HarborClient has always been a capable HTTP client — collections, environments, team hubs, AI assistance, and request scripts. Starting in HarborClient 1.8.0, you can go further: installable plugins that extend the app without waiting for a new release.

Plugins are packaged as .hcp files — HarborClient plugin packages that are really just ZIP archives with a friendly extension. Each package contains a manifest.json and prebuilt JavaScript bundles. Install one from a downloaded file, clone it from a public Git repository, or load an unpacked folder while you develop. HarborClient validates the manifest, shows you exactly what permissions the plugin wants, and activates it when you are ready.

Open File → Settings (or Cmd/Ctrl+,) and choose Plugins in the sidebar to get started.

Three ways to install

Install from file — Pick a .hcp or .zip plugin package from disk. HarborClient unpacks it to your local plugins directory, validates the manifest, and walks you through a permissions confirmation dialog before enabling it.

Install from Git… — Paste a public https:// repository URL and optionally pin a branch or tag. HarborClient shallow-clones the repo, looks for a built manifest.json and entry files at the repository root, and installs the same way as a file package. Git-installed plugins show a Git badge in the list and include an Update button to pull the latest version from the stored URL.

Load unpacked… — For plugin authors and power users: point HarborClient at a source directory on disk (the folder containing manifest.json). The plugin runs in place — no repackaging step for every change. Unpacked plugins get a Development badge, support manual Reload, and hot-reload automatically when you rebuild entry files.

You can also register dev plugins at startup with the HARBOR_PLUGINS_DEV environment variable or the --plugin-dev CLI flag — handy for local iteration without clicking through Settings every time.

You stay in control: permissions first

Plugins use a permission-gated model similar to VS Code extensions. Before a plugin activates, HarborClient shows what it is asking for:

• UI contributions — settings panels, sidebar views, request tabs, themes, toasts, and commands
• Plugin-scoped storage — persistent key-value data namespaced to the plugin
• Filesystem access — open/save dialogs and read/write on user-approved paths (not unrestricted disk access)
• HTTP hooks — observe or mutate outgoing requests in a sandboxed main-process runner
• Custom IPC — bridge logic between the plugin’s renderer UI and its main-process half

If you cancel the permissions dialog, the install is rolled back. You can enable or disable any plugin later without uninstalling it.

Extend almost every corner of the app

Plugins declare UI slots in their manifest and register React components at activation time. Here is what they can add today:

What plugins can add	Where it shows up
Settings sections	Settings sidebar — alongside General, Storage, AI, and the rest
Sidebar panels	Full-height switchable sidebar destinations
Sidebar sections	Collapsible blocks below Collections and Environments
Main views	Full main-area overlays (same pattern as Team Hubs)
Request tabs	Segmented tabs in the request editor (Params, Headers, Body, …)
Response tabs	Tabs in the response viewer
Collection settings tabs	Per-collection configuration tabs
Footer panels	Slide-up panels like Console and Variables
Request toolbar actions	Buttons next to Send in the URL bar
Context menu items	Right-click menus on collections, folders, and requests
Status bar items	Left or right footer status area
App menu items	File, Edit, View, and Help menus
Appearance themes	Settings → General → Theme picker

Custom themes

Plugins can register light or dark themes with color token overrides and optional CSS stylesheets. Your chosen theme persists as plugin:<pluginId>:<themeId> and falls back to System if the plugin is disabled or removed — so you never get stuck on a broken theme.

HTTP hooks without touching the renderer

Plugins that need to intercept traffic can ship a main entry that runs in an isolated utility process inside a hardened SES JavaScript sandbox — the same security-minded infrastructure HarborClient uses for request scripts. With the http permission, plugins can register:

• onBeforeSend — mutate method, URL, headers, or body before a request leaves HarborClient
• onAfterSend — inspect the response after it returns

This is ideal for logging, auditing, signing, or injecting headers globally — without a visible UI at all.

Storage and file system helpers

Plugins get namespaced hc.storage for persistent settings and state, stored locally via the main process. For file workflows, hc.fs exposes pick/read/write/save helpers that respect an allowlist: the plugin’s own directory is always accessible; anything else requires the user to pick a path through a native dialog.

Managing installed plugins

Select any plugin in Settings → Plugins to open its detail panel:

• Read the Markdown description, publisher, version, and on-disk path
• Follow Website and Report issue links from the manifest
• Review granted permissions
• Enable / Disable without losing the install
• Update git-sourced plugins with one click
• Reload unpacked dev plugins after a rebuild
• Uninstall file or git installs, or Remove unpacked registrations (your source folder is kept)

Contributed settings sections from enabled plugins appear automatically in the Settings sidebar — no restart required.

Broken plugins fail gracefully: they show an inline error on their row instead of crashing HarborClient on startup.

Built for plugin authors

If you build plugins, HarborClient follows familiar extension patterns:

Declarative manifest + activation function. Declare contribution slots in manifest.json, then call matching hc.ui.register* functions inside activate(hc).

Dual runtime. A renderer entry (dist/renderer.js) hosts React UI using HarborClient’s shared hc.react instance — do not bundle your own React. An optional main entry (dist/main.js) handles HTTP hooks and IPC in the sandboxed utility process.

Rich package metadata. Ship a square icon, Markdown README, screenshots, homepage, and bug tracker URL — all surfaced in the plugin detail view so users can evaluate your work before enabling it.

Type definitions. The @harborclient/sdk package provides TypeScript definitions for the plugin surface.

Engine compatibility. Manifests declare engines.harborclient (for example >=1.8.0) so incompatible plugins are rejected early.

Example ideas from the docs

• Request Logger — main-only plugin that logs every outbound request to the terminal via HTTP hooks; no UI required
• Request Audit — adds a read-only Audit tab to the request editor showing a JSON summary of the active draft
• Solarized Dark — registers a contributed dark theme in the appearance picker

Pack your built manifest.json, dist/, and assets into a ZIP renamed to .hcp, share it on GitHub, and users can install with Install from Git… — no app store required.

Plugins vs request scripts

HarborClient already supports request scripts — JavaScript that runs around a single send operation. Plugins share the hc namespace but serve a different purpose:

	Request scripts	Plugins
Lifetime	One shot per send	Long-lived while enabled
Best for	Tests, transforms, per-request logic	UI, themes, global hooks, tools
Defined in	Collection or request editor	Installed .hcp package

Request scripts cannot call plugin APIs, and plugins are not a replacement for quick per-request automation — they complement each other.

What plugins do not extend (yet)

To set expectations: plugins cannot modify the open-request tab strip, the AI sidebar, or native window chrome. Everything else listed above is fair game.

Get started

Users: Update to HarborClient 1.8.0 or later, open Settings → Plugins, and install your first extension. Download HarborClient

Developers: Read the full Plugin development guide for manifest reference, API docs, bundling with esbuild, and the unpacked hot-reload workflow. See also Settings → Plugins for the end-user install flow.

We built plugin support so HarborClient can grow with your workflow — custom audit tabs, team-specific tooling, logging middleware, branded themes, and integrations we have not imagined yet. If you ship a plugin, we would love to hear about it.