depot-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@depot-mcpWhy did my latest CI run fail?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
depot-mcp: MCP server for Depot (depot.dev)
A read-only Model Context Protocol server for Depot, the container build and CI acceleration service. It gives a coding agent Depot's own answer to "why did CI fail?" and "why did this build fail?", plus the run history, cache effectiveness, registry contents, CI configuration, and usage data behind those answers.
Community project. Not affiliated with, endorsed by, or supported by Depot. Source-available under Apache 2.0 with the Commons Clause; see License.
Not to be confused with: The Home Depot, Chromium's depot_tools, Steam depots, Perforce depots, or any other "depot". This server talks only to api.depot.dev.
Contents
Related MCP server: deployment-intelligence-mcp
Why this exists
Depot ships a good agent story already, but it is not MCP. Depot's answer is Agent Skills: SKILL.md files that teach an agent to drive the depot CLI, plus a documented CI API and llms.txt. Depot's own post announcing Skills notes two limitations: skills work best in clients that implement the SKILL.md convention, and they are "sometimes notorious for not being automatically used by agents."
This server covers the gaps that leaves:
Agents without a shell. Skills require a logged-in
depotbinary on the machine. A tool call does not.Clients that don't read
SKILL.md. MCP is client-agnostic.Reliable invocation. A registered tool with a description is discovered through the protocol rather than hopefully retrieved.
A read-only boundary. A skill cannot stop an agent from running
depot ci rerun. This server can, and does; see Read-only model and security.
The flagship tool is a thin, careful wrapper around something Depot already built: GetFailureDiagnosis, a server-side failure analysis that clusters a run's failures by root cause and returns a diagnosis, a suggested fix, and the evidence lines, already bounded so it fits in a context window. Most of this server's value is exposing that well.
How it compares to Depot Agent Skills
Depot Agent Skills | depot-mcp | |
Needs the | yes | no |
Works in clients without | no | yes |
Invocation | agent must retrieve the skill | tool is listed in |
Can mutate Depot (rerun, cancel, reset) | yes, anything the CLI can | no tool can |
Output bounded for a context window | depends on the CLI command | every tool |
Maintained by | Depot | community |
As of 2026-09-05 no standalone Depot MCP server exists (first-party or otherwise, in the official registry, on npm, or on PyPI), and Depot's own guidance for agents without a shell is to call the CI API directly. This server is that API call, shaped for an agent.
Status
Read-only. v1 registers no tool that can change anything. There is no retry, cancel, rerun, dispatch, delete, or token-minting tool.
Depot CI is beta, per Depot's own documentation. The CI tools are the most valuable ones here and also the most likely to shift under you.
Publishing to npm is pending. The
npx depot-mcpforms below will work once 0.1.0 is published; until then use the from a clone path. The namedepot-mcpis unclaimed on npm and PyPI as of 2026-09-05.MCP protocol revision
2025-11-25. This server is built on the@modelcontextprotocol/sdk1.x line, which speaks2025-11-25. The current spec revision is2026-07-28, implemented by the v2 packages (@modelcontextprotocol/server2.0.0, published 2026-07-28), which also serve2025-11-25clients. Every current client negotiates2025-11-25, so nothing is lost today. Moving to v2 is a planned, contained change: the SDK is imported in nine files and the transport wiring lives insrc/index.ts.
Prerequisites
Node.js 20 or newer (
node --version). The Docker image needs no Node on the host.A Depot Organization token. Depot dashboard, Organization Settings, API Tokens. A user token from
depot loginalso works but spans every organization you belong to, so setDEPOT_ORG_IDtoo.Project tokens will not work. Depot's own scope matrix excludes them from Depot CI and the API entirely.
Create a dedicated token for this server so you can revoke it independently. Depot has no read-only token scope; read the security section before you paste one anywhere.
Installation
Every client below runs the same command over stdio. The only things that vary are the file the config lives in and how that client lets you keep the token out of the file.
The generic config, which works as-is in Claude Desktop, Cursor, Windsurf, Cline, JetBrains, and most other clients:
{
"mcpServers": {
"depot": {
"command": "npx",
"args": ["-y", "depot-mcp"],
"env": {
"DEPOT_TOKEN": "dp_your_organization_token"
}
}
}
}Add "DEPOT_ORG_ID": "..." to env if your token can see more than one organization. Every tool is prefixed depot_, and tool names are stable across releases.
Claude Code
claude mcp add depot --scope user --env DEPOT_TOKEN=dp_your_organization_token -- npx -y depot-mcpOr commit a .mcp.json at the repository root so the whole team gets it. Claude Code expands ${VAR} and ${VAR:-default} in command, args, env, url, and headers, so the token stays in each developer's shell environment and out of git. Copy .mcp.json.example:
{
"mcpServers": {
"depot": {
"type": "stdio",
"command": "npx",
"args": ["-y", "depot-mcp"],
"env": {
"DEPOT_TOKEN": "${DEPOT_TOKEN}",
"DEPOT_ORG_ID": "${DEPOT_ORG_ID:-}"
}
}
}
}Claude Code prompts on every MCP tool call regardless of readOnlyHint. To stop being asked, allow the read-only tools in .claude/settings.json: "permissions": { "allow": ["mcp__depot__*"] }.
Claude Desktop
Two options.
Extension bundle (one click). Download depot-mcp.mcpb from the releases page, open it with Claude Desktop (or Settings, Extensions, Advanced settings, Install extension), and paste the token into the settings form. The token field is marked sensitive in manifest.json, so Claude Desktop stores it in the OS keychain rather than in a JSON file.
Manual JSON. Edit ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows and add the generic config above.
Cursor
The button pre-fills the server; fill in DEPOT_TOKEN when Cursor shows the config. Or edit ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project). Cursor resolves ${env:NAME} in command, args, env, url, and headers, so a committed project file can read the token from the environment:
{
"mcpServers": {
"depot": {
"command": "npx",
"args": ["-y", "depot-mcp"],
"env": {
"DEPOT_TOKEN": "${env:DEPOT_TOKEN}"
}
}
}
}VS Code and GitHub Copilot
The buttons register the server and prompt for the token once, storing it as a VS Code secret. Equivalent .vscode/mcp.json (safe to commit: the token is an input, not a value):
{
"inputs": [
{
"type": "promptString",
"id": "depot-token",
"description": "Depot Organization token (dp_...)",
"password": true
}
],
"servers": {
"depot": {
"type": "stdio",
"command": "npx",
"args": ["-y", "depot-mcp"],
"env": {
"DEPOT_TOKEN": "${input:depot-token}"
}
}
}
}Or from a terminal: code --add-mcp '{"name":"depot","command":"npx","args":["-y","depot-mcp"],"env":{"DEPOT_TOKEN":"dp_..."}}'. Copilot Chat in VS Code uses whatever is in mcp.json; use "MCP: Open User Configuration" for a user-level file.
GitHub Copilot coding agent
Repository Settings, Copilot, Coding agent, MCP configuration. Secrets must be Copilot environment secrets whose names start with COPILOT_MCP_:
{
"mcpServers": {
"depot": {
"type": "local",
"command": "npx",
"args": ["-y", "depot-mcp"],
"env": {
"DEPOT_TOKEN": "$COPILOT_MCP_DEPOT_TOKEN"
},
"tools": ["*"]
}
}
}OpenAI Codex CLI
codex mcp add depot --env DEPOT_TOKEN=dp_your_organization_token -- npx -y depot-mcpOr in ~/.codex/config.toml. env_vars forwards named variables from your shell so the token need not be written into the file:
[mcp_servers.depot]
command = "npx"
args = ["-y", "depot-mcp"]
env_vars = ["DEPOT_TOKEN", "DEPOT_ORG_ID"]Gemini CLI
gemini mcp add -e DEPOT_TOKEN=dp_your_organization_token depot npx -y depot-mcpOr in ~/.gemini/settings.json. Gemini CLI expands $VAR and ${VAR} inside env:
{
"mcpServers": {
"depot": {
"command": "npx",
"args": ["-y", "depot-mcp"],
"env": {
"DEPOT_TOKEN": "$DEPOT_TOKEN"
}
}
}
}Windsurf
~/.codeium/windsurf/mcp_config.json, or Windsurf Settings, Cascade, MCP Servers, Manage. Use the generic config above.
Zed
settings.json:
{
"context_servers": {
"depot": {
"command": "npx",
"args": ["-y", "depot-mcp"],
"env": {
"DEPOT_TOKEN": "dp_your_organization_token"
}
}
}
}Cline
Cline panel, MCP Servers, Configure (or ~/.cline/mcp.json for the CLI). The generic config works; Cline also accepts "disabled": false and "autoApprove": ["depot_whoami", "depot_diagnose_ci_failure"] per server.
JetBrains AI Assistant
Settings, Tools, AI Assistant, Model Context Protocol (MCP), Add, then paste the generic config as JSON. If you already configured Claude Desktop, "Import from Claude" picks it up.
Docker
No Node.js on the host. The image is stdio, so -i is required and -t must not be used. Pass the token from your environment rather than on the command line:
docker build -t depot-mcp .
export DEPOT_TOKEN=dp_your_organization_token
docker run -i --rm -e DEPOT_TOKEN -e DEPOT_ORG_ID depot-mcpClient config for the image:
{
"mcpServers": {
"depot": {
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "DEPOT_TOKEN", "depot-mcp"],
"env": {
"DEPOT_TOKEN": "dp_your_organization_token"
}
}
}
}A published image at ghcr.io/akshayjain3450/depot-mcp and a Docker MCP Catalog entry are planned; see Where to find it.
From a clone
Works today, before the npm publish:
git clone https://github.com/akshayjain3450/depot-mcp.git
cd depot-mcp
npm install
npm run buildThen replace "command": "npx", "args": ["-y", "depot-mcp"] in any block above with "command": "node", "args": ["/absolute/path/to/depot-mcp/dist/index.js"]. For Claude Code:
claude mcp add depot --env DEPOT_TOKEN=dp_your_organization_token -- node /absolute/path/to/depot-mcp/dist/index.jsChecking it works
npx @modelcontextprotocol/inspector npx -y depot-mcp # or: node dist/index.jsThen, from your agent, ask it to call depot_whoami. That confirms the token, reports which organizations and projects it can see, and warns about the organization ambiguity described under Configuration.
The binary also answers two flags without needing a token:
npx depot-mcp --version # prints the version from package.json
npx depot-mcp --help # usage, environment variables, exit codesImporting the package (import { createServer } from 'depot-mcp') gives you the server factory without starting anything; only the depot-mcp binary opens stdio.
Compatibility
The server speaks stdio only. Anything that can launch a local process and talk MCP 2025-11-25 (or negotiate down to it) works. "Tested" means exercised end to end by a maintainer with a real token; "verified" means the config shape was checked against the vendor's documentation on 2026-09-05 but not run.
Client | Transport | Status | Notes |
MCP Inspector | stdio | tested |
|
CI stdio smoke ( | stdio | tested | runs on every commit, Node 20 and 22 |
Claude Code | stdio | verified |
|
Claude Desktop | stdio, | verified | honours |
Cursor | stdio | verified |
|
VS Code / Copilot Chat | stdio | verified |
|
GitHub Copilot coding agent | stdio ( | verified | secrets must be prefixed |
OpenAI Codex CLI | stdio | verified |
|
Gemini CLI | stdio | verified |
|
Windsurf | stdio | verified | generic config |
Zed | stdio | verified |
|
Cline | stdio | verified |
|
JetBrains AI Assistant | stdio | verified | can import Claude Desktop config |
Docker (any client) | stdio via | verified | image built in CI; distroless runtime |
Streamable HTTP / remote | not offered | the token would leave the machine; see Security |
If you run it somewhere not listed, open an issue with the client name and the config that worked.
Where to find it
Planned distribution, in order of usefulness. Items marked pending need the npm publish first.
Channel | Identifier | Status |
npm | pending ( | |
Official MCP Registry |
| pending; |
Claude Desktop extension |
| pending |
Docker MCP Catalog | PR to docker/mcp-registry with a | pending |
GitHub Container Registry |
| pending |
Smithery | listing only; Smithery dropped hosted stdio servers in September 2025, and this server is stdio by design | pending |
Glama, PulseMCP, awesome-mcp-servers | directory listings | pending |
Never look for it under @depot/* or dev.depot/*; those namespaces belong to Depot, and this project is not theirs.
Configuration
Every setting is an environment variable, set in your client's config.
Variable | Required | Default | Purpose |
| yes | Depot API token. Must be a single line of printable ASCII; a line break copied from a wrapped terminal is rejected at startup without echoing the value. The server refuses to start without it (exit code 78). | |
| no | Sent as | |
| no | Default container-build project, so build tools can be called without one. | |
| no |
| Override the API endpoint. Must be |
| no |
| Cap on log/step pages fetched per tool call, so one call can't walk a gigabyte of logs. |
| no |
| Hard character ceiling on any single tool result. |
| no |
| Reserved for a future version; currently a no-op. The gate exists so mutating tools can be added later without reworking registration. v1 defines none, so setting this changes nothing; |
Each Depot API call has an overall deadline of about 40 seconds, with a bounded number of retries (exponential backoff) for unavailable, deadline_exceeded, aborted, and 429 responses. invalid_argument, not_found, permission_denied, and failed_precondition are never retried. A tool that makes several calls (log paging, build diagnosis) can therefore take longer than one deadline; it reports partial results rather than failing outright when a later page times out.
The organization gotcha
This is the single most confusing Depot failure mode, and Depot's own Agent Skill calls it out. A user token spans every organization you belong to. When more than one is visible and DEPOT_ORG_ID is unset, requests resolve against one organization and everything in the others reads as empty rather than as an error. If a list looks wrongly empty, call depot_whoami; it detects exactly this and tells you what to set.
Tools
All 16 tools are prefixed depot_, named depot_<verb>_<noun>, and annotated readOnlyHint: true and destructiveHint: false. Names are stable: a rename or removal is a breaking change and will be listed in CHANGELOG.md.
Diagnosis (start here)
Tool | Answers |
| Why did this CI run/workflow/job/attempt fail? Clustered root causes, AI diagnosis, suggested fix, evidence lines. |
| Why did this container build fail? Locates the failing step, returns its error and log tail, plus cache effectiveness. Reports |
| Is my token valid, and what can it see? Diagnoses the organization ambiguity above, and warns when |
Depot CI
Tool | Answers |
| Which runs happened recently, and which failed? Filter by status, repo, SHA, trigger, PR. |
| What is this run's workflow, job, and attempt tree, and which node broke? |
| Bounded raw logs for an attempt: tail by default, |
| What did the job publish about itself (the |
| Was this an OOM kill or CPU starvation? CPU/memory for a run, job, or attempt. |
| What did the run upload, and what is its signed download URL? Accepts |
| Which CI secrets exist and where do they apply? Names and scoping only; Depot never returns secret values. |
| Which CI variables exist, with values and scoping. Credential-shaped values are redacted (see below). |
Container builds, projects, registry, usage
Tool | Answers |
| Recent container builds with duration and cache hit ratio. |
| Which build projects exist, in which region, on what hardware, with which cache policy? Accepts |
| One project's full config plus its OIDC trust policies. |
| What is in this project's registry, with digests and sizes? |
| What is driving spend? Build minutes, minutes saved by cache, GitHub Actions runner minutes, storage, sandboxes. Dates are UTC; a date-only |
Prompts
Two prompts chain these into common workflows: diagnose-latest-failure (find the last failed run, diagnose it, propose a fix) and explain-build-slowness (builds plus usage: is it cache misses or more work?).
Output is always bounded
Every tool caps its own output and tells the agent when it truncated:
Log tools page forward into a ring buffer and return the tail, since
GetJobAttemptLogspages oldest-first with no tail parameter.depot_diagnose_ci_failurepropagates Depot's ownboundsobject as plain-language notes, and distinguishes what Depot dropped from what this server dropped, so a partial diagnosis never looks complete.Every result respects
DEPOT_MCP_OUTPUT_BUDGET.
Read-only model and security
Read the first point carefully.
Depot has no read-only token scope. An Organization token that can call
ListRunscan also callCancelRun,RerunWorkflow, andDeleteProject. Nothing about the credential you hand this server makes it safe. This server's tool registration is the entire safety boundary: it is read-only because it defines no mutating tool, not because the token is restricted. TreatreadOnlyHintas a hint to the client, not as enforcement.Some operations are permanently out of scope, not merely deferred:
ProjectService/ResetProject(deletes all cached data; a plausible-sounding "fix" with an irreversible, invisible, expensive blast radius),CIService/Run(executes arbitrary workflow content on your infrastructure), token and secret writes (CreateTokenreturns the secret, which would land in a transcript), image and tag deletion, andShareBuild(creates a public URL; data exposure disguised as a read).The token is never logged, echoed, or written to disk. It is read from the environment only, never printed in errors or in
depot_whoami. Error messages from the transport layer and from Depot's own error envelopes are scrubbed of the token before they reach the model, in case a misconfigured endpoint echoes request headers. This server does not read~/.config/depot/depot.yaml, so it cannot pick up ambient credentials you did not intend to give it.CI variable values are scrubbed. Depot withholds secret values server-side, but returns variable values verbatim, and variables get misused as secret storage. Values whose name or content looks like a credential are replaced with a placeholder, and the result reports which rule fired so you still know the variable exists.
Create a dedicated Organization token for this server so you can revoke it independently.
stdio only, no listening port. The token crosses no network boundary other than TLS to
api.depot.dev.CI logs are untrusted text. Log lines, step summaries, artifact names, variable values, and Depot's AI diagnoses are derived from repository content, so anyone who can push to a repository that runs on Depot CI can put words in them. This server returns them; it does not act on them. Your agent might. Summaries fence that text between
--- begin untrusted CI content ---and--- end untrusted CI content ---, label Depot's diagnosis and suggested fix as unverified, and carry acontentWarningfield in structured output. The server instructions tell the model to treat it as data, never as commands.Depot stores CLI credentials in plaintext at
~/.config/depot/depot.yaml(mode 0600), not the OS keychain. Relevant if you copy a token from there.
How clients treat the annotations differs: Claude Desktop uses readOnlyHint for auto-approval, Claude Code prompts on every call unless the tool is allowlisted, and Cursor uses its own run modes. Report security problems as described in SECURITY.md.
Limitations
Container builds cannot be started through Depot's API at all, by anyone. Running a build means acquiring an mTLS BuildKit endpoint and transferring the local build context; the
depotCLI embeds a BuildKit fork to do it. Builds here are observability only. A human runsdepot build, or CI does.depot.ci.v1has reference docs but no published schema. It is absent from bothdepot/protoand the Buf Schema Registry. There is nothing to generate types from and nothing to diff for breaking changes. Rather than assert a contract nobody publishes, responses are read through tolerant accessors that accept either camelCase or snake_case, handle protobuf's int64-as-string encoding, and strip enum name prefixes. Missing fields degrade to "unknown" instead of crashing.depot_get_ci_metricsreturns Depot's raw document alongside the fields it recognises, because Depot documents that these RPCs return CPU and memory summaries without publishing their field names.depot.ci.v3beta2is beta in its name. The secrets and variables tools are the most breakage-prone. Their list filters are undocumented, so filtering happens in this server and the request sent to Depot is empty.No log streaming. Depot caps concurrent log streams per token and per organization, and a careless streaming tool could exhaust that for your whole org, including your real CI. This server polls the unary
GetJobAttemptLogsinstead, which Depot's docs explicitly bless.There is no
wait_for_run_to_finishtool, deliberately. Long polls fit badly inside a tool-call timeout. Ask for status again instead; the agent can poll across turns.
Architecture
flowchart LR
Client["MCP client<br/>(Claude Code, Cursor, VS Code, Codex, ...)"]
Server["depot-mcp<br/>node dist/index.js"]
API["api.depot.dev<br/>Connect JSON over HTTPS"]
Client -- "JSON-RPC over stdio<br/>tools/list, tools/call, prompts" --> Server
Server -- "POST /depot.ci.v1.CIService/GetFailureDiagnosis<br/>Authorization: Bearer DEPOT_TOKEN<br/>x-depot-org: DEPOT_ORG_ID" --> API
API -- "JSON, read through tolerant accessors" --> Server
Server -- "text summary + structuredContent,<br/>capped by DEPOT_MCP_OUTPUT_BUDGET" --> ClientOne process, one credential, no listening port, no protobuf toolchain. Depot's Connect binding is plain JSON over HTTP POST, so the client is a fetch wrapper with retry. Tools are one module each under src/tools/; shared helpers (budget, redact, resolve, ci-target) keep them small and their output predictable. Design notes, the Depot API survey, and the prior-art review live in docs/ and research/.
Troubleshooting
Symptom | Cause and fix |
Server exits immediately with code 78 |
|
Every list is empty but the token is valid | Multi-organization token without |
| Project token (not supported), a revoked token, or the wrong organization. |
| The run had no failures Depot could cluster, or the ID is not a failed run. |
| The target is too broad. The result lists |
Result says | Expected. Use the |
Client shows "response was interrupted" or context errors | The client's own MCP output cap. Prefer the diagnose tools over raw logs, lower |
| It is downloading the package. Run |
Nothing in the client but the Inspector works | stdout must carry only JSON-RPC. If you added logging, send it to stderr. |
| Depot's per-token or per-organization limit. Wait; the server already backs off and retries. |
| Depot did not answer within the per-call deadline. Retry; if it persists, narrow the request (fewer pages, a job instead of a run). |
| Only |
The server writes one line to stderr on startup (depot-mcp 0.1.0 ready on stdio ...); most clients show stderr in their MCP logs.
Development
npm install
npm run typecheck # tsc --noEmit, strict
npm run lint # eslint with type-aware rules
npm test # vitest, no network or Depot account needed
npm run build # emit dist/
npm run inspect # build, then open the MCP Inspector
npm run smoke:stdio # handshake + tools/list against dist/, no token neededTests drive a real Client against a real McpServer over the SDK's InMemoryTransport, with fetch stubbed to return recorded fixtures in test/fixtures/. They assert the full round trip: input validation, output-schema conformance, annotations, character budgets, and error translation. The fixtures cover all four GetFailureDiagnosis states (focused_failure, grouped_failures, over_limit, empty), empty results, and Connect error envelopes.
Live check against your own Depot organization
DEPOT_TOKEN=dp_your_organization_token npm run smokeThis runs read-only calls only, prints what it found, and reports which checks passed, failed, or were skipped. It skips the failure-diagnosis check if your organization has no failed run to analyse; without one, the flagship tool cannot be exercised.
Layout
src/
index.ts entrypoint: config, stdio transport
server.ts McpServer construction and instructions
config.ts environment resolution, fail-fast validation
prompts.ts the two chained workflows
depot/
client.ts fetch against Depot's Connect JSON binding, with retry
api.ts typed RPC surface
errors.ts Connect error codes -> actionable messages
shape.ts tolerant accessors for an unpublished schema
lib/
tool.ts registration, validation, error translation in one place
budget.ts character budgets and truncation
diagnosis.ts parsing and shaping the GetFailureDiagnosis document
ci-tree.ts run -> workflow -> job -> attempt parsing
ci-target.ts loose identifier resolution
redact.ts credential scrubbing
build.ts project.ts resolve.ts time.ts
tools/ one module per tool group; index.ts holds the write gate
test/ vitest: unit, tool round-trips over InMemoryTransport, fixtures
docs/ design notes and distribution details
research/ the API and design research this was built from
.github/ CI, release, smoke and metadata scripts, templates
server.json MCP Registry entry manifest.json Claude Desktop .mcpb manifest
Dockerfile distroless stdio image .mcp.json.example Claude Code project configresearch/ documents the Depot API, the MCP design decisions, and the prior-art survey this implementation follows. It is worth reading before changing anything non-obvious.
Contributing
Read CONTRIBUTING.md first. The short version: keep it read-only, keep the token out of everything, keep output bounded, test through the MCP client harness, and sign off your commits (git commit -s). Bug reports and feature requests have templates; security issues go through SECURITY.md, not the issue tracker.
License
Apache License 2.0 with the Commons Clause License Condition v1.0. See LICENSE and NOTICE.
In plain words, you may:
use it, at home or at work, including inside commercial CI pipelines and paid products that happen to use Depot;
modify it, fork it, and redistribute it, as long as the LICENSE and NOTICE files travel with it;
contribute changes back under the same terms.
You may not:
sell it, charge for hosting it, or offer a paid product or service whose value comes entirely or substantially from this server's functionality.
Because of the Commons Clause this is source-available, not open source under the OSI definition. Everything else in Apache 2.0 (patent grant, no warranty, attribution) applies unchanged.
Depot is a trademark of its owner. This project is unaffiliated with Depot Technologies Inc.
Available Tools
16 toolsdepot_diagnose_buildDiagnose a Depot container build failureARead-onlyIdempotent
Explain why a Depot container build failed: locate the step that broke and return its error and the tail of its logs, alongside cache effectiveness for the build.
Use this for "why did my docker build fail". Unlike Depot CI, container builds have no server-side AI diagnosis, so this tool does the legwork an agent would otherwise do by hand: read the build, page through its steps, pick the step that reported an error (or the last step that actually executed), and fetch only that step's logs.
Pass projectId when you know it. Depot's build record does not include a project id and the steps API requires one, so without it this tool has to scan recent builds across your projects, which costs several extra requests. DEPOT_PROJECT_ID works as a default.
Also reports cachedSteps vs totalSteps and secondsSaved, which is the fastest way to see whether a slow build is a cache miss problem rather than a code problem.
Read-only: this cannot start, retry, or cancel a build. Container builds cannot be triggered through Depot's API at all — a human runs "depot build" locally, or CI runs it.
| Name | Required | Description | Default |
|---|---|---|---|
| buildId | Yes | The build id, as shown by depot_list_builds or the Depot dashboard. | |
| projectId | No | The project that owns the build. Strongly preferred: without it the server has to search. | |
| tailLines | No | How many trailing log lines to return from the failing step. |
Output Schema
| Name | Required | Description |
|---|---|---|
| build | Yes | |
| notes | Yes | |
| logTail | Yes | |
| projectId | Yes | |
| stepCount | Yes | |
| failingStep | No | |
| cacheSummary | Yes | |
| logTruncated | Yes | |
| logPageCapHit | Yes | |
| logNextPageToken | No | |
| logLinesTruncated | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial behavioral detail beyond the readOnlyHint and destructiveHint annotations: it cannot start, retry, or cancel a build; container builds cannot be triggered through Depot's API at all; and without a projectId it scans recent builds at extra request cost. These are meaningful, non-obvious traits that help an agent predict side effects and performance.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than average, but every sentence earns its place: purpose, usage trigger, differentiation from CI, parameter guidance, output significance, and safety guarantees. It is front-loaded with the core purpose and organized so the most actionable guidance appears early.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with an output schema, documented parameters, and read-only/idempotent annotations, the description still fills the remaining context: when to reach for it, why it exists, what operational costs to expect, and what the cache metrics mean. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even though the schema already documents all three parameters at 100% coverage, the description adds critical semantics for projectId: the build record lacks the project id, the steps API requires it, and omitting it triggers extra scanning requests. It also clarifies what buildId is by referencing depot_list_builds and the dashboard, and ties tailLines to the log-tail behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and outcome: 'Explain why a Depot container build failed' and then details exactly what it returns (failing step, error, log tail, cache stats). It clearly distinguishes itself from CI diagnosis with 'Unlike Depot CI, container builds have no server-side AI diagnosis.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use the tool: "Use this for 'why did my docker build fail'." It also explains the alternative context, noting the difference from Depot CI, and gives concrete operational guidance about passing projectId, including the DEPOT_PROJECT_ID default and the cost of omitting it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_diagnose_ci_failureDiagnose a Depot CI failureARead-onlyIdempotent
Explain why a Depot CI run, workflow, job, or attempt failed.
Reach for this first whenever someone asks why CI failed, what broke the build, or to fix a failing job. It calls Depot's server-side failure analysis, which clusters every failure in the target by root cause and returns, for each cluster: the error message, an AI-written diagnosis, a suggested fix, and the exact log lines that are the evidence.
Prefer this over depot_get_ci_logs. Depot bounds this response server-side, so it costs far less context than raw logs, and it already works out which job is the real root cause rather than a downstream casualty. Use depot_get_ci_logs afterwards only if you need more detail on a specific attempt.
Pass whichever identifier you have in "id" — a run, workflow, job, or attempt ID. This server works out which kind it is; set "targetType" only when you already know it and want to skip that step.
How to read the returned "state":
"focused_failure": one clear culprit. Read representativeAttempts.
"grouped_failures": several distinct root causes, clustered by fingerprint. Read failureGroups.
"over_limit": too many failures to analyse at this level. narrowerTargets gives the IDs to call this tool again with.
"empty": Depot found no failure evidence. The target may still be running, may have succeeded, or may be old enough that its logs have aged out.
Diagnoses and suggested fixes are generated by Depot's AI and can be wrong — treat them as a lead to verify, not a fact. Read-only: this never retries, cancels, or triggers anything.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | A Depot CI identifier: a run, workflow, job, or attempt ID. Pass whatever you have — the server resolves which kind it is. | |
| targetType | No | What kind of thing "id" refers to. Omit unless you know it; the server otherwise infers it, falling back to trying each kind in turn. | |
| maxEvidenceLines | No | Cap on evidence log lines per failing attempt. Set 0 to get diagnoses and fixes without any log lines. | |
| maxFailureGroups | No | Cap on how many clustered root causes to return. Raise only if 5 was not enough. |
Output Schema
| Name | Required | Description |
|---|---|---|
| state | Yes | One of focused_failure, grouped_failures, over_limit, empty, or unknown. |
| target | Yes | |
| context | Yes | |
| nextSteps | Yes | Depot's suggested follow-ups, rewritten as calls to this server's tools. |
| truncation | Yes | |
| emptyReason | No | |
| aiDisclosure | No | |
| failureGroups | Yes | |
| contentWarning | Yes | Reminder that names, log lines, and diagnoses here are unverified CI output. |
| narrowerTargets | Yes | Present when state is over_limit: narrower ids to re-run this tool against. |
| resolvedTargetType | Yes | The target kind that Depot accepted for this id. |
| representativeAttempts | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint and idempotentHint, and the description reinforces this with "Read-only: this never retries, cancels, or triggers anything." It also discloses that diagnoses are AI-generated and can be wrong, and explains the server-side bounding behavior that limits context cost.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured into clearly labeled sections: purpose, when to use, parameter guidance, how to read the returned state, and a caution about AI-generated content. Every paragraph earns its place and the most important guidance is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description correctly focuses on interpretation rather than raw return format. It explains all meaningful states, gives actionable guidance for each, names the sibling tool to use afterward, and warns about reliability. Nothing essential is missing for correct invocation and response interpretation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds meaningful guidance beyond the schema by explaining that "id" accepts any identifier kind and the server resolves it, and that "targetType" is only needed to skip inference. This is valuable semantic context not present in the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: "Explain why a Depot CI run, workflow, job, or attempt failed." It clearly distinguishes this diagnostic tool from log retrieval and other CI tools by emphasizing root-cause analysis over raw logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says "Reach for this first whenever someone asks why CI failed" and names the alternative with a clear preference rule: "Prefer this over depot_get_ci_logs" and use logs only for more detail on a specific attempt. This leaves no ambiguity about when to choose this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_get_ci_job_summaryGet a Depot CI job step summaryARead-onlyIdempotent
Read the step summary a Depot CI job authored for itself — the equivalent of GitHub Actions' $GITHUB_STEP_SUMMARY.
This is markdown the job's own steps chose to publish: test result tables, coverage deltas, lint counts, deployment URLs. When a job writes one, it is usually a far better explanation of what happened than its logs, because a human decided what mattered.
Most jobs write nothing here, and an empty result is normal rather than an error. If it comes back empty, use depot_diagnose_ci_failure for a failure, or depot_get_ci_logs for raw output.
"id" accepts an attempt id, a job id, or a run id.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | An attempt id, job id, or run id. | |
| targetType | No | What "id" refers to. Omit to let the server work it out. |
Output Schema
| Name | Required | Description |
|---|---|---|
| empty | Yes | |
| target | Yes | |
| markdown | Yes | |
| truncated | Yes | |
| contentWarning | Yes | Reminder that the markdown was authored by the job itself and is unverified. |
| originalLength | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool readOnly, idempotent, and non-destructive; the description adds meaningful behavior beyond that: the summary is job-authored markdown and 'an empty result is normal rather than an error.' This prevents misinterpreting empty output as failure and clarifies the accepted id forms (attempt, job, or run id). No contradiction with annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every paragraph earns its place: purpose, interpretation/value, empty-result handling with sibling routing, and id flexibility. The first sentence is front-loaded with the exact operation, and there is no redundant filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 100% schema coverage, an output schema, and strong annotations, the description covers purpose, usage context, empty behavior, alternatives, and id semantics. An agent has enough information to call the tool correctly and interpret the result without further inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 100%, including an enum for targetType and a clear description for id. The description mostly restates the id flexibility without adding syntax or format details beyond the schema. Baseline 3 is appropriate because the schema carries the parameter-semantics weight.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence names a specific verb ('Read'), a concrete resource ('step summary a Depot CI job authored for itself'), and anchors it to a familiar GitHub Actions concept ($GITHUB_STEP_SUMMARY). This clearly differentiates the tool from log- or run-level tools like depot_get_ci_logs or depot_get_ci_run even before reading the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent that an empty result is normal and should not be treated as an error. It then routes to siblings: use depot_diagnose_ci_failure for a failure and depot_get_ci_logs for raw output, which is clear when-to-use vs alternatives guidance. It also explains why the summary is preferable to logs when present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_get_ci_logsGet Depot CI job logsARead-onlyIdempotent
Fetch a bounded slice of the persisted logs for a Depot CI job attempt.
Try depot_diagnose_ci_failure first. It is cheaper, it already contains the relevant log lines with a diagnosis attached, and it identifies which job actually broke. Use this tool when you need detail the diagnosis did not include: the full traceback, output from a step that did not fail, or a specific pattern.
Defaults to the last 200 matching lines, because failures land at the end of a log. "grep" (case-insensitive substring, not a regex), "stepKey" and "stream" are applied by this server after it fetches pages from Depot, so they reduce what you receive but not what is read: a grep still walks the log page by page, up to DEPOT_MCP_MAX_LOG_PAGES pages (default 20), and is the most expensive way to use this tool. Prefer stepKey or stream, which at least keep the returned window small.
"id" accepts an attempt id, a job id, or a run id. Given a run id this picks that run's failed job (or its last job) and reads the latest attempt, mirroring what "depot ci logs" does.
Paging contract:
Without a pageToken you get the tail: the last "tailLines" matching lines of what was read. If the page cap stops the walk first, the result says so, the lines are the end of what was read rather than the end of the log, and nextPageToken continues forward from there.
With a pageToken you get the next window forward: up to "tailLines" lines in order from that point, and a new nextPageToken if more remain. Nothing in a forward window is ever dropped for the character budget; the window just closes early and the token resumes at the exact next line, so following nextPageToken until it is absent yields every line exactly once. That is how to follow a running job's output across turns.
Pass tokens back verbatim. Some are issued by this server rather than Depot; both are opaque.
Each line body is capped at 2000 characters ("bodyTruncated" marks the ones that were cut).
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | An attempt id, job id, or run id. Attempt ids give the most precise result. | |
| grep | No | Case-insensitive substring filter applied to line bodies by this server after fetching. Not a regular expression. | |
| stream | No | Keep only one output stream. stderr alone is often enough to spot a failure. | |
| stepKey | No | Keep only lines from this step, as reported in a line's stepKey. | |
| pageToken | No | Continue forward from a previous nextPageToken instead of returning the tail. Use this to poll a running job or to read a log from the start. | |
| tailLines | No | Maximum log lines per call: the last N of what was read without a pageToken, the next N forward with one. | |
| targetType | No | What "id" refers to. Omit to let the server work it out. | |
| includeTimestamps | No | Prefix each rendered line with its ISO timestamp. Costs context; usually not needed. |
Output Schema
| Name | Required | Description |
|---|---|---|
| lines | Yes | |
| notes | Yes | |
| target | Yes | |
| truncated | Yes | |
| pageCapHit | Yes | |
| linesMatched | Yes | |
| pagesFetched | Yes | |
| linesReturned | Yes | |
| nextPageToken | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description massively exceeds what the annotations (readOnlyHint, idempotentHint, destructiveHint) already provide: it discloses that grep is applied server-side after page fetches so it reduces received data but not read data, warns that grep walks up to DEPOT_MCP_MAX_LOG_PAGES pages and is the most expensive mode, documents the paging contract in full (tail vs forward, page-cap early stop, exact-line resumption), requires tokens to be passed back verbatim, and caps line bodies at 2000 chars with a bodyTruncated marker. This is deep behavioral disclosure with no contradiction against the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long, but every paragraph earns its place: purpose, sibling routing, filtering-cost model, id polymorphism, and the paging contract are all dense operational content rather than filler. It is front-loaded with purpose and the 'try depot_diagnose_ci_failure first' guidance, and the paging contract is given as a structured bulleted list, making it easy for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 8 parameters, a two-mode paging contract, polymorphic id handling, and an output schema; the description covers all of it, including defaults, the page cap, truncation markers, and even the cross-turn polling pattern ('following nextPageToken until it is absent yields every line exactly once'). With the output schema already present, no crucial invocation detail is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even though schema description coverage is 100% and the baseline is therefore 3, the description adds essential meaning beyond every parameter: id's polymorphic behavior (run id picks the failed or last job and reads the latest attempt), the cost differential between grep versus stepKey/stream, the paging semantics that give pageToken and tailLines their meaning, and the context-cost warning on includeTimestamps ('Costs context; usually not needed'). These semantics are required to invoke the tool correctly and reside only in the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening line 'Fetch a bounded slice of the persisted logs for a Depot CI job attempt' names a precise verb, resource, and scope, and the 'bounded slice' qualifier distinguishes this from a generic 'get all logs' tool. It also explicitly names depot_diagnose_ci_failure as the sibling it is not, so an agent can route correctly without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states unambiguously when to prefer the alternative ('Try depot_diagnose_ci_failure first') with concrete reasons why it is cheaper and what it contains, then gives exact conditions for using this tool ('when you need detail the diagnosis did not include: the full traceback, output from a step that did not fail, or a specific pattern'). This is fully explicit when/to-when-not guidance with a named alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_get_ci_metricsGet Depot CI CPU and memory metricsARead-onlyIdempotent
Read CPU and memory metrics for a Depot CI run, job, or job attempt.
Use this when a job died without a useful error, was killed abruptly, hit an exit code like 137, or is simply slow — the shapes to look for are memory sitting at its limit (an OOM kill) or CPU pinned at 100% for the whole job (under-provisioned runner).
"id" accepts a run, job, or attempt id and the level is inferred; set "level" to pick explicitly. Note that metrics for a still-running attempt grow between calls, so a snapshot time is reported.
Depot does not publish field names for these responses, so this tool returns the metrics it recognises plus the raw document (bounded) so nothing is lost. Very large metrics results are rejected by Depot itself with a resource-exhausted error — ask for a single attempt rather than a whole run if that happens.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | A run id, job id, or attempt id. | |
| level | No | Which level "id" refers to. Omit to infer; the server otherwise tries run, then job, then attempt. |
Output Schema
| Name | Required | Description |
|---|---|---|
| id | Yes | |
| level | Yes | |
| metrics | Yes | |
| rawJson | Yes | Depot's metrics document as JSON text, truncated if large. |
| likelyOom | No | |
| rawTruncated | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only and idempotent, and the description adds meaningful behavioral context: metrics for a running attempt change between calls, a snapshot time is reported, and the response includes the raw document because Depot publishes no field names. It also discloses the resource-exhausted failure mode and a workaround.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose, then flows from usage triggers to parameter behavior to response shape and failure handling. Every sentence adds information; no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description does not need to enumerate return fields, and it still covers param semantics, changing-data behavior, response composition, and error handling. An agent has enough context to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds important semantic detail: the level is inferred when omitted, and the server tries run, then job, then attempt. This goes beyond the schema's parameter descriptions and clarifies how 'level' and 'id' interact.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Read CPU and memory metrics for a Depot CI run, job, or job attempt.' The stated use cases (OOM kills, exit 137, under-provisioned runner) set it apart from sibling tools like depot_get_ci_logs and depot_get_ci_job_summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly instructs when to use the tool: when a job died without a useful error, was killed, hit exit 137, or is slow. It gives diagnostic patterns (memory at limit, CPU pinned) but does not name specific sibling alternatives or say when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_get_ci_runGet a Depot CI run treeARead-onlyIdempotent
Show one Depot CI run as its workflow -> job -> attempt tree, with the status of every node and the ids needed to drill in.
Use this to see the shape of a run: which jobs exist, which failed, and which attempt ids to pass to depot_get_ci_logs or depot_get_ci_metrics. Set failedOnly=true to cut a large matrix down to just the broken jobs.
This does not explain failures — it only reports structure and status. For root cause, call depot_diagnose_ci_failure with the same run id.
| Name | Required | Description | Default |
|---|---|---|---|
| runId | Yes | The run id, as returned by depot_list_ci_runs. | |
| failedOnly | No | Show only jobs that failed or were cancelled. Useful for wide build matrices. |
Output Schema
| Name | Required | Description |
|---|---|---|
| run | Yes | |
| jobCount | Yes | |
| workflows | Yes | |
| failedJobCount | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as readOnly, idempotent, openWorld=false, and non-destructive. The description adds important behavioral context beyond annotations: the tool only reports structure and status, does not explain failures, and returns node ids needed for drilling into logs/metrics. This is exactly the kind of limitation disclosure that helps an agent avoid misusing the result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight paragraphs, each earning its place: first defines the output, second gives concrete usage and the flag, third states the limitation and routes to the correct alternative. No filler or repetition of annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tree tool with an output schema and full parameter schema coverage, the description supplies all required context: what the output looks like, which jobs/attempts to inspect, how to filter, what the tool does not do, and which sibling to call for root cause. Nothing an agent needs to select or invoke the tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both runId and failedOnly clearly. The description reinforces failedOnly's purpose ('cut a large matrix down to just the broken jobs') but does not add meaning beyond what the schema provides. A baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: 'Show one Depot CI run as its workflow -> job -> attempt tree' with node statuses and drill-in IDs. It distinguishes itself from siblings by explicitly noting this tool does not explain failures and that root cause belongs to depot_diagnose_ci_failure.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit guidance on when to use the tool ('Use this to see the shape of a run'), how to use failedOnly for large matrices, and when not to use it ('does not explain failures') with a clear alternative call: depot_diagnose_ci_failure. It also tells the agent which attempt ids to pass to depot_get_ci_logs or depot_get_ci_metrics.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_get_projectGet one Depot project and its trust policiesARead-onlyIdempotent
Show one Depot container build project's full configuration together with its OIDC trust policies.
Use this to check build capacity and cache retention for a specific project, and to audit which external CI systems are allowed to exchange an OIDC token for Depot credentials — trust policies are the answer to "how does our GitHub Actions workflow authenticate to Depot without a stored token".
Trust-relationship tokens carry project-token permissions, which means they cannot reach the Depot CI API or the Depot API; only container builds and the registry.
| Name | Required | Description | Default |
|---|---|---|---|
| projectId | Yes | The project id, from depot_list_projects. |
Output Schema
| Name | Required | Description |
|---|---|---|
| project | Yes | |
| trustPolicies | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable security context beyond annotations: trust-relationship tokens carry project-token permissions and cannot reach the Depot CI API or Depot API, only container builds and the registry. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured with a front-loaded purpose sentence, followed by use cases and a security note. Each paragraph adds distinct information, though it is slightly longer than a purely minimal definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only single-resource tool with an output schema, the description covers purpose, use cases, and authentication semantics. Nothing needed to select and invoke the tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single projectId parameter is already documented as coming from depot_list_projects. The description adds no additional parameter-level meaning, so it does not need to compensate; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Show one Depot container build project's full configuration together with its OIDC trust policies.' This clearly distinguishes it from sibling list/diagnostic tools by narrowing scope to a single project and its trust policies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit use cases: 'check build capacity and cache retention for a specific project' and 'audit which external CI systems are allowed to exchange an OIDC token for Depot credentials.' It does not explicitly name when-not-to-use alternatives, but the 'specific project' framing makes the boundary clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_get_usageGet Depot usage and spend driversARead-onlyIdempotent
Report Depot usage for a period: container build minutes and minutes saved by caching, GitHub Actions runner minutes by repository and workflow, storage, and agent sandbox minutes.
Use this for cost questions — "what is burning our Depot minutes", "which repo dominates our runner bill", "is the cache actually paying for itself". minutesSaved against minutesBilled is the cache's return on investment; a project with high billed minutes and low saved minutes is where to look first.
This is also the only place Depot exposes managed GitHub Actions runner data through the API, and it is aggregated: there is no per-job runner list.
Pass projectId to scope to one container build project, which returns build counts, duration and layer cache size instead of the organization-wide breakdown. Defaults to the last 30 days.
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | Look back this many days from now. Ignored when startAt and endAt are both given. | |
| endAt | No | End of the window, RFC 3339 or YYYY-MM-DD. Dates are UTC. A date-only value is inclusive: "2024-01-31" covers all of 31 January. Requires startAt. | |
| startAt | No | Start of the window, RFC 3339 or YYYY-MM-DD. Dates are UTC; a date-only value means midnight at the start of that day. Requires endAt. | |
| projectId | No | Scope to one container build project instead of the whole organization. |
Output Schema
| Name | Required | Description |
|---|---|---|
| notes | Yes | |
| scope | Yes | |
| storage | Yes | |
| periodEnd | Yes | |
| periodStart | Yes | |
| agentSandbox | Yes | |
| projectUsage | No | |
| containerBuild | Yes | |
| githubActionsJobs | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, and the description adds valuable behavioral context: the data is aggregated, there is no per-job detail, projectId changes the response shape, and the default window is 30 days. It also explains the meaningfulness of minutesSaved vs minutesBilled, which goes beyond the structured schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized for a complex usage-reporting tool and is front-loaded with a concise summary of what it returns. Every sentence adds value: use cases, the uniqueness of the runner data, aggregation caveats, and scope behavior. There is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with an output schema, read-only annotations, and a rich input schema, this description is complete. It covers what data is returned, when to use it, how scope changes, exclusions, and default behavior. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by explaining that projectId returns build counts, duration, and layer cache size instead of the organization-wide breakdown, and by confirming the default look-back period. It does not deeply discuss startAt/endAt semantics, but the schema already covers those.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: it reports Depot usage for a period, enumerating build minutes, caching savings, runner minutes, storage, and sandbox minutes. It clearly differentiates this from sibling list/diagnose tools by framing it as the cost/spend reporting endpoint and noting it is the only API exposure for managed runner data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to use this for cost questions and gives concrete examples like 'what is burning our Depot minutes' and 'which repo dominates our runner bill'. It also clarifies that there is no per-job runner list, preventing misuse, and explains when to pass projectId to change scope.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_list_buildsList Depot container buildsARead-onlyIdempotent
List recent container builds for a Depot project, with duration and cache effectiveness for each.
Use this to find a build to diagnose, or to answer "are our builds getting slower" — every row carries cachedSteps, totalSteps and secondsSaved, so a run of builds with a low cache hit ratio is visible immediately without opening the dashboard.
Requires a projectId; DEPOT_PROJECT_ID is used when set, and depot_list_projects lists the options. These are container builds only, not Depot CI runs — use depot_list_ci_runs for those.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum builds to return. | |
| pageToken | No | nextPageToken from a previous call. | |
| projectId | No | The project to list builds for. Falls back to DEPOT_PROJECT_ID. |
Output Schema
| Name | Required | Description |
|---|---|---|
| builds | Yes | |
| returned | Yes | |
| projectId | Yes | |
| nextPageToken | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as read-only, idempotent, and non-destructive. The description adds useful behavioral context: it mentions the returned fields (cachedSteps, totalSteps, secondsSaved), the DEPOT_PROJECT_ID fallback, and that results are 'recent', which conveys ordering without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short paragraphs, each earning its place: the first defines the core function, the second gives concrete diagnostic use cases, and the third covers required context and sibling differentiation. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with an output schema, the description covers what the tool returns, how to select a project, when to use it, and what it is not. An agent has everything needed to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all three parameters with descriptions, so the baseline is 3. The description adds extra semantic value by stating 'Requires a projectId' despite the schema having no required fields, explaining the DEPOT_PROJECT_ID fallback, and pointing to depot_list_projects as a source for valid IDs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'List recent container builds for a Depot project, with duration and cache effectiveness for each.' It clearly distinguishes container builds from CI runs, and the semantics are aligned with the title and annotations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool: 'to find a build to diagnose, or to answer are our builds getting slower.' It also names the alternative: 'use depot_list_ci_runs for those' and points to depot_list_projects for project ID discovery.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_list_ci_artifactsList Depot CI artifactsARead-onlyIdempotent
List the artifacts a Depot CI run, workflow, job, or attempt uploaded, optionally with signed download URLs.
Use this to find out what a run produced — test reports, JUnit XML, coverage output, built binaries, screenshots from a failed browser test. Filter to one job or attempt by passing its id alongside runId.
Set withDownloadUrl=true to also fetch signed HTTPS URLs, which are minted one request per artifact and capped at 10 per call. This tool never downloads or reads artifact contents; it returns metadata and links only.
| Name | Required | Description | Default |
|---|---|---|---|
| jobId | No | Narrow to one job. | |
| limit | No | Maximum artifacts to return. | |
| runId | No | The run whose artifacts you want. | |
| attemptId | No | Narrow to one attempt. | |
| pageToken | No | Continue a previous listing: pass the nextPageToken from the last call, with the same filters. | |
| workflowId | No | Narrow to one workflow within the run. | |
| withDownloadUrl | No | Also mint a signed download URL per artifact. Costs one extra request each, capped at 10. |
Output Schema
| Name | Required | Description |
|---|---|---|
| notes | Yes | |
| returned | Yes | |
| artifacts | Yes | |
| nextPageToken | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds important behavioral detail beyond those annotations: signed URLs are minted one request per artifact, capped at 10 per call, and the tool only returns metadata and links without downloading contents. This is exactly the kind of context an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured: the first sentence captures the core operation, the second gives practical use cases, and the third explains the optional signed-URL behavior and its constraints. No sentence is wasted, and the most decision-relevant detail (never downloads contents) is included early.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and annotations covering safety, the description provides the remaining behavioral context an agent needs: what artifacts are for, how to narrow results, how signed URLs behave, and the cap. Pagination is handled by the schema's pageToken description, so nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter. The description adds some relational context (e.g., passing jobId/attemptId alongside runId, withDownloadUrl costing extra requests) but does not substantially expand beyond the schema's own descriptions. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List'), a precise resource ('artifacts'), and the exact scope ('a Depot CI run, workflow, job, or attempt'). It also clarifies what the tool does not do ('never downloads or reads artifact contents'), making its purpose unmistakable even among many sibling CI tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: 'Use this to find out what a run produced' with concrete examples, and explains when to filter by job or attempt. It does not explicitly compare against sibling tools like depot_get_ci_logs or depot_get_ci_job_summary, so an agent is left to infer those boundaries, but the guidance is otherwise strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_list_ci_runsList Depot CI runsARead-onlyIdempotent
List recent Depot CI runs, newest first, optionally filtered by status, repository, commit, trigger, or pull request.
Use this to find the run someone is talking about — "my last failed build", "did main go green", "what ran for PR 412" — and then pass the returned runId to depot_diagnose_ci_failure or depot_get_ci_run.
The fastest path to diagnosing a recent breakage is status=["failed"] with limit=1, then depot_diagnose_ci_failure on the runId that comes back.
Returns identity, status and timing only. It does not return logs or failure detail; use depot_diagnose_ci_failure for that.
| Name | Required | Description | Default |
|---|---|---|---|
| pr | No | Pull request number. Depot requires repo to be set alongside this. | |
| sha | No | Filter to runs for one commit SHA. | |
| repo | No | Repository in "owner/name" form. Required when filtering by pr. | |
| limit | No | Maximum runs to return in one call. | |
| status | No | Keep only runs in these states. "finished" means completed successfully; a failed run reports "failed". | |
| trigger | No | Filter by what started the run, for example "push" or "workflow_dispatch". | |
| pageToken | No | nextPageToken from a previous call, to fetch the following page. |
Output Schema
| Name | Required | Description |
|---|---|---|
| runs | Yes | |
| returned | Yes | |
| nextPageToken | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description only needs to add context beyond safety. It adds newest-first ordering, the limited return payload ('identity, status and timing only'), and the explicit absence of logs or failure detail. Pagination behavior is not described in prose, but the schema's pageToken parameter covers that gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core action and ordering, then moves to use cases, a recommended call pattern, and finally the boundary of what the tool returns. Every sentence earns its place and no sentence merely repeats the schema or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with a rich input schema and an output schema, the description covers ordering, filtering, return scope, exclusions, and next steps with the returned runId. An agent can both select this tool over siblings and invoke it correctly without needing further inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds value by grouping the optional filters into a readable list and by providing a concrete recommended argument combination: status=['failed'] with limit=1. It does not redefine each parameter, but the invocation pattern gives the agent useful guidance beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'List recent Depot CI runs' including ordering ('newest first'). It clearly names the filter dimensions and explicitly contrasts itself with depot_diagnose_ci_failure and depot_get_ci_run by stating what it returns and what it does not. This cleanly separates it from sibling list/detail/diagnosis tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives concrete use cases ('find the run someone is talking about', 'did main go green', 'what ran for PR 412') and a recommended fast path: status=['failed'] with limit=1, then depot_diagnose_ci_failure. It also explicitly says the tool does not return logs or failure detail and directs the agent to depot_diagnose_ci_failure for that, so when-to-use and when-not-to-use are both clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_list_ci_secretsList Depot CI secret names and scopingARead-onlyIdempotent
List the names and scoping of Depot CI secrets. Values are never returned — Depot's API does not expose them at all, by design.
Use this to answer "why can't my job see $FOO". Depot models a secret as one name with several variants, each scoped by repository, environment, branch, and workflow attributes; a job that cannot see a secret usually means no variant matches that job's scope. Compare what this returns against the job you are debugging.
Filtering happens in this server, because Depot's v3beta2 list filters are undocumented. Note that depot.ci.v3beta2 is a beta API and the most likely of Depot's surfaces to change.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Case-insensitive substring match on the name. | |
| branch | No | Keep variants scoped to this branch. | |
| workflow | No | Keep variants scoped to this workflow. | |
| repository | No | Keep variants scoped to this repository, plus unscoped ones. | |
| environment | No | Keep variants scoped to this environment. |
Output Schema
| Name | Required | Description |
|---|---|---|
| secrets | Yes | |
| returned | Yes | |
| valuesAvailable | Yes | Always false: Depot never returns secret values over the API. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare read-only, idempotent, non-destructive behavior. The description adds valuable context: secret values are never exposed by design, filtering happens server-side because upstream filters are undocumented, and the beta API is likely to change. These are meaningful behavioral disclosures beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and each paragraph earns its place: purpose and security first, then debugging guidance, then filtering and API risk. It is longer than one or two sentences, but nothing is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only listing tool with a diverse set of optional filters, the description covers the security model, scoping semantics, debugging workflow, server-side filtering rationale, and API stability. An agent has enough context to invoke the tool correctly and interpret its results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents each parameter. The description adds conceptual value by explaining how scoping works — a secret has variants scoped by repository, environment, branch, and workflow — which helps the agent understand why filters matter and how to interpret results. This goes beyond the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists Depot CI secret names and scoping, and explicitly notes that values are never returned. It is specific about the resource and action, but it does not explicitly distinguish itself from sibling tools like depot_list_ci_variables or depot_diagnose_ci_failure, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit use case: answer 'why can't my job see $FOO' and compare returned scoping against the job being debugged. It does not mention alternatives or provide when-not-to-use guidance, so it is not a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_list_ci_variablesList Depot CI variables and their scopingARead-onlyIdempotent
List Depot CI variables, their values, and their scoping.
Use this for the same "why can't my job see $FOO" question as depot_list_ci_secrets, and to check that a variable holds what you expect for a given branch or environment. Depot models a variable as one name with several variants, each scoped by repository, environment, branch, and workflow.
Unlike secrets, Depot does return variable values. Because variables are routinely misused to hold credentials, this server redacts any value whose name or content looks like a secret and reports which rule fired, so a redacted value still tells you the variable exists.
Filtering happens in this server. depot.ci.v3beta2 is a beta API and the most likely of Depot's surfaces to change.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Case-insensitive substring match on the name. | |
| branch | No | Keep variants scoped to this branch. | |
| workflow | No | Keep variants scoped to this workflow. | |
| repository | No | Keep variants scoped to this repository, plus unscoped ones. | |
| environment | No | Keep variants scoped to this environment. |
Output Schema
| Name | Required | Description |
|---|---|---|
| returned | Yes | |
| variables | Yes | |
| redactedCount | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the operation as read-only, idempotent, and non-destructive, so the description focuses on valuable extra behavior. It explains the variable-as-variants scoping model, reveals that values can be redacted when they resemble secrets, and warns that the underlying API is beta and likely to change.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose, then moves through use cases, behavioral nuances, and API stability in a logical order. Every sentence earns its place, and the length is appropriate for the tool's conceptual complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With annotations covering safety and an output schema present, the description only needs to explain selection and behavioral nuance, which it does thoroughly. It covers scoping, redaction, filtering location, and beta instability, leaving no important gap for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes all five optional parameters with 100% coverage, so the baseline is 3. The description adds meaningful semantic context by explaining that a single variable name can have multiple variants scoped by repository, environment, branch, and workflow, and by clarifying that filtering is performed server-side.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb and resource: it lists Depot CI variables, their values, and their scoping. It also distinguishes itself from the sibling depot_list_ci_secrets by explicitly noting that variables return values while secrets do not.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly identifies the use case: answering "why can't my job see $FOO" and checking whether a variable holds the expected value for a branch or environment. It references the sibling secrets tool, but does not give a strict when-not-to-use rule beyond the contrast that variables return values.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_list_imagesList images in a Depot project registryARead-onlyIdempotent
List the container images stored in a Depot project's registry, with tag, digest, push time, and size.
Use this to check whether a build actually pushed what you expected, to find the digest behind a tag before a deploy, or to see when an image was last refreshed.
Requires a projectId; DEPOT_PROJECT_ID is used when set, and depot_list_projects lists the options.
Read-only: this cannot delete tags or images. Image deletion is deliberately not exposed by this server, since it is irreversible and something may be deploying what you delete.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum images to return. | |
| pageToken | No | nextPageToken from a previous call. | |
| projectId | No | The project whose registry to list. Falls back to DEPOT_PROJECT_ID. |
Output Schema
| Name | Required | Description |
|---|---|---|
| images | Yes | |
| returned | Yes | |
| projectId | Yes | |
| nextPageToken | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint/idempotentHint/destructiveHint annotations, the description explicitly states the operation cannot delete tags or images and explains WHY deletion is not exposed—it is irreversible and something may be deploying what you delete. It also discloses the DEPOT_PROJECT_ID fallback behavior, adding context the annotation booleans alone do not convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The first sentence carries the core purpose, followed by short paragraphs for use cases, environment/parameter behavior, and a safety note. Every sentence earns its place, though four paragraphs is slightly more than strictly necessary for a simple list operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with an output schema, 100% schema parameter coverage, and four safety annotations, the description covers purpose, use cases, the projectId mechanism, and the read-only guarantee. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters are already fully documented (limit bounds and default, pageToken semantics, projectId fallback). The description only restates the projectId fallback in prose without adding new parameter-level detail, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'List the container images stored in a Depot project's registry, with tag, digest, push time, and size.' It names the exact returned fields, and no sibling tool covers image listing, so it is trivially distinguishable from the other fourteen depot_* tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Three concrete use cases are given: verifying a build pushed what was expected, finding the digest behind a tag before deploy, and checking when an image was last refreshed. It also routes the agent to depot_list_projects when the projectId is unknown. No alternative tool is named for exclusion, but the provided scenarios make selection unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_list_projectsList Depot container build projectsARead-onlyIdempotent
List Depot container build projects with their region, runner hardware, and cache policy.
Use this to find a projectId for depot_list_builds, depot_diagnose_build, or depot_list_images, and to check configuration that affects build speed: which region a project builds in, how large its runners are, and how much layer cache it retains before eviction.
These are container build projects. Depot CI runs are organised by repository and workflow instead — use depot_list_ci_runs for those.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum projects to return. | |
| regionId | No | Filter to one region, for example "us-east-1" or "eu-central-1". | |
| pageToken | No | Continue a previous listing: pass the nextPageToken from the last call. |
Output Schema
| Name | Required | Description |
|---|---|---|
| projects | Yes | |
| returned | Yes | |
| nextPageToken | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description does not need to repeat safety traits. It adds useful context beyond annotations by specifying what fields are returned and by clarifying the tool's scope relative to Depot CI runs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core action and payload, then provides concrete use cases and an explicit sibling distinction. Every sentence earns its place and there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of this read-only list tool, the presence of an output schema, and strong annotations, the description is complete. It tells the agent what to use the tool for, what it returns, and when to choose a different tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents all three parameters with 100% coverage, including defaults and examples. The description adds no parameter-specific detail, but the baseline of 3 is appropriate because the schema carries the full semantic burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List'), a specific resource ('Depot container build projects'), and key returned data ('region, runner hardware, cache policy'). It clearly distinguishes itself from CI-run tools by explicitly saying these are container build projects, not CI runs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use this tool: to find a projectId for list/diagnose operations and to check build-speed-related configuration. It also explicitly tells the agent to use depot_list_ci_runs for CI runs instead, providing a clear alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
depot_whoamiCheck the Depot token and its visible scopeARead-onlyIdempotent
Verify the configured Depot token and report which organizations and projects it can actually see.
Call this first whenever another Depot tool returns an empty list or a permission error. Depot's most common confusing failure is a token that spans several organizations with none selected: requests then resolve against the wrong organization and return empty results rather than an error. This tool says plainly whether that is happening and what to set.
Also reports whether write tools are enabled. This version of the server ships no mutating tools at all, so the answer is always that nothing can be modified.
Never returns the token or any part of it.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| apiUrl | Yes | |
| failures | Yes | |
| projects | Yes | |
| warnings | Yes | |
| activeOrgId | No | |
| tokenSource | Yes | |
| orgSelection | Yes | |
| projectCount | No | |
| organizations | Yes | |
| writesEnabled | Yes | |
| mutatingToolsAvailable | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes beyond the readOnly/idempotent annotations by disclosing that it reports visible organizations/projects, always indicates no mutating capabilities, and never returns the token itself. This gives the agent important security and expectation-setting context not present in annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and then adds usage guidance and security notes. It is slightly longer than strictly necessary, but each paragraph covers a distinct and valuable aspect, so the verbosity is justified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter diagnostic tool with an output schema and strong annotations, the description is complete. It covers when to call it, what it reports, a common failure scenario, and the crucial guarantee that it never exposes the token. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so the baseline is 4 and parameter documentation is unnecessary. The description appropriately focuses on what the tool returns rather than inputs, which is all that is needed here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Verify the configured Depot token and report which organizations and projects it can actually see.' This clearly distinguishes it from the list/get/diagnose sibling tools and makes its diagnostic role obvious.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly instructs the agent to call this tool first 'whenever another Depot tool returns an empty list or a permission error,' and explains the underlying failure mode. This is concrete, actionable guidance that an agent can apply without inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
16 tool updates
v0.1.0- First observed
depot_diagnose_build - First observed
depot_diagnose_ci_failure - First observed
depot_get_ci_job_summary - First observed
depot_get_ci_logs - First observed
depot_get_ci_metrics - First observed
depot_get_ci_run - First observed
depot_get_project - First observed
depot_get_usage - First observed
depot_list_builds - First observed
depot_list_ci_artifacts - First observed
depot_list_ci_runs - First observed
depot_list_ci_secrets - First observed
depot_list_ci_variables - First observed
depot_list_images - First observed
depot_list_projects - First observed
depot_whoami
TDQS
Every tool targets a distinct resource and action. The CI troubleshooting tools are cleanly separated by purpose—diagnose, logs, metrics, artifacts, secrets, variables, run structure—and the build/project/usage tools don't overlap with them or each other. Where tools could overlap, the descriptions explicitly explain when to use which.
All tools share the depot_ prefix and follow a consistent verb_noun pattern (list_*, get_*, diagnose_*). The few special names like depot_whoami still fit the command-style convention without breaking the overall predictability.
At 16 tools, this sits slightly above the ideal 3-15 range, but the count is justified by covering two related domains: Depot CI and container builds/registry/usage. Each tool has a clear purpose, so the size feels deliberate rather than bloated.
For a deliberately read-only server, the surface is thorough: run discovery, failure diagnosis, logs, job summaries, metrics, artifacts, secrets, variables, builds, projects, images, and usage. There are no obvious dead ends for diagnosing failures or answering configuration and cost questions.
Maintenance
Related MCP Connectors
Read-only MCP server for turva.dev, an agent-readiness audit and advisory service.
Read-only MCP access to a documented IT fleet: state, changes, posture. 15 tools.
Read-only MCP access to sessions, funnels, campaigns, errors, live visitors, and anomalies.
Read-only MCP tools for AI agent discovery, structured resources, and NIULAI information.
Related MCP Servers
- AlicenseAqualityCmaintenanceRead-only MCP tools for coding agents to audit deployment targets, detect fabricated code, review backlog, database schema, analytics, ML models, architecture docs, and decision lenses.1119MIT
- FlicenseNot gradedqualityCmaintenanceEnables MCP agents to inspect deployment knowledge extracted from a repository, covering workflows, services, deployments, and images.-
- AlicenseNot gradedqualityAmaintenanceA secure, local-first MCP server for read-only inspection and troubleshooting of development environments, exposing narrow, typed, auditable capabilities for repository inspection, log summarization, Docker review, and security scanning without granting unrestricted machine access.MIT
- FlicenseNot gradedqualityCmaintenanceEnables AI agents to investigate production incidents by exposing service health, logs, and deployment data through MCP tools.10-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/akshayjain3450/depot-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server