CircleCICAUTION
[DEPRECATED] This package is no longer maintained. Migrate to CircleCI's hosted MCP server or the CircleCI CLI MCP. See https://circleci.com/docs/guides/toolkit/circleci-mcp-overview/
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[!IMPORTANT] This package is deprecated. Please migrate.@circleci/mcp-server-circleciis no longer receiving feature work. Use CircleCI's hosted MCP server or the CircleCI CLI MCP instead — see the [CircleCI MCP overview](https://circleci.com/docs/guides/toolkit/circleci-mcp-overview/). This repository will be archived. Existing versions remain installable from npm, but running an unmaintained server that holds a CircleCI Personal API Token is not recommended. If you are running the self-managed remote transport (start=remote), migrate first: the hosted server is its direct replacement and removes the need to operate a network-facing service that brokers your org's token.
[](https://github.com/CircleCI-Public/mcp-server-circleci/blob/main/LICENSE) [](https://dl.circleci.com/status-badge/redirect/gh/CircleCI-Public/mcp-server-circleci/tree/main) [](https://www.npmjs.com/package/@circleci/mcp-server-circleci)
Model Context Protocol (MCP) is a new, standardized protocol for managing context between large language models (LLMs) and external systems. In this repository, we provide an MCP Server for CircleCI.
Use Cursor, Windsurf, Copilot, Claude, or any MCP-compatible client to interact with CircleCI using natural language — without leaving your IDE.
Tools
2195db070766OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server-circleci --env CIRCLECI_TOKEN=${CIRCLECI_TOKEN} --env MCP_ALLOW_UNAUTHENTICATED_NETWORK_ACCESS=${MCP_ALLOW_UNAUTHENTICATED_NETWORK_ACCESS} --env REQUIRE_REQUEST_TOKEN=${REQUIRE_REQUEST_TOKEN} -- npx -y @circleci/[email protected]{
"mcpServers": {
"mcp-server-circleci": {
"command": "npx",
"args": [
"-y",
"@circleci/[email protected]"
],
"env": {
"CIRCLECI_TOKEN": "${CIRCLECI_TOKEN}",
"MCP_ALLOW_UNAUTHENTICATED_NETWORK_ACCESS": "${MCP_ALLOW_UNAUTHENTICATED_NETWORK_ACCESS}",
"REQUIRE_REQUEST_TOKEN": "${REQUIRE_REQUEST_TOKEN}"
}
}
}
}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
production | read | Production environment |
Trust audit
CAUTIONgrade B · trust 88/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (17)
'System paths and hidden config directories (e.g. "/etc", "~/.ssh") are rejected.',
.prettierignore
expect(() => resolveSafeOutputDir('~/.ssh')).toThrow(UnsafePathError);['an ssh private key', '~/.ssh/id_rsa'],
['the ssh directory', '~/.ssh'],
['a hidden target', '/../.ssh/authorized_keys'],
['deep relative traversal', '../../../../../../../../etc'],
['/../../../../tmp/pwned', 'tmp_pwned'],
['x/../../../etc/cron.d/evil', 'x_.._.._.._etc_cron.d_evil'],
['deep traversal', '../../../../etc/evil.csv'],
import { getCircleCIClient } from '../../clients/client.js';expect(allowed.has('http://127.0.0.1')).toBe(true);expect(allowed.has('https://127.0.0.1')).toBe(true);expect(allowed.has('https://127.0.0.1:8000')).toBe(true);@modelcontextprotocol/sdk, express, parse-github-url, zod, zod-to-json-schema, @eslint/js, @types/node, @types/parse-github-url
When the server has `CIRCLECI_TOKEN` set and is started with `REQUIRE_REQUEST_TOKEN=false` (request auth is on by default and must be explicitly disabled, and a non-loopback bind additionally requires
- Fixed a path-traversal / arbitrary-file-write vulnerability in the tools that take a filesystem path. `outputDir` (`get_build_failure_logs`, `download_usage_api_data`) and `csvFilePath` (`find_under
Gates applied: no_behavioural_pass.
2195db070766full audit observations/trust-audit/mcp-server/circleci-public__circleci.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 2195db070766 | CAUTION | B | 88 | first audit |
Questions
What is the CircleCI MCP server?
[DEPRECATED] This package is no longer maintained. Migrate to CircleCI's hosted MCP server or the CircleCI CLI MCP. See https://circleci.com/docs/guides/toolkit/circleci-mcp-overview/
What tools does CircleCI expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is CircleCI safe to connect to an agent?
With care. The audit graded it B (88/100) and found 17 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does CircleCI need?
It reads CIRCLECI_TOKEN, MCP_ALLOW_UNAUTHENTICATED_NETWORK_ACCESS and REQUIRE_REQUEST_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does CircleCI run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @circleci/mcp-server-circleci at 0.20.0.
How current is this page?
The grade is for one exact copy of the source (2195db070766), read on 2026-10-07. The repository is watched and re-audited when it changes.