Jenkins MCP server

A focused, fast Model Context Protocol (MCP) server for Jenkins, written in Go.

Connect Jenkins to Claude Desktop, Claude Code, Cursor, or any MCP-compatible AI agent: fetch console logs, inspect pipeline stages, parse JUnit and Ginkgo test reports, diff two builds, rank flaky tests, trigger and abort builds, and manage the build queue — all over a single MCP stdio transport, from one static Go binary.

Most Jenkins integrations expect a human at a keyboard. LLM agents need something different: small, structured responses; a clear path from "build failed" to "here is the failing line"; and the ability to grep a multi-gigabyte console log without re-downloading it on every question.

jenkins-mcp-gois built for that workflow:

- Read-first, opt-out writes.Read tools are always on. Write tools (trigger_build,stop_build,cancel_queue_item) are gated byJENKINS_MCP_READONLY: set the env var and the server registers only the read surface.
- Single-host, single-credential.It talks to one Jenkins URL with one API token, configured by environment variables. No multi-tenant surface, no credential vault to misuse.
- Triage-shaped, not API-shaped.Tools answer the questions agents actually ask —"what changed between build A and B?"(compare_builds),"which tests in this job are flaky?"(get_flaky_candidates),"what commits and files touched this build?"(get_scm_context) — instead of mirroring Jenkins endpoints one-for-one.
- Built for context windows.Every listing tool takes an RE2 filter and a cap.get_console_log_pathreturns the on-disk path of a finished build's log so the agent canRead/Grep/Bashit natively instead of streaming gigabytes through MCP.
- Disk-cached console logs.Finished builds are saved once and reused. The cache is keyed by job path + build number, capped by total size, and evicted by LRU mtime.
- Pipeline- and Ginkgo-aware.Beyond the raw console, dedicated tools parse/wfapi/describe,/testReport/api/json, and Ginkgo'sSummarizing N Failureblock so the agent gets pre-digested failure information.
- One static binary.Pure Go. No Python runtime, no Docker required.

Build-targeted tools take ajob_path(slash-separated, e.g.Builds/team/job-name) and an optionalbuild_number(0or omitted =lastBuild). A URL likehttps://jenkins.example.com/job/Builds/job/team/job/job-name/86/becomesjob_path="Builds/team/job-name",build_number=86.list_jobstakes afolder_pathin the same slash-separated form (empty = root).

Seedocs/TOOLS.mdfor the full parameter reference.

Grab the archive for your OS and architecture from theReleases pageand put thejenkins-mcpbinary on yourPATH.

go install github.com/2001adarsh/jenkins-mcp-go@latest

docker pull ghcr.io/2001adarsh/jenkins-mcp-go:latest

The image is built ongcr.io/distroless/static:nonroot— runs as a non-root user, ships with CA roots so HTTPS to Jenkins works out of the box, and is under 20 MB compressed. See theDocker MCP client setupsection for adocker run-based Claude Desktop config.

git clone https://github.com/2001adarsh/jenkins-mcp-go.git cd jenkins-mcp-go make build ./bin/jenkins-mcp -h 2>/dev/null || true # the server speaks MCP over stdio; -h prints nothing

{ "mcpServers": { "jenkins": { "command": "/usr/local/bin/jenkins-mcp", "env": { "JENKINS_URL": "https://jenkins.example.com", "JENKINS_USER": "your-username", "JENKINS_API_TOKEN": "your-api-token" } } } }

{ "mcpServers": { "jenkins": { "command": "docker", "args": [ "run", "--rm", "-i", "-e", "JENKINS_URL", "-e", "JENKINS_USER", "-e", "JENKINS_API_TOKEN", "ghcr.io/2001adarsh/jenkins-mcp-go:latest" ], "env": { "JENKINS_URL": "https://jenkins.example.com", "JENKINS_USER": "your-username", "JENKINS_API_TOKEN": "your-api-token" } } } }

-ikeeps stdin open (MCP speaks stdio);--rmcleans up the container after Claude Desktop disconnects. The console-log cache lives inside the container by default, so it's lost on restart — add-v "$HOME/.cache/jenkins-mcp:/home/nonroot/.cache/jenkins-mcp"and-e XDG_CACHE_HOME=/home/nonroot/.cacheto theargsarray if you want the cache to survive across sessions.

claude mcp add jenkins /usr/local/bin/jenkins-mcp \ --env JENKINS_URL=https://jenkins.example.com \ --env JENKINS_USER=your-username \ --env JENKINS_API_TOKEN=your-api-token

Any client that supports stdio MCP servers will accept a configuration of the form:

{ "command": "jenkins-mcp", "args": [], "env": { "JENKINS_URL": "https://jenkins.example.com", "JENKINS_USER": "your-username", "JENKINS_API_TOKEN": "your-api-token" } }

Once the server is registered, ask your agent things like:

- "What integration-test jobs do we have underBuilds/team?"→ callslist_jobswithfolder_path: "Builds/team",recursive: true,name_filter: "integration".
- "What was the result of build 86 ofBuilds/team/integration-tests?"→ callsget_build_info.
- "Show me the last 200 lines of the most recent run ofnightly."→ callsget_console_logwithtail_lines: 200.
- "Find every line matchingpanic|fatalin build 4521 with five lines of context."→ callssearch_console_logwithpattern: "panic|fatal",context_lines: 5.
- "Build 91 passed but 92 failed — what changed?"→ callscompare_buildswithbuild_a: 91,build_b: 92.
- "Which tests inBuilds/team/integration-testshave been flipping between pass and fail recently?"→ callsget_flaky_candidates.
- "Which commits in build 86 touched anything underinternal/auth/?"→ callsget_scm_contextwithpath_filter: "^internal/auth/".
- "Which Ginkgo specs failed in build 92 and what was the first error each emitted?"→ callsget_ginkgo_failure_summary.
- "Cache the full log for build 4521 so I can grep it locally."→ callsget_console_log_path; the agent then uses its ownRead/Grep/Bashtools on the returned path.

Only finished builds are cached (the writer requires Jenkins'Finished:marker), and the cache is evicted by LRU mtime once it exceedsJENKINS_MCP_CACHE_MAX. Files live inJENKINS_MCP_CACHE_DIR.

- No credential echo.The server never includes credentials in tool output, error messages, or cached files.
- Filesystem boundary.Cache filenames are sanitized; the cache directory is the only path the server writes to.

If you find a security issue, please followSECURITY.mdrather than opening a public issue.

make build / test / lint / fmt. SeeCONTRIBUTING.mdfor the full contributor guide anddocs/DEBUGGING.mdfor how to exercise the server locally with MCP Inspector.

- Go:1.23+
- Jenkins:any version that exposes the standard/api/json,/consoleText,/wfapi/describe,/testReport/api/jsonendpoints. Pipeline-specific tools require the Pipeline plugin.
- MCP:usesgithub.com/modelcontextprotocol/go-sdkv1.6+.

Install thejenkins-mcpbinary, then add it to your Claude Desktop or Claude Code MCP configuration with yourJENKINS_URL,JENKINS_USER, andJENKINS_API_TOKEN. SeeMCP client setupabove for the exact JSON / CLI snippets.

Yes. Any MCP client that supports stdio servers will accept the samecommand+envconfiguration shown in theMCP client setupsection.

Yes.get_ginkgo_failure_summaryparses Ginkgo'sSummarizing N Failureblock and surfaces the first[ERROR]line tagged with each spec name plus surrounding context — much faster than asking the agent to scan the whole log.

Is it safe to give an LLM API token access to Jenkins?

The server uses a single Jenkins user's API token (not a password), confined to oneJENKINS_URL. Combine withJENKINS_MCP_READONLY=1and a least-privilege Jenkins user for the safest default. SeeSECURITY.mdfor the full threat model.

fable-discipline is a Claude Code plugin that makes agentic software work follow repeatable working patterns: design before code, verify after edits, separate author from reviewer, preserve verified state between sessions, and report uncertainty honestly.