Tier-1 Linux pilot

From zero to a read-only Cursor session.

Rocky Linux or Ubuntu. Unlocked Secret Service. A personal Jenkins API token. No secrets in mcp.json — ever.

1. Install the binary

Prefer a checksum-verified package from your enterprise channel. Portable tarballs always ship from make package.

Rocky Linux Ubuntu LTS linux/amd64 Windows out of scope

# Portable tarball
tar -xzf jenkins-mcp_*_linux_amd64.tar.gz
sudo install -m 0755 usr/bin/jenkins-mcp /usr/local/bin/jenkins-mcp

jenkins-mcp version --json

2. Profile + login

Profiles store non-secret connection metadata. Interactive login verifies the token against Jenkins, then stores it in Secret Service. Success output prints identity only.

jenkins-mcp profile add corp --url https://jenkins.example.corp/

# Interactive: username + API token on the terminal
jenkins-mcp login --profile corp

jenkins-mcp status --profile corp
jenkins-mcp doctor --profile corp --offline

3. Cursor stdio (RO default)

Read-only is the pilot and production default. Prefer explicit flags so hosts never rely on “forgot to set RO.” Mutations stay unregistered unless you opt in separately.

{
  "mcpServers": {
    "jenkins": {
      "command": "jenkins-mcp",
      "args": [
        "serve",
        "--profile",
        "corp"
      ]
    }
  }
}

Never put secrets in

Hard rules for pilot configs.

Cursor config

No tokens in mcp.json command, args, or env. Login once; serve resolves credentials from the keyring.

Shell history

Do not paste -auth user:token or JENKINS_MCP_AUTH — those bootstrap paths are removed (fail closed).

Profile JSON

XDG config under ~/.config/jenkins-mcp/ is non-secret connection data only.

Optional OIDC path

External-IdP OIDC login with PKCE is implemented offline. Live Jenkins LTS + jwt-auth-filter evidence remains residual — do not claim OAuth production readiness until that lab is closed.

Need the long form?

User guide covers packaging paths, doctor checks, mutations preview, and pilot checklist handoff.

docs/user/README.md Pilot kit