slot, Haiku slot (background tasks), each with a picker of the proxy's models after a test |
| Codex | Default model, Wire API (Responses or Chat Completions) |
| Advanced | Tag requests for spend tracking, Disable experimental betas |
Press Save to apply. Projects can override any of this with a gateway: block or opt out with gateway: { enabled: false }. See Model gateway.
Environment#
A table of Name and Value rows (values are masked), with + and − buttons. Variables are available to $VAR references in WORKFLOW.md and to workspace hooks. Define tracker keys such as CLICKUP_API_TOKEN and GITHUB_TOKEN here: GUI apps don't inherit your shell environment. Stored in the Keychain. See Environment and variables.
Limits#
Across all projects: toggles and values for Max agents running at once (1–50), Daily budget (USD) and Daily token budget. When a budget is reached, running turns finish but no new work starts until midnight.
Today: what's been spent and the tokens used, in total and per project with activity today. See Budgets and limits.
Sandbox#
Hosts every sandbox may reach: the host-wide allowlist as editable chips, with Restore SI Fabrik defaults. It applies to Docker and Cloudflare sandboxes in allowlist mode. Each run also reaches its model, through SI Fabrik's relay, and SI Fabrik's tracker tools. In Docker, GitHub and the npm, Yarn, crates.io and RubyGems registries stay read-only.
Cloudflare sandboxes: Bridge URL, Bridge token (HARNESS_BRIDGE_TOKEN) and Test Connection. Model keys and tracker traffic are relayed through this Mac, so credentials never enter Cloudflare. See Cloudflare Containers.
About#
The version, links to sifabrik.com, the Symphony SPEC.md and the Claude Code docs.
Where settings are stored#
| Setting | Stored in |
|---|---|
| Credentials, Environment, the gateway key, the bridge token, project environments and test logins | Login Keychain, service com.redmantech.harness |
| Port, notifications, gateway fields, limits, sandbox defaults | App preferences |
| Projects, including Allow agents to run directly on this Mac | ~/Library/Application Support/Harness/projects.json |
| Servers (Remote mode) | ~/Library/Application Support/Harness/servers.json; session tokens are in the Keychain |
Edit Project#
Per-project settings live in Edit Project… (the … menu in the project header):
- Name, the Workflow path, Start orchestrator when SI Fabrik launches, Color and Icon.
- Allow agents to run directly on this Mac: off by default, so the project's agents must run in a Docker or Cloudflare sandbox and a project without one pauses with
sandbox_policy. Turning it on removes the sandbox floor for this project: agents and hooks without a sandbox run as you, with access to your files, SSH keys and network. It's saved in the app'sprojects.json, not inWORKFLOW.md, which agents can edit on their branch. - Environment: project variables, on top of Settings → Environment. Credential names are marked credential.
- Test logins: see Test logins.