Keyring credentials
Personal API tokens verified then stored via Secret Service. Profiles never embed tokens. Legacy -auth / JENKINS_MCP_AUTH bootstrap is removed (fail closed).
Threat model · operator guide
Security is the product, not a chapter at the end.
Agents with CI access are a new attack surface. This binary defaults to least privilege and refuses to put long-lived secrets on the model path.
Log redaction
Server-side scrubbing of common secret shapes before tool responses leave the process. Diagnose tools surface redaction counts as evidence, not the secrets themselves.
Policy envelopes
Ed25519 signed policy bundles, deny-only job patterns, list privacy filters, and force_read_only operator caps that survive reloads.
Mutation discipline
Start/stop/cancel require opt-in registration, preview tokens, confirm cooldown, rate limits, and audit reason codes — never silent execute.
Doctor + self-check
Offline security self-check canaries cover origin pin, allowlist, mutation residual, update verify, and more for pilot evidence packs.
Support bundles
Diagnostics extract privacy-scrubbed support material for operators without dumping credentials or unrestricted cache contents.
What we still will not claim
Live Entra / jwt-auth-filter production pins, loopback HTTP socket client auth by default, multi-tenant gateway mutation isolation, and true t-of-n HSM policy signing remain residual. See product residuals and phase boards for the honest ledger.