Skip to main content
Glama

depot-mcp: MCP server for Depot (depot.dev)

A read-only Model Context Protocol server for Depot, the container build and CI acceleration service. It gives a coding agent Depot's own answer to "why did CI fail?" and "why did this build fail?", plus the run history, cache effectiveness, registry contents, CI configuration, and usage data behind those answers.

CI npm MCP Registry License Node

Community project. Not affiliated with, endorsed by, or supported by Depot. Source-available under Apache 2.0 with the Commons Clause; see License.

Not to be confused with: The Home Depot, Chromium's depot_tools, Steam depots, Perforce depots, or any other "depot". This server talks only to api.depot.dev.

Contents

Related MCP server: deployment-intelligence-mcp

Why this exists

Depot ships a good agent story already, but it is not MCP. Depot's answer is Agent Skills: SKILL.md files that teach an agent to drive the depot CLI, plus a documented CI API and llms.txt. Depot's own post announcing Skills notes two limitations: skills work best in clients that implement the SKILL.md convention, and they are "sometimes notorious for not being automatically used by agents."

This server covers the gaps that leaves:

  • Agents without a shell. Skills require a logged-in depot binary on the machine. A tool call does not.

  • Clients that don't read SKILL.md. MCP is client-agnostic.

  • Reliable invocation. A registered tool with a description is discovered through the protocol rather than hopefully retrieved.

  • A read-only boundary. A skill cannot stop an agent from running depot ci rerun. This server can, and does; see Read-only model and security.

The flagship tool is a thin, careful wrapper around something Depot already built: GetFailureDiagnosis, a server-side failure analysis that clusters a run's failures by root cause and returns a diagnosis, a suggested fix, and the evidence lines, already bounded so it fits in a context window. Most of this server's value is exposing that well.

How it compares to Depot Agent Skills

Depot Agent Skills

depot-mcp

Needs the depot CLI installed and logged in

yes

no

Works in clients without SKILL.md support

no

yes

Invocation

agent must retrieve the skill

tool is listed in tools/list

Can mutate Depot (rerun, cancel, reset)

yes, anything the CLI can

no tool can

Output bounded for a context window

depends on the CLI command

every tool

Maintained by

Depot

community

As of 2026-09-05 no standalone Depot MCP server exists (first-party or otherwise, in the official registry, on npm, or on PyPI), and Depot's own guidance for agents without a shell is to call the CI API directly. This server is that API call, shaped for an agent.

Status

  • Read-only. v1 registers no tool that can change anything. There is no retry, cancel, rerun, dispatch, delete, or token-minting tool.

  • Depot CI is beta, per Depot's own documentation. The CI tools are the most valuable ones here and also the most likely to shift under you.

  • Publishing to npm is pending. The npx depot-mcp forms below will work once 0.1.0 is published; until then use the from a clone path. The name depot-mcp is unclaimed on npm and PyPI as of 2026-09-05.

  • MCP protocol revision 2025-11-25. This server is built on the @modelcontextprotocol/sdk 1.x line, which speaks 2025-11-25. The current spec revision is 2026-07-28, implemented by the v2 packages (@modelcontextprotocol/server 2.0.0, published 2026-07-28), which also serve 2025-11-25 clients. Every current client negotiates 2025-11-25, so nothing is lost today. Moving to v2 is a planned, contained change: the SDK is imported in nine files and the transport wiring lives in src/index.ts.

Prerequisites

  • Node.js 20 or newer (node --version). The Docker image needs no Node on the host.

  • A Depot Organization token. Depot dashboard, Organization Settings, API Tokens. A user token from depot login also works but spans every organization you belong to, so set DEPOT_ORG_ID too.

  • Project tokens will not work. Depot's own scope matrix excludes them from Depot CI and the API entirely.

Create a dedicated token for this server so you can revoke it independently. Depot has no read-only token scope; read the security section before you paste one anywhere.

Installation

Every client below runs the same command over stdio. The only things that vary are the file the config lives in and how that client lets you keep the token out of the file.

The generic config, which works as-is in Claude Desktop, Cursor, Windsurf, Cline, JetBrains, and most other clients:

{
  "mcpServers": {
    "depot": {
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "dp_your_organization_token"
      }
    }
  }
}

Add "DEPOT_ORG_ID": "..." to env if your token can see more than one organization. Every tool is prefixed depot_, and tool names are stable across releases.

Claude Code

claude mcp add depot --scope user --env DEPOT_TOKEN=dp_your_organization_token -- npx -y depot-mcp

Or commit a .mcp.json at the repository root so the whole team gets it. Claude Code expands ${VAR} and ${VAR:-default} in command, args, env, url, and headers, so the token stays in each developer's shell environment and out of git. Copy .mcp.json.example:

{
  "mcpServers": {
    "depot": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "${DEPOT_TOKEN}",
        "DEPOT_ORG_ID": "${DEPOT_ORG_ID:-}"
      }
    }
  }
}

Claude Code prompts on every MCP tool call regardless of readOnlyHint. To stop being asked, allow the read-only tools in .claude/settings.json: "permissions": { "allow": ["mcp__depot__*"] }.

Claude Desktop

Two options.

Extension bundle (one click). Download depot-mcp.mcpb from the releases page, open it with Claude Desktop (or Settings, Extensions, Advanced settings, Install extension), and paste the token into the settings form. The token field is marked sensitive in manifest.json, so Claude Desktop stores it in the OS keychain rather than in a JSON file.

Manual JSON. Edit ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows and add the generic config above.

Cursor

Install in Cursor

The button pre-fills the server; fill in DEPOT_TOKEN when Cursor shows the config. Or edit ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project). Cursor resolves ${env:NAME} in command, args, env, url, and headers, so a committed project file can read the token from the environment:

{
  "mcpServers": {
    "depot": {
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "${env:DEPOT_TOKEN}"
      }
    }
  }
}

VS Code and GitHub Copilot

Install in VS Code Install in VS Code Insiders

The buttons register the server and prompt for the token once, storing it as a VS Code secret. Equivalent .vscode/mcp.json (safe to commit: the token is an input, not a value):

{
  "inputs": [
    {
      "type": "promptString",
      "id": "depot-token",
      "description": "Depot Organization token (dp_...)",
      "password": true
    }
  ],
  "servers": {
    "depot": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "${input:depot-token}"
      }
    }
  }
}

Or from a terminal: code --add-mcp '{"name":"depot","command":"npx","args":["-y","depot-mcp"],"env":{"DEPOT_TOKEN":"dp_..."}}'. Copilot Chat in VS Code uses whatever is in mcp.json; use "MCP: Open User Configuration" for a user-level file.

GitHub Copilot coding agent

Repository Settings, Copilot, Coding agent, MCP configuration. Secrets must be Copilot environment secrets whose names start with COPILOT_MCP_:

{
  "mcpServers": {
    "depot": {
      "type": "local",
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "$COPILOT_MCP_DEPOT_TOKEN"
      },
      "tools": ["*"]
    }
  }
}

OpenAI Codex CLI

codex mcp add depot --env DEPOT_TOKEN=dp_your_organization_token -- npx -y depot-mcp

Or in ~/.codex/config.toml. env_vars forwards named variables from your shell so the token need not be written into the file:

[mcp_servers.depot]
command = "npx"
args = ["-y", "depot-mcp"]
env_vars = ["DEPOT_TOKEN", "DEPOT_ORG_ID"]

Gemini CLI

gemini mcp add -e DEPOT_TOKEN=dp_your_organization_token depot npx -y depot-mcp

Or in ~/.gemini/settings.json. Gemini CLI expands $VAR and ${VAR} inside env:

{
  "mcpServers": {
    "depot": {
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "$DEPOT_TOKEN"
      }
    }
  }
}

Windsurf

~/.codeium/windsurf/mcp_config.json, or Windsurf Settings, Cascade, MCP Servers, Manage. Use the generic config above.

Zed

settings.json:

{
  "context_servers": {
    "depot": {
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "dp_your_organization_token"
      }
    }
  }
}

Cline

Cline panel, MCP Servers, Configure (or ~/.cline/mcp.json for the CLI). The generic config works; Cline also accepts "disabled": false and "autoApprove": ["depot_whoami", "depot_diagnose_ci_failure"] per server.

JetBrains AI Assistant

Settings, Tools, AI Assistant, Model Context Protocol (MCP), Add, then paste the generic config as JSON. If you already configured Claude Desktop, "Import from Claude" picks it up.

Docker

No Node.js on the host. The image is stdio, so -i is required and -t must not be used. Pass the token from your environment rather than on the command line:

docker build -t depot-mcp .
export DEPOT_TOKEN=dp_your_organization_token
docker run -i --rm -e DEPOT_TOKEN -e DEPOT_ORG_ID depot-mcp

Client config for the image:

{
  "mcpServers": {
    "depot": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "DEPOT_TOKEN", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "dp_your_organization_token"
      }
    }
  }
}

A published image at ghcr.io/akshayjain3450/depot-mcp and a Docker MCP Catalog entry are planned; see Where to find it.

From a clone

Works today, before the npm publish:

git clone https://github.com/akshayjain3450/depot-mcp.git
cd depot-mcp
npm install
npm run build

Then replace "command": "npx", "args": ["-y", "depot-mcp"] in any block above with "command": "node", "args": ["/absolute/path/to/depot-mcp/dist/index.js"]. For Claude Code:

claude mcp add depot --env DEPOT_TOKEN=dp_your_organization_token -- node /absolute/path/to/depot-mcp/dist/index.js

Checking it works

npx @modelcontextprotocol/inspector npx -y depot-mcp      # or: node dist/index.js

Then, from your agent, ask it to call depot_whoami. That confirms the token, reports which organizations and projects it can see, and warns about the organization ambiguity described under Configuration.

The binary also answers two flags without needing a token:

npx depot-mcp --version   # prints the version from package.json
npx depot-mcp --help      # usage, environment variables, exit codes

Importing the package (import { createServer } from 'depot-mcp') gives you the server factory without starting anything; only the depot-mcp binary opens stdio.

Compatibility

The server speaks stdio only. Anything that can launch a local process and talk MCP 2025-11-25 (or negotiate down to it) works. "Tested" means exercised end to end by a maintainer with a real token; "verified" means the config shape was checked against the vendor's documentation on 2026-09-05 but not run.

Client

Transport

Status

Notes

MCP Inspector

stdio

tested

npm run inspect

CI stdio smoke (initialize + tools/list)

stdio

tested

runs on every commit, Node 20 and 22

Claude Code

stdio

verified

${VAR} expansion in .mcp.json; prompts per call unless allowlisted

Claude Desktop

stdio, .mcpb

verified

honours readOnlyHint for auto-approval

Cursor

stdio

verified

${env:VAR}; one-click deeplink

VS Code / Copilot Chat

stdio

verified

inputs keep the token out of the file; one-click link

GitHub Copilot coding agent

stdio (type: local)

verified

secrets must be prefixed COPILOT_MCP_

OpenAI Codex CLI

stdio

verified

env_vars forwards from the shell

Gemini CLI

stdio

verified

$VAR expansion in env

Windsurf

stdio

verified

generic config

Zed

stdio

verified

context_servers key

Cline

stdio

verified

autoApprove per tool

JetBrains AI Assistant

stdio

verified

can import Claude Desktop config

Docker (any client)

stdio via docker run -i

verified

image built in CI; distroless runtime

Streamable HTTP / remote

not offered

the token would leave the machine; see Security

If you run it somewhere not listed, open an issue with the client name and the config that worked.

Where to find it

Planned distribution, in order of usefulness. Items marked pending need the npm publish first.

Channel

Identifier

Status

npm

depot-mcp

pending (release.yml publishes with provenance on a v* tag)

Official MCP Registry

io.github.akshayjain3450/depot-mcp (server.json)

pending; mcp-publisher publish after npm

Claude Desktop extension

depot-mcp.mcpb on GitHub releases (manifest.json)

pending

Docker MCP Catalog

PR to docker/mcp-registry with a server.yaml pointing at this repo's Dockerfile

pending

GitHub Container Registry

ghcr.io/akshayjain3450/depot-mcp

pending

Smithery

listing only; Smithery dropped hosted stdio servers in September 2025, and this server is stdio by design

pending

Glama, PulseMCP, awesome-mcp-servers

directory listings

pending

Never look for it under @depot/* or dev.depot/*; those namespaces belong to Depot, and this project is not theirs.

Configuration

Every setting is an environment variable, set in your client's config.

Variable

Required

Default

Purpose

DEPOT_TOKEN

yes

Depot API token. Must be a single line of printable ASCII; a line break copied from a wrapped terminal is rejected at startup without echoing the value. The server refuses to start without it (exit code 78).

DEPOT_ORG_ID

no

Sent as x-depot-org. Set this if your token can see more than one organization (see below).

DEPOT_PROJECT_ID

no

Default container-build project, so build tools can be called without one.

DEPOT_API_URL

no

https://api.depot.dev

Override the API endpoint. Must be https://; plain http:// is accepted only for localhost, for running against a stub.

DEPOT_MCP_MAX_LOG_PAGES

no

20

Cap on log/step pages fetched per tool call, so one call can't walk a gigabyte of logs.

DEPOT_MCP_OUTPUT_BUDGET

no

24000

Hard character ceiling on any single tool result.

DEPOT_MCP_ALLOW_WRITES

no

0

Reserved for a future version; currently a no-op. The gate exists so mutating tools can be added later without reworking registration. v1 defines none, so setting this changes nothing; depot_whoami will say so.

Each Depot API call has an overall deadline of about 40 seconds, with a bounded number of retries (exponential backoff) for unavailable, deadline_exceeded, aborted, and 429 responses. invalid_argument, not_found, permission_denied, and failed_precondition are never retried. A tool that makes several calls (log paging, build diagnosis) can therefore take longer than one deadline; it reports partial results rather than failing outright when a later page times out.

The organization gotcha

This is the single most confusing Depot failure mode, and Depot's own Agent Skill calls it out. A user token spans every organization you belong to. When more than one is visible and DEPOT_ORG_ID is unset, requests resolve against one organization and everything in the others reads as empty rather than as an error. If a list looks wrongly empty, call depot_whoami; it detects exactly this and tells you what to set.

Tools

All 16 tools are prefixed depot_, named depot_<verb>_<noun>, and annotated readOnlyHint: true and destructiveHint: false. Names are stable: a rename or removal is a breaking change and will be listed in CHANGELOG.md.

Diagnosis (start here)

Tool

Answers

depot_diagnose_ci_failure

Why did this CI run/workflow/job/attempt fail? Clustered root causes, AI diagnosis, suggested fix, evidence lines.

depot_diagnose_build

Why did this container build fail? Locates the failing step, returns its error and log tail, plus cache effectiveness. Reports logPageCapHit and logNextPageToken when the step's output was longer than the page cap allowed.

depot_whoami

Is my token valid, and what can it see? Diagnoses the organization ambiguity above, and warns when DEPOT_ORG_ID names an organization the token cannot see.

Depot CI

Tool

Answers

depot_list_ci_runs

Which runs happened recently, and which failed? Filter by status, repo, SHA, trigger, PR.

depot_get_ci_run

What is this run's workflow, job, and attempt tree, and which node broke?

depot_get_ci_logs

Bounded raw logs for an attempt: tail by default, grep/step/stream filters, forward paging with an exact cursor. Filters run in this server after fetching, so grep still reads up to DEPOT_MCP_MAX_LOG_PAGES pages. When the page cap stops the walk the result says the log continues, and pageCapHit plus nextPageToken let you carry on; it never labels the middle of a log as its tail. Line bodies are capped at 2000 characters (bodyTruncated).

depot_get_ci_job_summary

What did the job publish about itself (the $GITHUB_STEP_SUMMARY equivalent)?

depot_get_ci_metrics

Was this an OOM kill or CPU starvation? CPU/memory for a run, job, or attempt.

depot_list_ci_artifacts

What did the run upload, and what is its signed download URL? Accepts pageToken.

depot_list_ci_secrets

Which CI secrets exist and where do they apply? Names and scoping only; Depot never returns secret values.

depot_list_ci_variables

Which CI variables exist, with values and scoping. Credential-shaped values are redacted (see below).

Container builds, projects, registry, usage

Tool

Answers

depot_list_builds

Recent container builds with duration and cache hit ratio.

depot_list_projects

Which build projects exist, in which region, on what hardware, with which cache policy? Accepts pageToken.

depot_get_project

One project's full config plus its OIDC trust policies.

depot_list_images

What is in this project's registry, with digests and sizes?

depot_get_usage

What is driving spend? Build minutes, minutes saved by cache, GitHub Actions runner minutes, storage, sandboxes. Dates are UTC; a date-only endAt includes that whole day.

Prompts

Two prompts chain these into common workflows: diagnose-latest-failure (find the last failed run, diagnose it, propose a fix) and explain-build-slowness (builds plus usage: is it cache misses or more work?).

Output is always bounded

Every tool caps its own output and tells the agent when it truncated:

  • Log tools page forward into a ring buffer and return the tail, since GetJobAttemptLogs pages oldest-first with no tail parameter.

  • depot_diagnose_ci_failure propagates Depot's own bounds object as plain-language notes, and distinguishes what Depot dropped from what this server dropped, so a partial diagnosis never looks complete.

  • Every result respects DEPOT_MCP_OUTPUT_BUDGET.

Read-only model and security

Read the first point carefully.

  • Depot has no read-only token scope. An Organization token that can call ListRuns can also call CancelRun, RerunWorkflow, and DeleteProject. Nothing about the credential you hand this server makes it safe. This server's tool registration is the entire safety boundary: it is read-only because it defines no mutating tool, not because the token is restricted. Treat readOnlyHint as a hint to the client, not as enforcement.

  • Some operations are permanently out of scope, not merely deferred: ProjectService/ResetProject (deletes all cached data; a plausible-sounding "fix" with an irreversible, invisible, expensive blast radius), CIService/Run (executes arbitrary workflow content on your infrastructure), token and secret writes (CreateToken returns the secret, which would land in a transcript), image and tag deletion, and ShareBuild (creates a public URL; data exposure disguised as a read).

  • The token is never logged, echoed, or written to disk. It is read from the environment only, never printed in errors or in depot_whoami. Error messages from the transport layer and from Depot's own error envelopes are scrubbed of the token before they reach the model, in case a misconfigured endpoint echoes request headers. This server does not read ~/.config/depot/depot.yaml, so it cannot pick up ambient credentials you did not intend to give it.

  • CI variable values are scrubbed. Depot withholds secret values server-side, but returns variable values verbatim, and variables get misused as secret storage. Values whose name or content looks like a credential are replaced with a placeholder, and the result reports which rule fired so you still know the variable exists.

  • Create a dedicated Organization token for this server so you can revoke it independently.

  • stdio only, no listening port. The token crosses no network boundary other than TLS to api.depot.dev.

  • CI logs are untrusted text. Log lines, step summaries, artifact names, variable values, and Depot's AI diagnoses are derived from repository content, so anyone who can push to a repository that runs on Depot CI can put words in them. This server returns them; it does not act on them. Your agent might. Summaries fence that text between --- begin untrusted CI content --- and --- end untrusted CI content ---, label Depot's diagnosis and suggested fix as unverified, and carry a contentWarning field in structured output. The server instructions tell the model to treat it as data, never as commands.

  • Depot stores CLI credentials in plaintext at ~/.config/depot/depot.yaml (mode 0600), not the OS keychain. Relevant if you copy a token from there.

How clients treat the annotations differs: Claude Desktop uses readOnlyHint for auto-approval, Claude Code prompts on every call unless the tool is allowlisted, and Cursor uses its own run modes. Report security problems as described in SECURITY.md.

Limitations

  • Container builds cannot be started through Depot's API at all, by anyone. Running a build means acquiring an mTLS BuildKit endpoint and transferring the local build context; the depot CLI embeds a BuildKit fork to do it. Builds here are observability only. A human runs depot build, or CI does.

  • depot.ci.v1 has reference docs but no published schema. It is absent from both depot/proto and the Buf Schema Registry. There is nothing to generate types from and nothing to diff for breaking changes. Rather than assert a contract nobody publishes, responses are read through tolerant accessors that accept either camelCase or snake_case, handle protobuf's int64-as-string encoding, and strip enum name prefixes. Missing fields degrade to "unknown" instead of crashing.

  • depot_get_ci_metrics returns Depot's raw document alongside the fields it recognises, because Depot documents that these RPCs return CPU and memory summaries without publishing their field names.

  • depot.ci.v3beta2 is beta in its name. The secrets and variables tools are the most breakage-prone. Their list filters are undocumented, so filtering happens in this server and the request sent to Depot is empty.

  • No log streaming. Depot caps concurrent log streams per token and per organization, and a careless streaming tool could exhaust that for your whole org, including your real CI. This server polls the unary GetJobAttemptLogs instead, which Depot's docs explicitly bless.

  • There is no wait_for_run_to_finish tool, deliberately. Long polls fit badly inside a tool-call timeout. Ask for status again instead; the agent can poll across turns.

Architecture

flowchart LR
    Client["MCP client<br/>(Claude Code, Cursor, VS Code, Codex, ...)"]
    Server["depot-mcp<br/>node dist/index.js"]
    API["api.depot.dev<br/>Connect JSON over HTTPS"]

    Client -- "JSON-RPC over stdio<br/>tools/list, tools/call, prompts" --> Server
    Server -- "POST /depot.ci.v1.CIService/GetFailureDiagnosis<br/>Authorization: Bearer DEPOT_TOKEN<br/>x-depot-org: DEPOT_ORG_ID" --> API
    API -- "JSON, read through tolerant accessors" --> Server
    Server -- "text summary + structuredContent,<br/>capped by DEPOT_MCP_OUTPUT_BUDGET" --> Client

One process, one credential, no listening port, no protobuf toolchain. Depot's Connect binding is plain JSON over HTTP POST, so the client is a fetch wrapper with retry. Tools are one module each under src/tools/; shared helpers (budget, redact, resolve, ci-target) keep them small and their output predictable. Design notes, the Depot API survey, and the prior-art review live in docs/ and research/.

Troubleshooting

Symptom

Cause and fix

Server exits immediately with code 78

DEPOT_TOKEN is unset or empty. The client's env block is the usual place it went missing.

Every list is empty but the token is valid

Multi-organization token without DEPOT_ORG_ID. Call depot_whoami; it names the organizations it can see.

permission_denied or unauthenticated

Project token (not supported), a revoked token, or the wrong organization. depot_whoami distinguishes them.

depot_diagnose_ci_failure returns state: empty

The run had no failures Depot could cluster, or the ID is not a failed run. depot_list_ci_runs with status: ["failed"] finds one.

state: over_limit

The target is too broad. The result lists narrowerTargets; re-call with a workflow or job ID.

Result says truncated: true

Expected. Use the hint in the result (narrower filter, grep, pageToken) or raise DEPOT_MCP_OUTPUT_BUDGET.

Client shows "response was interrupted" or context errors

The client's own MCP output cap. Prefer the diagnose tools over raw logs, lower tailLines, or use grep.

npx hangs on first run

It is downloading the package. Run npx -y depot-mcp once in a terminal, then restart the client.

Nothing in the client but the Inspector works

stdout must carry only JSON-RPC. If you added logging, send it to stderr.

429 resource_exhausted

Depot's per-token or per-organization limit. Wait; the server already backs off and retries.

deadline_exceeded after about 40 seconds

Depot did not answer within the per-call deadline. Retry; if it persists, narrow the request (fewer pages, a job instead of a run).

DEPOT_API_URL must be an https URL

Only https:// endpoints are accepted, except http://localhost for a local stub.

The server writes one line to stderr on startup (depot-mcp 0.1.0 ready on stdio ...); most clients show stderr in their MCP logs.

Development

npm install
npm run typecheck   # tsc --noEmit, strict
npm run lint        # eslint with type-aware rules
npm test            # vitest, no network or Depot account needed
npm run build       # emit dist/
npm run inspect     # build, then open the MCP Inspector
npm run smoke:stdio # handshake + tools/list against dist/, no token needed

Tests drive a real Client against a real McpServer over the SDK's InMemoryTransport, with fetch stubbed to return recorded fixtures in test/fixtures/. They assert the full round trip: input validation, output-schema conformance, annotations, character budgets, and error translation. The fixtures cover all four GetFailureDiagnosis states (focused_failure, grouped_failures, over_limit, empty), empty results, and Connect error envelopes.

Live check against your own Depot organization

DEPOT_TOKEN=dp_your_organization_token npm run smoke

This runs read-only calls only, prints what it found, and reports which checks passed, failed, or were skipped. It skips the failure-diagnosis check if your organization has no failed run to analyse; without one, the flagship tool cannot be exercised.

Layout

src/
  index.ts          entrypoint: config, stdio transport
  server.ts         McpServer construction and instructions
  config.ts         environment resolution, fail-fast validation
  prompts.ts        the two chained workflows
  depot/
    client.ts       fetch against Depot's Connect JSON binding, with retry
    api.ts          typed RPC surface
    errors.ts       Connect error codes -> actionable messages
    shape.ts        tolerant accessors for an unpublished schema
  lib/
    tool.ts         registration, validation, error translation in one place
    budget.ts       character budgets and truncation
    diagnosis.ts    parsing and shaping the GetFailureDiagnosis document
    ci-tree.ts      run -> workflow -> job -> attempt parsing
    ci-target.ts    loose identifier resolution
    redact.ts       credential scrubbing
    build.ts  project.ts  resolve.ts  time.ts
  tools/            one module per tool group; index.ts holds the write gate
test/               vitest: unit, tool round-trips over InMemoryTransport, fixtures
docs/               design notes and distribution details
research/           the API and design research this was built from
.github/            CI, release, smoke and metadata scripts, templates
server.json         MCP Registry entry      manifest.json   Claude Desktop .mcpb manifest
Dockerfile          distroless stdio image  .mcp.json.example  Claude Code project config

research/ documents the Depot API, the MCP design decisions, and the prior-art survey this implementation follows. It is worth reading before changing anything non-obvious.

Contributing

Read CONTRIBUTING.md first. The short version: keep it read-only, keep the token out of everything, keep output bounded, test through the MCP client harness, and sign off your commits (git commit -s). Bug reports and feature requests have templates; security issues go through SECURITY.md, not the issue tracker.

License

Apache License 2.0 with the Commons Clause License Condition v1.0. See LICENSE and NOTICE.

In plain words, you may:

  • use it, at home or at work, including inside commercial CI pipelines and paid products that happen to use Depot;

  • modify it, fork it, and redistribute it, as long as the LICENSE and NOTICE files travel with it;

  • contribute changes back under the same terms.

You may not:

  • sell it, charge for hosting it, or offer a paid product or service whose value comes entirely or substantially from this server's functionality.

Because of the Commons Clause this is source-available, not open source under the OSI definition. Everything else in Apache 2.0 (patent grant, no warranty, attribution) applies unchanged.

Depot is a trademark of its owner. This project is unaffiliated with Depot Technologies Inc.

Available Tools

16 tools
depot_diagnose_buildDiagnose a Depot container build failureA
Read-onlyIdempotent

Explain why a Depot container build failed: locate the step that broke and return its error and the tail of its logs, alongside cache effectiveness for the build.

Use this for "why did my docker build fail". Unlike Depot CI, container builds have no server-side AI diagnosis, so this tool does the legwork an agent would otherwise do by hand: read the build, page through its steps, pick the step that reported an error (or the last step that actually executed), and fetch only that step's logs.

Pass projectId when you know it. Depot's build record does not include a project id and the steps API requires one, so without it this tool has to scan recent builds across your projects, which costs several extra requests. DEPOT_PROJECT_ID works as a default.

Also reports cachedSteps vs totalSteps and secondsSaved, which is the fastest way to see whether a slow build is a cache miss problem rather than a code problem.

Read-only: this cannot start, retry, or cancel a build. Container builds cannot be triggered through Depot's API at all — a human runs "depot build" locally, or CI runs it.

ParametersJSON Schema
NameRequiredDescriptionDefault
buildIdYesThe build id, as shown by depot_list_builds or the Depot dashboard.
projectIdNoThe project that owns the build. Strongly preferred: without it the server has to search.
tailLinesNoHow many trailing log lines to return from the failing step.

Output Schema

ParametersJSON Schema
NameRequiredDescription
buildYes
notesYes
logTailYes
projectIdYes
stepCountYes
failingStepNo
cacheSummaryYes
logTruncatedYes
logPageCapHitYes
logNextPageTokenNo
logLinesTruncatedYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavioral detail beyond the readOnlyHint and destructiveHint annotations: it cannot start, retry, or cancel a build; container builds cannot be triggered through Depot's API at all; and without a projectId it scans recent builds at extra request cost. These are meaningful, non-obvious traits that help an agent predict side effects and performance.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average, but every sentence earns its place: purpose, usage trigger, differentiation from CI, parameter guidance, output significance, and safety guarantees. It is front-loaded with the core purpose and organized so the most actionable guidance appears early.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with an output schema, documented parameters, and read-only/idempotent annotations, the description still fills the remaining context: when to reach for it, why it exists, what operational costs to expect, and what the cache metrics mean. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though the schema already documents all three parameters at 100% coverage, the description adds critical semantics for projectId: the build record lacks the project id, the steps API requires it, and omitting it triggers extra scanning requests. It also clarifies what buildId is by referencing depot_list_builds and the dashboard, and ties tailLines to the log-tail behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and outcome: 'Explain why a Depot container build failed' and then details exactly what it returns (failing step, error, log tail, cache stats). It clearly distinguishes itself from CI diagnosis with 'Unlike Depot CI, container builds have no server-side AI diagnosis.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use the tool: "Use this for 'why did my docker build fail'." It also explains the alternative context, noting the difference from Depot CI, and gives concrete operational guidance about passing projectId, including the DEPOT_PROJECT_ID default and the cost of omitting it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_diagnose_ci_failureDiagnose a Depot CI failureA
Read-onlyIdempotent

Explain why a Depot CI run, workflow, job, or attempt failed.

Reach for this first whenever someone asks why CI failed, what broke the build, or to fix a failing job. It calls Depot's server-side failure analysis, which clusters every failure in the target by root cause and returns, for each cluster: the error message, an AI-written diagnosis, a suggested fix, and the exact log lines that are the evidence.

Prefer this over depot_get_ci_logs. Depot bounds this response server-side, so it costs far less context than raw logs, and it already works out which job is the real root cause rather than a downstream casualty. Use depot_get_ci_logs afterwards only if you need more detail on a specific attempt.

Pass whichever identifier you have in "id" — a run, workflow, job, or attempt ID. This server works out which kind it is; set "targetType" only when you already know it and want to skip that step.

How to read the returned "state":

  • "focused_failure": one clear culprit. Read representativeAttempts.

  • "grouped_failures": several distinct root causes, clustered by fingerprint. Read failureGroups.

  • "over_limit": too many failures to analyse at this level. narrowerTargets gives the IDs to call this tool again with.

  • "empty": Depot found no failure evidence. The target may still be running, may have succeeded, or may be old enough that its logs have aged out.

Diagnoses and suggested fixes are generated by Depot's AI and can be wrong — treat them as a lead to verify, not a fact. Read-only: this never retries, cancels, or triggers anything.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesA Depot CI identifier: a run, workflow, job, or attempt ID. Pass whatever you have — the server resolves which kind it is.
targetTypeNoWhat kind of thing "id" refers to. Omit unless you know it; the server otherwise infers it, falling back to trying each kind in turn.
maxEvidenceLinesNoCap on evidence log lines per failing attempt. Set 0 to get diagnoses and fixes without any log lines.
maxFailureGroupsNoCap on how many clustered root causes to return. Raise only if 5 was not enough.

Output Schema

ParametersJSON Schema
NameRequiredDescription
stateYesOne of focused_failure, grouped_failures, over_limit, empty, or unknown.
targetYes
contextYes
nextStepsYesDepot's suggested follow-ups, rewritten as calls to this server's tools.
truncationYes
emptyReasonNo
aiDisclosureNo
failureGroupsYes
contentWarningYesReminder that names, log lines, and diagnoses here are unverified CI output.
narrowerTargetsYesPresent when state is over_limit: narrower ids to re-run this tool against.
resolvedTargetTypeYesThe target kind that Depot accepted for this id.
representativeAttemptsYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint and idempotentHint, and the description reinforces this with "Read-only: this never retries, cancels, or triggers anything." It also discloses that diagnoses are AI-generated and can be wrong, and explains the server-side bounding behavior that limits context cost.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured into clearly labeled sections: purpose, when to use, parameter guidance, how to read the returned state, and a caution about AI-generated content. Every paragraph earns its place and the most important guidance is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description correctly focuses on interpretation rather than raw return format. It explains all meaningful states, gives actionable guidance for each, names the sibling tool to use afterward, and warns about reliability. Nothing essential is missing for correct invocation and response interpretation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaningful guidance beyond the schema by explaining that "id" accepts any identifier kind and the server resolves it, and that "targetType" is only needed to skip inference. This is valuable semantic context not present in the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: "Explain why a Depot CI run, workflow, job, or attempt failed." It clearly distinguishes this diagnostic tool from log retrieval and other CI tools by emphasizing root-cause analysis over raw logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says "Reach for this first whenever someone asks why CI failed" and names the alternative with a clear preference rule: "Prefer this over depot_get_ci_logs" and use logs only for more detail on a specific attempt. This leaves no ambiguity about when to choose this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_ci_job_summaryGet a Depot CI job step summaryA
Read-onlyIdempotent

Read the step summary a Depot CI job authored for itself — the equivalent of GitHub Actions' $GITHUB_STEP_SUMMARY.

This is markdown the job's own steps chose to publish: test result tables, coverage deltas, lint counts, deployment URLs. When a job writes one, it is usually a far better explanation of what happened than its logs, because a human decided what mattered.

Most jobs write nothing here, and an empty result is normal rather than an error. If it comes back empty, use depot_diagnose_ci_failure for a failure, or depot_get_ci_logs for raw output.

"id" accepts an attempt id, a job id, or a run id.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesAn attempt id, job id, or run id.
targetTypeNoWhat "id" refers to. Omit to let the server work it out.

Output Schema

ParametersJSON Schema
NameRequiredDescription
emptyYes
targetYes
markdownYes
truncatedYes
contentWarningYesReminder that the markdown was authored by the job itself and is unverified.
originalLengthYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool readOnly, idempotent, and non-destructive; the description adds meaningful behavior beyond that: the summary is job-authored markdown and 'an empty result is normal rather than an error.' This prevents misinterpreting empty output as failure and clarifies the accepted id forms (attempt, job, or run id). No contradiction with annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every paragraph earns its place: purpose, interpretation/value, empty-result handling with sibling routing, and id flexibility. The first sentence is front-loaded with the exact operation, and there is no redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 100% schema coverage, an output schema, and strong annotations, the description covers purpose, usage context, empty behavior, alternatives, and id semantics. An agent has enough information to call the tool correctly and interpret the result without further inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema coverage is 100%, including an enum for targetType and a clear description for id. The description mostly restates the id flexibility without adding syntax or format details beyond the schema. Baseline 3 is appropriate because the schema carries the parameter-semantics weight.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names a specific verb ('Read'), a concrete resource ('step summary a Depot CI job authored for itself'), and anchors it to a familiar GitHub Actions concept ($GITHUB_STEP_SUMMARY). This clearly differentiates the tool from log- or run-level tools like depot_get_ci_logs or depot_get_ci_run even before reading the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells the agent that an empty result is normal and should not be treated as an error. It then routes to siblings: use depot_diagnose_ci_failure for a failure and depot_get_ci_logs for raw output, which is clear when-to-use vs alternatives guidance. It also explains why the summary is preferable to logs when present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_ci_logsGet Depot CI job logsA
Read-onlyIdempotent

Fetch a bounded slice of the persisted logs for a Depot CI job attempt.

Try depot_diagnose_ci_failure first. It is cheaper, it already contains the relevant log lines with a diagnosis attached, and it identifies which job actually broke. Use this tool when you need detail the diagnosis did not include: the full traceback, output from a step that did not fail, or a specific pattern.

Defaults to the last 200 matching lines, because failures land at the end of a log. "grep" (case-insensitive substring, not a regex), "stepKey" and "stream" are applied by this server after it fetches pages from Depot, so they reduce what you receive but not what is read: a grep still walks the log page by page, up to DEPOT_MCP_MAX_LOG_PAGES pages (default 20), and is the most expensive way to use this tool. Prefer stepKey or stream, which at least keep the returned window small.

"id" accepts an attempt id, a job id, or a run id. Given a run id this picks that run's failed job (or its last job) and reads the latest attempt, mirroring what "depot ci logs" does.

Paging contract:

  • Without a pageToken you get the tail: the last "tailLines" matching lines of what was read. If the page cap stops the walk first, the result says so, the lines are the end of what was read rather than the end of the log, and nextPageToken continues forward from there.

  • With a pageToken you get the next window forward: up to "tailLines" lines in order from that point, and a new nextPageToken if more remain. Nothing in a forward window is ever dropped for the character budget; the window just closes early and the token resumes at the exact next line, so following nextPageToken until it is absent yields every line exactly once. That is how to follow a running job's output across turns.

  • Pass tokens back verbatim. Some are issued by this server rather than Depot; both are opaque.

  • Each line body is capped at 2000 characters ("bodyTruncated" marks the ones that were cut).

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesAn attempt id, job id, or run id. Attempt ids give the most precise result.
grepNoCase-insensitive substring filter applied to line bodies by this server after fetching. Not a regular expression.
streamNoKeep only one output stream. stderr alone is often enough to spot a failure.
stepKeyNoKeep only lines from this step, as reported in a line's stepKey.
pageTokenNoContinue forward from a previous nextPageToken instead of returning the tail. Use this to poll a running job or to read a log from the start.
tailLinesNoMaximum log lines per call: the last N of what was read without a pageToken, the next N forward with one.
targetTypeNoWhat "id" refers to. Omit to let the server work it out.
includeTimestampsNoPrefix each rendered line with its ISO timestamp. Costs context; usually not needed.

Output Schema

ParametersJSON Schema
NameRequiredDescription
linesYes
notesYes
targetYes
truncatedYes
pageCapHitYes
linesMatchedYes
pagesFetchedYes
linesReturnedYes
nextPageTokenNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description massively exceeds what the annotations (readOnlyHint, idempotentHint, destructiveHint) already provide: it discloses that grep is applied server-side after page fetches so it reduces received data but not read data, warns that grep walks up to DEPOT_MCP_MAX_LOG_PAGES pages and is the most expensive mode, documents the paging contract in full (tail vs forward, page-cap early stop, exact-line resumption), requires tokens to be passed back verbatim, and caps line bodies at 2000 chars with a bodyTruncated marker. This is deep behavioral disclosure with no contradiction against the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long, but every paragraph earns its place: purpose, sibling routing, filtering-cost model, id polymorphism, and the paging contract are all dense operational content rather than filler. It is front-loaded with purpose and the 'try depot_diagnose_ci_failure first' guidance, and the paging contract is given as a structured bulleted list, making it easy for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 8 parameters, a two-mode paging contract, polymorphic id handling, and an output schema; the description covers all of it, including defaults, the page cap, truncation markers, and even the cross-turn polling pattern ('following nextPageToken until it is absent yields every line exactly once'). With the output schema already present, no crucial invocation detail is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though schema description coverage is 100% and the baseline is therefore 3, the description adds essential meaning beyond every parameter: id's polymorphic behavior (run id picks the failed or last job and reads the latest attempt), the cost differential between grep versus stepKey/stream, the paging semantics that give pageToken and tailLines their meaning, and the context-cost warning on includeTimestamps ('Costs context; usually not needed'). These semantics are required to invoke the tool correctly and reside only in the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line 'Fetch a bounded slice of the persisted logs for a Depot CI job attempt' names a precise verb, resource, and scope, and the 'bounded slice' qualifier distinguishes this from a generic 'get all logs' tool. It also explicitly names depot_diagnose_ci_failure as the sibling it is not, so an agent can route correctly without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states unambiguously when to prefer the alternative ('Try depot_diagnose_ci_failure first') with concrete reasons why it is cheaper and what it contains, then gives exact conditions for using this tool ('when you need detail the diagnosis did not include: the full traceback, output from a step that did not fail, or a specific pattern'). This is fully explicit when/to-when-not guidance with a named alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_ci_metricsGet Depot CI CPU and memory metricsA
Read-onlyIdempotent

Read CPU and memory metrics for a Depot CI run, job, or job attempt.

Use this when a job died without a useful error, was killed abruptly, hit an exit code like 137, or is simply slow — the shapes to look for are memory sitting at its limit (an OOM kill) or CPU pinned at 100% for the whole job (under-provisioned runner).

"id" accepts a run, job, or attempt id and the level is inferred; set "level" to pick explicitly. Note that metrics for a still-running attempt grow between calls, so a snapshot time is reported.

Depot does not publish field names for these responses, so this tool returns the metrics it recognises plus the raw document (bounded) so nothing is lost. Very large metrics results are rejected by Depot itself with a resource-exhausted error — ask for a single attempt rather than a whole run if that happens.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesA run id, job id, or attempt id.
levelNoWhich level "id" refers to. Omit to infer; the server otherwise tries run, then job, then attempt.

Output Schema

ParametersJSON Schema
NameRequiredDescription
idYes
levelYes
metricsYes
rawJsonYesDepot's metrics document as JSON text, truncated if large.
likelyOomNo
rawTruncatedYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only and idempotent, and the description adds meaningful behavioral context: metrics for a running attempt change between calls, a snapshot time is reported, and the response includes the raw document because Depot publishes no field names. It also discloses the resource-exhausted failure mode and a workaround.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then flows from usage triggers to parameter behavior to response shape and failure handling. Every sentence adds information; no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description does not need to enumerate return fields, and it still covers param semantics, changing-data behavior, response composition, and error handling. An agent has enough context to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds important semantic detail: the level is inferred when omitted, and the server tries run, then job, then attempt. This goes beyond the schema's parameter descriptions and clarifies how 'level' and 'id' interact.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Read CPU and memory metrics for a Depot CI run, job, or job attempt.' The stated use cases (OOM kills, exit 137, under-provisioned runner) set it apart from sibling tools like depot_get_ci_logs and depot_get_ci_job_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly instructs when to use the tool: when a job died without a useful error, was killed, hit exit 137, or is slow. It gives diagnostic patterns (memory at limit, CPU pinned) but does not name specific sibling alternatives or say when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_ci_runGet a Depot CI run treeA
Read-onlyIdempotent

Show one Depot CI run as its workflow -> job -> attempt tree, with the status of every node and the ids needed to drill in.

Use this to see the shape of a run: which jobs exist, which failed, and which attempt ids to pass to depot_get_ci_logs or depot_get_ci_metrics. Set failedOnly=true to cut a large matrix down to just the broken jobs.

This does not explain failures — it only reports structure and status. For root cause, call depot_diagnose_ci_failure with the same run id.

ParametersJSON Schema
NameRequiredDescriptionDefault
runIdYesThe run id, as returned by depot_list_ci_runs.
failedOnlyNoShow only jobs that failed or were cancelled. Useful for wide build matrices.

Output Schema

ParametersJSON Schema
NameRequiredDescription
runYes
jobCountYes
workflowsYes
failedJobCountYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as readOnly, idempotent, openWorld=false, and non-destructive. The description adds important behavioral context beyond annotations: the tool only reports structure and status, does not explain failures, and returns node ids needed for drilling into logs/metrics. This is exactly the kind of limitation disclosure that helps an agent avoid misusing the result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight paragraphs, each earning its place: first defines the output, second gives concrete usage and the flag, third states the limitation and routes to the correct alternative. No filler or repetition of annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only tree tool with an output schema and full parameter schema coverage, the description supplies all required context: what the output looks like, which jobs/attempts to inspect, how to filter, what the tool does not do, and which sibling to call for root cause. Nothing an agent needs to select or invoke the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both runId and failedOnly clearly. The description reinforces failedOnly's purpose ('cut a large matrix down to just the broken jobs') but does not add meaning beyond what the schema provides. A baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: 'Show one Depot CI run as its workflow -> job -> attempt tree' with node statuses and drill-in IDs. It distinguishes itself from siblings by explicitly noting this tool does not explain failures and that root cause belongs to depot_diagnose_ci_failure.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance on when to use the tool ('Use this to see the shape of a run'), how to use failedOnly for large matrices, and when not to use it ('does not explain failures') with a clear alternative call: depot_diagnose_ci_failure. It also tells the agent which attempt ids to pass to depot_get_ci_logs or depot_get_ci_metrics.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_projectGet one Depot project and its trust policiesA
Read-onlyIdempotent

Show one Depot container build project's full configuration together with its OIDC trust policies.

Use this to check build capacity and cache retention for a specific project, and to audit which external CI systems are allowed to exchange an OIDC token for Depot credentials — trust policies are the answer to "how does our GitHub Actions workflow authenticate to Depot without a stored token".

Trust-relationship tokens carry project-token permissions, which means they cannot reach the Depot CI API or the Depot API; only container builds and the registry.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectIdYesThe project id, from depot_list_projects.

Output Schema

ParametersJSON Schema
NameRequiredDescription
projectYes
trustPoliciesYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable security context beyond annotations: trust-relationship tokens carry project-token permissions and cannot reach the Depot CI API or Depot API, only container builds and the registry. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a front-loaded purpose sentence, followed by use cases and a security note. Each paragraph adds distinct information, though it is slightly longer than a purely minimal definition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only single-resource tool with an output schema, the description covers purpose, use cases, and authentication semantics. Nothing needed to select and invoke the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single projectId parameter is already documented as coming from depot_list_projects. The description adds no additional parameter-level meaning, so it does not need to compensate; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Show one Depot container build project's full configuration together with its OIDC trust policies.' This clearly distinguishes it from sibling list/diagnostic tools by narrowing scope to a single project and its trust policies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit use cases: 'check build capacity and cache retention for a specific project' and 'audit which external CI systems are allowed to exchange an OIDC token for Depot credentials.' It does not explicitly name when-not-to-use alternatives, but the 'specific project' framing makes the boundary clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_usageGet Depot usage and spend driversA
Read-onlyIdempotent

Report Depot usage for a period: container build minutes and minutes saved by caching, GitHub Actions runner minutes by repository and workflow, storage, and agent sandbox minutes.

Use this for cost questions — "what is burning our Depot minutes", "which repo dominates our runner bill", "is the cache actually paying for itself". minutesSaved against minutesBilled is the cache's return on investment; a project with high billed minutes and low saved minutes is where to look first.

This is also the only place Depot exposes managed GitHub Actions runner data through the API, and it is aggregated: there is no per-job runner list.

Pass projectId to scope to one container build project, which returns build counts, duration and layer cache size instead of the organization-wide breakdown. Defaults to the last 30 days.

ParametersJSON Schema
NameRequiredDescriptionDefault
daysNoLook back this many days from now. Ignored when startAt and endAt are both given.
endAtNoEnd of the window, RFC 3339 or YYYY-MM-DD. Dates are UTC. A date-only value is inclusive: "2024-01-31" covers all of 31 January. Requires startAt.
startAtNoStart of the window, RFC 3339 or YYYY-MM-DD. Dates are UTC; a date-only value means midnight at the start of that day. Requires endAt.
projectIdNoScope to one container build project instead of the whole organization.

Output Schema

ParametersJSON Schema
NameRequiredDescription
notesYes
scopeYes
storageYes
periodEndYes
periodStartYes
agentSandboxYes
projectUsageNo
containerBuildYes
githubActionsJobsYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, and the description adds valuable behavioral context: the data is aggregated, there is no per-job detail, projectId changes the response shape, and the default window is 30 days. It also explains the meaningfulness of minutesSaved vs minutesBilled, which goes beyond the structured schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized for a complex usage-reporting tool and is front-loaded with a concise summary of what it returns. Every sentence adds value: use cases, the uniqueness of the runner data, aggregation caveats, and scope behavior. There is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with an output schema, read-only annotations, and a rich input schema, this description is complete. It covers what data is returned, when to use it, how scope changes, exclusions, and default behavior. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by explaining that projectId returns build counts, duration, and layer cache size instead of the organization-wide breakdown, and by confirming the default look-back period. It does not deeply discuss startAt/endAt semantics, but the schema already covers those.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: it reports Depot usage for a period, enumerating build minutes, caching savings, runner minutes, storage, and sandbox minutes. It clearly differentiates this from sibling list/diagnose tools by framing it as the cost/spend reporting endpoint and noting it is the only API exposure for managed runner data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to use this for cost questions and gives concrete examples like 'what is burning our Depot minutes' and 'which repo dominates our runner bill'. It also clarifies that there is no per-job runner list, preventing misuse, and explains when to pass projectId to change scope.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_buildsList Depot container buildsA
Read-onlyIdempotent

List recent container builds for a Depot project, with duration and cache effectiveness for each.

Use this to find a build to diagnose, or to answer "are our builds getting slower" — every row carries cachedSteps, totalSteps and secondsSaved, so a run of builds with a low cache hit ratio is visible immediately without opening the dashboard.

Requires a projectId; DEPOT_PROJECT_ID is used when set, and depot_list_projects lists the options. These are container builds only, not Depot CI runs — use depot_list_ci_runs for those.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum builds to return.
pageTokenNonextPageToken from a previous call.
projectIdNoThe project to list builds for. Falls back to DEPOT_PROJECT_ID.

Output Schema

ParametersJSON Schema
NameRequiredDescription
buildsYes
returnedYes
projectIdYes
nextPageTokenNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as read-only, idempotent, and non-destructive. The description adds useful behavioral context: it mentions the returned fields (cachedSteps, totalSteps, secondsSaved), the DEPOT_PROJECT_ID fallback, and that results are 'recent', which conveys ordering without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short paragraphs, each earning its place: the first defines the core function, the second gives concrete diagnostic use cases, and the third covers required context and sibling differentiation. No filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with an output schema, the description covers what the tool returns, how to select a project, when to use it, and what it is not. An agent has everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all three parameters with descriptions, so the baseline is 3. The description adds extra semantic value by stating 'Requires a projectId' despite the schema having no required fields, explaining the DEPOT_PROJECT_ID fallback, and pointing to depot_list_projects as a source for valid IDs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List recent container builds for a Depot project, with duration and cache effectiveness for each.' It clearly distinguishes container builds from CI runs, and the semantics are aligned with the title and annotations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'to find a build to diagnose, or to answer are our builds getting slower.' It also names the alternative: 'use depot_list_ci_runs for those' and points to depot_list_projects for project ID discovery.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_ci_artifactsList Depot CI artifactsA
Read-onlyIdempotent

List the artifacts a Depot CI run, workflow, job, or attempt uploaded, optionally with signed download URLs.

Use this to find out what a run produced — test reports, JUnit XML, coverage output, built binaries, screenshots from a failed browser test. Filter to one job or attempt by passing its id alongside runId.

Set withDownloadUrl=true to also fetch signed HTTPS URLs, which are minted one request per artifact and capped at 10 per call. This tool never downloads or reads artifact contents; it returns metadata and links only.

ParametersJSON Schema
NameRequiredDescriptionDefault
jobIdNoNarrow to one job.
limitNoMaximum artifacts to return.
runIdNoThe run whose artifacts you want.
attemptIdNoNarrow to one attempt.
pageTokenNoContinue a previous listing: pass the nextPageToken from the last call, with the same filters.
workflowIdNoNarrow to one workflow within the run.
withDownloadUrlNoAlso mint a signed download URL per artifact. Costs one extra request each, capped at 10.

Output Schema

ParametersJSON Schema
NameRequiredDescription
notesYes
returnedYes
artifactsYes
nextPageTokenNo

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds important behavioral detail beyond those annotations: signed URLs are minted one request per artifact, capped at 10 per call, and the tool only returns metadata and links without downloading contents. This is exactly the kind of context an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: the first sentence captures the core operation, the second gives practical use cases, and the third explains the optional signed-URL behavior and its constraints. No sentence is wasted, and the most decision-relevant detail (never downloads contents) is included early.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and annotations covering safety, the description provides the remaining behavioral context an agent needs: what artifacts are for, how to narrow results, how signed URLs behave, and the cap. Pagination is handled by the schema's pageToken description, so nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter. The description adds some relational context (e.g., passing jobId/attemptId alongside runId, withDownloadUrl costing extra requests) but does not substantially expand beyond the schema's own descriptions. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List'), a precise resource ('artifacts'), and the exact scope ('a Depot CI run, workflow, job, or attempt'). It also clarifies what the tool does not do ('never downloads or reads artifact contents'), making its purpose unmistakable even among many sibling CI tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: 'Use this to find out what a run produced' with concrete examples, and explains when to filter by job or attempt. It does not explicitly compare against sibling tools like depot_get_ci_logs or depot_get_ci_job_summary, so an agent is left to infer those boundaries, but the guidance is otherwise strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_ci_runsList Depot CI runsA
Read-onlyIdempotent

List recent Depot CI runs, newest first, optionally filtered by status, repository, commit, trigger, or pull request.

Use this to find the run someone is talking about — "my last failed build", "did main go green", "what ran for PR 412" — and then pass the returned runId to depot_diagnose_ci_failure or depot_get_ci_run.

The fastest path to diagnosing a recent breakage is status=["failed"] with limit=1, then depot_diagnose_ci_failure on the runId that comes back.

Returns identity, status and timing only. It does not return logs or failure detail; use depot_diagnose_ci_failure for that.

ParametersJSON Schema
NameRequiredDescriptionDefault
prNoPull request number. Depot requires repo to be set alongside this.
shaNoFilter to runs for one commit SHA.
repoNoRepository in "owner/name" form. Required when filtering by pr.
limitNoMaximum runs to return in one call.
statusNoKeep only runs in these states. "finished" means completed successfully; a failed run reports "failed".
triggerNoFilter by what started the run, for example "push" or "workflow_dispatch".
pageTokenNonextPageToken from a previous call, to fetch the following page.

Output Schema

ParametersJSON Schema
NameRequiredDescription
runsYes
returnedYes
nextPageTokenNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description only needs to add context beyond safety. It adds newest-first ordering, the limited return payload ('identity, status and timing only'), and the explicit absence of logs or failure detail. Pagination behavior is not described in prose, but the schema's pageToken parameter covers that gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and ordering, then moves to use cases, a recommended call pattern, and finally the boundary of what the tool returns. Every sentence earns its place and no sentence merely repeats the schema or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with a rich input schema and an output schema, the description covers ordering, filtering, return scope, exclusions, and next steps with the returned runId. An agent can both select this tool over siblings and invoke it correctly without needing further inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds value by grouping the optional filters into a readable list and by providing a concrete recommended argument combination: status=['failed'] with limit=1. It does not redefine each parameter, but the invocation pattern gives the agent useful guidance beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'List recent Depot CI runs' including ordering ('newest first'). It clearly names the filter dimensions and explicitly contrasts itself with depot_diagnose_ci_failure and depot_get_ci_run by stating what it returns and what it does not. This cleanly separates it from sibling list/detail/diagnosis tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives concrete use cases ('find the run someone is talking about', 'did main go green', 'what ran for PR 412') and a recommended fast path: status=['failed'] with limit=1, then depot_diagnose_ci_failure. It also explicitly says the tool does not return logs or failure detail and directs the agent to depot_diagnose_ci_failure for that, so when-to-use and when-not-to-use are both clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_ci_secretsList Depot CI secret names and scopingA
Read-onlyIdempotent

List the names and scoping of Depot CI secrets. Values are never returned — Depot's API does not expose them at all, by design.

Use this to answer "why can't my job see $FOO". Depot models a secret as one name with several variants, each scoped by repository, environment, branch, and workflow attributes; a job that cannot see a secret usually means no variant matches that job's scope. Compare what this returns against the job you are debugging.

Filtering happens in this server, because Depot's v3beta2 list filters are undocumented. Note that depot.ci.v3beta2 is a beta API and the most likely of Depot's surfaces to change.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNoCase-insensitive substring match on the name.
branchNoKeep variants scoped to this branch.
workflowNoKeep variants scoped to this workflow.
repositoryNoKeep variants scoped to this repository, plus unscoped ones.
environmentNoKeep variants scoped to this environment.

Output Schema

ParametersJSON Schema
NameRequiredDescription
secretsYes
returnedYes
valuesAvailableYesAlways false: Depot never returns secret values over the API.

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare read-only, idempotent, non-destructive behavior. The description adds valuable context: secret values are never exposed by design, filtering happens server-side because upstream filters are undocumented, and the beta API is likely to change. These are meaningful behavioral disclosures beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and each paragraph earns its place: purpose and security first, then debugging guidance, then filtering and API risk. It is longer than one or two sentences, but nothing is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only listing tool with a diverse set of optional filters, the description covers the security model, scoping semantics, debugging workflow, server-side filtering rationale, and API stability. An agent has enough context to invoke the tool correctly and interpret its results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents each parameter. The description adds conceptual value by explaining how scoping works — a secret has variants scoped by repository, environment, branch, and workflow — which helps the agent understand why filters matter and how to interpret results. This goes beyond the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists Depot CI secret names and scoping, and explicitly notes that values are never returned. It is specific about the resource and action, but it does not explicitly distinguish itself from sibling tools like depot_list_ci_variables or depot_diagnose_ci_failure, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit use case: answer 'why can't my job see $FOO' and compare returned scoping against the job being debugged. It does not mention alternatives or provide when-not-to-use guidance, so it is not a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_ci_variablesList Depot CI variables and their scopingA
Read-onlyIdempotent

List Depot CI variables, their values, and their scoping.

Use this for the same "why can't my job see $FOO" question as depot_list_ci_secrets, and to check that a variable holds what you expect for a given branch or environment. Depot models a variable as one name with several variants, each scoped by repository, environment, branch, and workflow.

Unlike secrets, Depot does return variable values. Because variables are routinely misused to hold credentials, this server redacts any value whose name or content looks like a secret and reports which rule fired, so a redacted value still tells you the variable exists.

Filtering happens in this server. depot.ci.v3beta2 is a beta API and the most likely of Depot's surfaces to change.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNoCase-insensitive substring match on the name.
branchNoKeep variants scoped to this branch.
workflowNoKeep variants scoped to this workflow.
repositoryNoKeep variants scoped to this repository, plus unscoped ones.
environmentNoKeep variants scoped to this environment.

Output Schema

ParametersJSON Schema
NameRequiredDescription
returnedYes
variablesYes
redactedCountYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the operation as read-only, idempotent, and non-destructive, so the description focuses on valuable extra behavior. It explains the variable-as-variants scoping model, reveals that values can be redacted when they resemble secrets, and warns that the underlying API is beta and likely to change.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then moves through use cases, behavioral nuances, and API stability in a logical order. Every sentence earns its place, and the length is appropriate for the tool's conceptual complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With annotations covering safety and an output schema present, the description only needs to explain selection and behavioral nuance, which it does thoroughly. It covers scoping, redaction, filtering location, and beta instability, leaving no important gap for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already describes all five optional parameters with 100% coverage, so the baseline is 3. The description adds meaningful semantic context by explaining that a single variable name can have multiple variants scoped by repository, environment, branch, and workflow, and by clarifying that filtering is performed server-side.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb and resource: it lists Depot CI variables, their values, and their scoping. It also distinguishes itself from the sibling depot_list_ci_secrets by explicitly noting that variables return values while secrets do not.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly identifies the use case: answering "why can't my job see $FOO" and checking whether a variable holds the expected value for a branch or environment. It references the sibling secrets tool, but does not give a strict when-not-to-use rule beyond the contrast that variables return values.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_imagesList images in a Depot project registryA
Read-onlyIdempotent

List the container images stored in a Depot project's registry, with tag, digest, push time, and size.

Use this to check whether a build actually pushed what you expected, to find the digest behind a tag before a deploy, or to see when an image was last refreshed.

Requires a projectId; DEPOT_PROJECT_ID is used when set, and depot_list_projects lists the options.

Read-only: this cannot delete tags or images. Image deletion is deliberately not exposed by this server, since it is irreversible and something may be deploying what you delete.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum images to return.
pageTokenNonextPageToken from a previous call.
projectIdNoThe project whose registry to list. Falls back to DEPOT_PROJECT_ID.

Output Schema

ParametersJSON Schema
NameRequiredDescription
imagesYes
returnedYes
projectIdYes
nextPageTokenNo

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/idempotentHint/destructiveHint annotations, the description explicitly states the operation cannot delete tags or images and explains WHY deletion is not exposed—it is irreversible and something may be deploying what you delete. It also discloses the DEPOT_PROJECT_ID fallback behavior, adding context the annotation booleans alone do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence carries the core purpose, followed by short paragraphs for use cases, environment/parameter behavior, and a safety note. Every sentence earns its place, though four paragraphs is slightly more than strictly necessary for a simple list operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with an output schema, 100% schema parameter coverage, and four safety annotations, the description covers purpose, use cases, the projectId mechanism, and the read-only guarantee. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters are already fully documented (limit bounds and default, pageToken semantics, projectId fallback). The description only restates the projectId fallback in prose without adding new parameter-level detail, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List the container images stored in a Depot project's registry, with tag, digest, push time, and size.' It names the exact returned fields, and no sibling tool covers image listing, so it is trivially distinguishable from the other fourteen depot_* tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Three concrete use cases are given: verifying a build pushed what was expected, finding the digest behind a tag before deploy, and checking when an image was last refreshed. It also routes the agent to depot_list_projects when the projectId is unknown. No alternative tool is named for exclusion, but the provided scenarios make selection unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_projectsList Depot container build projectsA
Read-onlyIdempotent

List Depot container build projects with their region, runner hardware, and cache policy.

Use this to find a projectId for depot_list_builds, depot_diagnose_build, or depot_list_images, and to check configuration that affects build speed: which region a project builds in, how large its runners are, and how much layer cache it retains before eviction.

These are container build projects. Depot CI runs are organised by repository and workflow instead — use depot_list_ci_runs for those.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum projects to return.
regionIdNoFilter to one region, for example "us-east-1" or "eu-central-1".
pageTokenNoContinue a previous listing: pass the nextPageToken from the last call.

Output Schema

ParametersJSON Schema
NameRequiredDescription
projectsYes
returnedYes
nextPageTokenNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description does not need to repeat safety traits. It adds useful context beyond annotations by specifying what fields are returned and by clarifying the tool's scope relative to Depot CI runs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and payload, then provides concrete use cases and an explicit sibling distinction. Every sentence earns its place and there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of this read-only list tool, the presence of an output schema, and strong annotations, the description is complete. It tells the agent what to use the tool for, what it returns, and when to choose a different tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents all three parameters with 100% coverage, including defaults and examples. The description adds no parameter-specific detail, but the baseline of 3 is appropriate because the schema carries the full semantic burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List'), a specific resource ('Depot container build projects'), and key returned data ('region, runner hardware, cache policy'). It clearly distinguishes itself from CI-run tools by explicitly saying these are container build projects, not CI runs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use this tool: to find a projectId for list/diagnose operations and to check build-speed-related configuration. It also explicitly tells the agent to use depot_list_ci_runs for CI runs instead, providing a clear alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_whoamiCheck the Depot token and its visible scopeA
Read-onlyIdempotent

Verify the configured Depot token and report which organizations and projects it can actually see.

Call this first whenever another Depot tool returns an empty list or a permission error. Depot's most common confusing failure is a token that spans several organizations with none selected: requests then resolve against the wrong organization and return empty results rather than an error. This tool says plainly whether that is happening and what to set.

Also reports whether write tools are enabled. This version of the server ships no mutating tools at all, so the answer is always that nothing can be modified.

Never returns the token or any part of it.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
apiUrlYes
failuresYes
projectsYes
warningsYes
activeOrgIdNo
tokenSourceYes
orgSelectionYes
projectCountNo
organizationsYes
writesEnabledYes
mutatingToolsAvailableYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond the readOnly/idempotent annotations by disclosing that it reports visible organizations/projects, always indicates no mutating capabilities, and never returns the token itself. This gives the agent important security and expectation-setting context not present in annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and then adds usage guidance and security notes. It is slightly longer than strictly necessary, but each paragraph covers a distinct and valuable aspect, so the verbosity is justified.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter diagnostic tool with an output schema and strong annotations, the description is complete. It covers when to call it, what it reports, a common failure scenario, and the crucial guarantee that it never exposes the token. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so the baseline is 4 and parameter documentation is unnecessary. The description appropriately focuses on what the tool returns rather than inputs, which is all that is needed here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Verify the configured Depot token and report which organizations and projects it can actually see.' This clearly distinguishes it from the list/get/diagnose sibling tools and makes its diagnostic role obvious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly instructs the agent to call this tool first 'whenever another Depot tool returns an empty list or a permission error,' and explains the underlying failure mode. This is concrete, actionable guidance that an agent can apply without inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 16 tool updatesv0.1.0
    • First observeddepot_diagnose_build
    • First observeddepot_diagnose_ci_failure
    • First observeddepot_get_ci_job_summary
    • First observeddepot_get_ci_logs
    • First observeddepot_get_ci_metrics
    • First observeddepot_get_ci_run
    • First observeddepot_get_project
    • First observeddepot_get_usage
    • First observeddepot_list_builds
    • First observeddepot_list_ci_artifacts
    • First observeddepot_list_ci_runs
    • First observeddepot_list_ci_secrets
    • First observeddepot_list_ci_variables
    • First observeddepot_list_images
    • First observeddepot_list_projects
    • First observeddepot_whoami

TDQS

A4.6/5.0
Disambiguation5/5

Every tool targets a distinct resource and action. The CI troubleshooting tools are cleanly separated by purpose—diagnose, logs, metrics, artifacts, secrets, variables, run structure—and the build/project/usage tools don't overlap with them or each other. Where tools could overlap, the descriptions explicitly explain when to use which.

Naming Consistency5/5

All tools share the depot_ prefix and follow a consistent verb_noun pattern (list_*, get_*, diagnose_*). The few special names like depot_whoami still fit the command-style convention without breaking the overall predictability.

Tool Count4/5

At 16 tools, this sits slightly above the ideal 3-15 range, but the count is justified by covering two related domains: Depot CI and container builds/registry/usage. Each tool has a clear purpose, so the size feels deliberate rather than bloated.

Completeness5/5

For a deliberately read-only server, the surface is thorough: run discovery, failure diagnosis, logs, job summaries, metrics, artifacts, secrets, variables, builds, projects, images, and usage. There are no obvious dead ends for diagnosing failures or answering configuration and cost questions.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Read-only MCP tools for coding agents to audit deployment targets, detect fabricated code, review backlog, database schema, analytics, ML models, architecture docs, and decision lenses.
    11
    19
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    A secure, local-first MCP server for read-only inspection and troubleshooting of development environments, exposing narrow, typed, auditable capabilities for repository inspection, log summarization, Docker review, and security scanning without granting unrestricted machine access.
    MIT
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to investigate production incidents by exposing service health, logs, and deployment data through MCP tools.
    10
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/akshayjain3450/depot-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server