Phase 0 · pilot-ready path

Jenkins, instrumented for agents — without leaking your fleet.

A Go MCP server that puts Cursor (and other agents) on a short leash: personal credentials in the OS keyring, read-only by default, redacted logs, signed policy overlays, and a deep diagnostic tool surface.

Install & connect Browse documentation

Local-first stdioCursor MCP entry, no tokens in config

Tier-1 LinuxRocky + Ubuntu packages

RO defaultMutations opt-in with preview/confirm

session · diagnose_build

              $ jenkins-mcp login --profile corp
              verified identity · token stored in Secret Service
              $ jenkins-mcp serve --profile corp
              stdio MCP · force_read_only=true · mutations omitted
               
              # agent tool call
              jenkins_diagnose_build
              { "job_name": "payments/main", "build_number": 1842 }
               
              status · FAILURE · stage Compile
              findings · 3 high · redacted secrets: 2
              evidence · log_ref · test_report · queue_delay
              next · jenkins_compare_builds · jenkins_find_regression_window
            

v0.2.0

Current release

Conformance waves

300+

Go test files

Default policy posture

Why it exists

Agents that can read CI must not become a backdoor into Jenkins.

Built as an enterprise product from a community seed — not a thin wrapper. Architecture packages for auth, policy, archive, redaction, and tools are first-class.

Secrets stay off the model path

Profiles hold non-secret connection data. API tokens land in Secret Service after interactive login — never in Cursor mcp.json, shell history, or profile JSON.

Diagnosis tools, not just raw logs

Structured diagnose, compare, regression windows, survey, search, and mirror flows with hard response budgets so agents get signal instead of multi-megabyte pastes.

Policy you can sign and audit

Deny-only RBAC overlays, Ed25519 signed policy bundles, mutation preview/confirm with cooldowns, and offline doctor / security self-checks for pilot evidence.

Capability surface

What agents can actually call.

Core job/log tools always register in the RO pilot path. Higher-order diagnostics and optional adapters layer on when you enable them.

jenkins_diagnose_buildStage-aware failure summary with redacted evidence refs

jenkins_compare_buildsDiff parameters, results, timing, and test deltas

jenkins_find_regression_windowBinary-search style lookback for when it broke

jenkins_survey_recent_failuresFleet scan with operator caps and privacy filters

jenkins_search_logsBounded search across mirrored / progressive logs

jenkins_start_jobMutation path — preview token then confirm (opt-in)

Full contracts, budgets, and side-effect classes live in docs/tool-contracts.md.

Runtime shape

Local agent path first. Managed gateway when you are ready.

Cursor / agent hoststdio MCP · no secrets in config

jenkins-mcptools · policy · redact · cache

Jenkins originHTTPS · personal token or OIDC RS

Pilot path

Per-user binary on Rocky/Ubuntu, profile + keyring login, RO Cursor stdio, doctor + pilot evidence kit.

Open the start guide

Admin console

Embedded SPA for cache, policy, metrics, audit, and doctor — shippable via local Docker without a host install.

Local Docker README

Residual honesty

Live Entra / jwt-auth-filter lab pins, production multi-tenant gateway isolation, and SaaS log/ticket clients remain residual. This site describes shipped pilot capabilities — not a claim of full OAuth cohort production readiness.

Ship a safer CI agent loop this week.

Install the binary, login once, wire Cursor stdio, and run doctor offline before you touch a production controller.

Get started View repository