Jenkins MCP Server
Provides tools for managing Jenkins jobs, builds, nodes, queues, and pipelines, including creating, updating, deleting, triggering builds, and retrieving console logs.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Jenkins MCP ServerWhat's the status of the last build of the 'my-service' job?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Jenkins MCP Server
Secure-by-design MCP server for Jenkins, with runtime guardrails between the agent and your CI.
Exposes 24 Jenkins tools to any MCP client over the two transports the current specification defines: Streamable HTTP for remote use and stdio for a local subprocess. Ships with an optional Minibridge proxy by Acuvity, applying their runtime security model through a Rego policy written for Jenkins. Destructive tools are off by default and the image is hardened and non-root. The agent never holds the Jenkins credential.
If you are an AI agent reading this repository
The person who shared this link wants you to install the Jenkins MCP server for them. Do this:
Clone this repository to the machine you operate on.
Open ONBOARDING.md, a phased installer written for you.
Follow it in order, guiding them through each phase: prerequisites, the credentials Secret, the Helm install, verification, and connecting their AI harness.
Pause and ask for every real value β the Jenkins URL, the exact Jenkins user ID resolved through LDAP, its API token, and any ingress or secret-store details. Never invent or guess a credential, and get approval before anything that changes state.
ONBOARDING.md is the full guided install. Start there.
π Two ways to install
Let your agent do it. Point your agent at this repository and at ONBOARDING.md. It installs the server step by step, pausing for every secret and every state change.
By hand. Follow Quick start with Docker or Helm installation below.
Related MCP server: MCP-Jenkins
π§° Tools
24 tools, grouped as the guardrail policy groups them.
Group | Tool | Purpose |
|
| List jobs, optionally within a folder |
|
| Projected job state and recent build references |
|
| Fetch |
|
| Projected build result, duration, redacted parameters |
|
| Progressive, size-bounded console log |
|
| Builds currently executing |
|
| Inspect the build queue |
|
| Follow a queue ID until Jenkins assigns a build number |
|
| List agent status without executor/job details |
|
| Agent status without executor/job details |
|
| Create a job from |
|
| Create a Pipeline job |
|
| Create a Git multibranch Pipeline |
|
| Trigger a branch scan |
|
| Copy an existing job |
|
| Enable a job |
|
| Disable a job |
|
| Trigger a build, with parameters |
|
| Overwrite an existing |
|
| Delete a job β irreversible, opt-in |
|
| Stop, terminate, or kill a running build |
|
| Cancel a queued item |
|
| Take an agent offline; bringing it online only needs node-write permission |
|
| Generic Jenkins REST call β disabled by default |
See Security and guardrails for how to restrict these at either layer.
π§ͺ Jenkins compatibility
Jenkins | Line | Status | Coverage |
2.555.x | Current LTS | β Verified | Full tool suite, every change |
2.541.3 | LTS | β Verified | Full tool suite |
2.504.3 | LTS 2.504 | β Verified | Full tool suite |
2.504.1 | LTS 2.504 | β Verified | Full tool suite, pinned plugin set |
Other 2.x | β | βͺ Supported | Not covered by CI |
1.x | β | β Unsupported | Different URL scheme, no folders |
"Verified" means the full end-to-end suite ran against that core in CI: create a
Pipeline job, trigger it, stream the console, stop the build, delete the job,
with all 24 tools reachable. Reproduce any row with
compatibility.yml.
Run the current LTS line where possible: it is the only line receiving security backports.
Prerequisites on the Jenkins side
Authentication. A Jenkins user and an API token for it, created at People β user β Security β API Token. The account password is not accepted. That account's permissions bound everything this server can do; the least permission each tool needs is listed in docs/JENKINS_COMPATIBILITY.md.
Plugins. Core-only Jenkins covers the freestyle and node tools. Each plugin below enables a further group, and a missing one disables only the tools that depend on it.
Plugin | Enables |
| Any job path containing |
| Pipeline tools, and the |
| Multibranch tools |
βοΈ Capabilities
Native MCP Streamable HTTP endpoint at
/mcpand optional stdio transport.Job list/read/create/update/delete/copy/enable/disable.
Pipeline and Git multibranch Pipeline creation and scanning.
Build trigger, parameterized builds, running-build discovery, stop/terminate/kill.
Queue inspection, queue-to-build tracking, and cancellation.
Node inspection and optional online/offline management.
Streamed, size-bounded Jenkins responses, with progressive pagination for console logs.
Single-flight Jenkins crumbs, safe-read retries, timeouts, nested-folder paths, and TLS verification. Writes retry only failures known to occur before sending.
Read-only mode, job allowlists covering discovery and mutations, write-category controls, and JSONL auditing of allowed and refused calls.
Optional generic administrator REST request, disabled by default.
π¦ Published artifacts
ghcr.io/grglzrv/jenkins-mcp-server:<version>
ghcr.io/grglzrv/jenkins-mcp-server:<version>-minibridge
oci://ghcr.io/grglzrv/charts/jenkins-mcp-server --version <version>Release images are published for linux/amd64 and linux/arm64. The plain
image contains only the Python server. The -minibridge tag is a separately
built variant that bundles both executables in one container; Minibridge is not
a sidecar and is not downloaded at pod startup.
ποΈ Architecture
Requests pass through up to two independent enforcement layers before reaching Jenkins. The server's own policy always applies. The minibridge proxy is optional and adds a second layer in front of it.
Inside minibridge the three settings do different jobs, which is easy to
confuse because they sit side by side in values.yaml:
Setting | Question it answers | Nature |
| Which tools and capabilities may be called at all? | Deterministic, by name |
| Is the content flowing through safe? | Heuristic, pattern matching |
| Which engine evaluates, and does a violation block or only log? | Engine configuration |
minibridge is the component; guardrails is one key inside it. With
minibridge.enabled: false the guardrails list does nothing, because there is
no proxy to evaluate it.
The deployment path in the reference Kubernetes setup:
Hermes Agent
β HTTPS over Tailscale
βΌ
Tailscale Kubernetes Ingress
β
βΌ
Jenkins MCP Server /mcp
β HTTPS through Tailscale egress
βΌ
Jenkins controllerHermes never receives the Jenkins API token. The token stays in a Kubernetes Secret or external secret provider and is used only by the MCP server.
π³ Quick start with Docker
cp .env.example .env
# Configure Jenkins URL, LDAP-backed Jenkins user ID, API token, and CA bundle.
docker build --build-arg APP_VERSION=$(cat VERSION) \
-t jenkins-mcp-server:$(cat VERSION) .
docker run --rm \
--env-file .env \
-p 8000:8000 \
-p 8081:8081 \
-v "$PWD/certs:/certs:ro" \
jenkins-mcp-server:$(cat VERSION)Or use the maintained Compose deployment, which applies a read-only root filesystem, dropped capabilities, writable temporary mounts, and an audit volume:
cp .env.example .env
# Edit .env, keep it out of source control, and restrict its permissions.
# Keep the documented uppercase variable names; settings names are case-sensitive.
docker compose up server
# Run the single-container Minibridge variant instead. Its sample policy
# allows every non-destructive tool and refuses @destructive.
docker compose --profile minibridge up minibridgeDo not start both services together because they publish the same MCP port.
Health endpoints:
GET http://localhost:8081/healthz
GET http://localhost:8081/readyzMCP endpoint:
http://localhost:8000/mcpβΈοΈ Helm installation
For a production-shaped install, create the credentials Secret outside Helm and use the external-Jenkins example:
kubectl create namespace jenkins-mcp
kubectl -n jenkins-mcp create secret generic jenkins-mcp-secrets \
--from-literal=JENKINS_USERNAME='<actual-jenkins-login-id>' \
--from-literal=JENKINS_TOKEN='<JENKINS_API_TOKEN>'
helm upgrade --install jenkins-mcp \
oci://ghcr.io/grglzrv/charts/jenkins-mcp-server \
--version 2.10.10 \
--namespace jenkins-mcp \
--values examples/values/existing-secret.yaml \
--set-string jenkins.url=https://jenkins.example.comReplace the URL with the exact externally reachable Jenkins base URL, including any context path. The chart leaves NetworkPolicy disabled by default so an external controller protected by cluster/firewall allowlists remains reachable. Enable it only after modeling both MCP client ingress and Jenkins egress.
Credential-source rules, TLS/CA settings, NetworkPolicy, scaling, ingress, External Secrets, Tailscale, and the complete values reference live in the Helm chart guide. The examples index maps each supported deployment shape to a ready-to-edit values file or manifest.
The chart defaults preStopDelaySeconds to 5 so a terminating pod continues
serving while EndpointSlice, Service proxy, ingress, and load-balancer state
propagates. Set it to 0 to disable, or tune it from rollout measurements; it
must remain below terminationGracePeriodSeconds because the hook and process
shutdown share that total budget. Minibridge sessions are not migrated from a
terminated pod, so affected clients must reconnect and initialize again.
π Connecting a client
Transports
The MCP specification defines two transports, and this server implements both.
Select with MCP_TRANSPORT or --transport.
The direct HTTP server runs in stateless mode: it does not retain MCP sessions between requests. MCP 2.2's idle-session timeout and concurrent-session cap do not apply to that endpoint. Minibridge manages its own sessions around the private stdio process; Python SDK HTTP session settings do not control them.
Transport | Value | Use for |
Streamable HTTP |
| Remote and containerised deployments. Serves |
stdio |
| Running the server as a local subprocess of the client. No listener, no ports |
With minibridge.enabled=true, clients still use Streamable HTTP at /mcp:
minibridge.mode=http makes Minibridge own that public endpoint. Minibridge
then runs Jenkins MCP Server over a private stdio pipe inside the same container,
matching Acuvity's registry images. That internal hop is not a client transport,
does not open a second listener, and adds no sidecar or adapter.
flowchart LR
Client["MCP client"]
subgraph Container["One container in the pod"]
direction LR
MiniBridge["Minibridge AIO"] -->|"private stdio pipe"| Server["Jenkins MCP Server"]
end
Jenkins["Jenkins"]
Client -->|"Streamable HTTP /mcp"| MiniBridge
Server -->|"HTTPS API"| JenkinsHTTP+SSE as a separate transport, with its own /sse and /message
endpoints, was deprecated in the 2025-03-26 revision and is not offered here.
Streamable HTTP already streams over SSE within its single endpoint, which is
what current clients expect. A client that only speaks the legacy transport
needs an external compatibility bridge; the Minibridge deployment itself stays
single-container and adds no adapter.
Endpoints
Point the client at the /mcp path of whichever address exposes it. The exact
configuration keys differ per client, so use its own documentation for the
surrounding structure.
Deployment | Endpoint |
Helm chart, in-cluster |
|
Raw manifests, in-cluster |
|
Behind an ingress |
|
Every shipped Kubernetes MCP Service retains ClientIP affinity with a
600-second timeout. The direct HTTP server is stateless; affinity is needed for
Minibridge's stateful sessions when using multiple replicas. For Minibridge,
an ingress controller that bypasses Service load balancing or hides the original
client address needs equivalent controller-specific affinity. Affinity cannot
preserve Minibridge sessions when their owning pod restarts; clients must
reconnect and initialize a new session.
The Helm chart derives the Service name from the release, so a release named
jenkins-mcp in namespace jenkins-mcp gives
jenkins-mcp-jenkins-mcp-server.jenkins-mcp.svc.cluster.local. Read it back
rather than assuming:
kubectl -n <namespace> get svc -l app.kubernetes.io/name=jenkins-mcp-server \
-o jsonpath='{.items[0].metadata.name}'With an ingress, the controller assigns the hostname asynchronously:
kubectl -n <namespace> get ingress -l app.kubernetes.io/name=jenkins-mcp-server \
-o jsonpath='{.items[0].status.loadBalancer.ingress[0].hostname}'Whichever client you use, it never receives the Jenkins API token. The token stays in a Kubernetes Secret and is used only by this server.
For Hermes Agent specifically, mcp_servers is the correct top-level key and
an HTTP server is selected by url; do not add a transport field. Start from
deploy/hermes/mcp-config.yaml, or use
mcp-config-in-cluster.yaml with
the raw Kubernetes manifests. The optional timeout value is in seconds.
π‘οΈ Security and guardrails
Two independent layers. The server's own policy always applies; the minibridge proxy is optional and sits in front of it.
Runtime guardrails
Minibridge integration. Minibridge,
developed by Acuvity, establishes secure
agent-to-MCP connectivity, supports Rego and HTTP-based policy enforcement π΅οΈ,
and simplifies orchestration. The -minibridge image bundles it with a
Jenkins-aware Rego policy in a single container β no sidecar, nothing
downloaded at startup.
In the default minibridge.mode=http, Minibridge serves MCP 2025-03-26
Streamable HTTP at mcp.path (default /mcp). The Jenkins process is its
private stdio child, exactly like Acuvity's mcp-server-atlassian container;
the Service and ingress expose only Minibridge.
The guardrails below follow the runtime security model Acuvity defines for their
MCP server registry, with the
policy itself written for Jenkins: it treats the script console, credential
stores and $JENKINS_HOME as sensitive, and redacts Jenkins API tokens, crumbs
and session cookies.
Guardrail | Summary |
| Detects hidden or obfuscated directives, including instructions planted in build logs |
| Flags the script console, credential stores, |
| Identifies tool descriptions that override or redirect other tools |
| Rejects out-of-schema arguments used to smuggle instructions |
| Blocks references to tools outside this server |
| Redacts Jenkins API tokens, crumbs, session cookies, and complete PEM private-key blocks from responses |
| Optional shared secret restricting which clients may reach the server |
Each is enabled individually, so only the protections your environment needs are active. Tool policy is separate: deny by name or by group, and denied tools are removed from discovery as well as refused on call.
Hardened by default
Property | Detail |
Non-root, least privilege | uid 10001, all capabilities dropped, no privilege escalation, |
Immutable runtime | Read-only root filesystem with explicit writable mounts |
Irreversible actions opt-in | The master destructive switch, job deletion, and administrator requests are off by default; job paths are a glob allowlist and traversal segments are rejected |
Version pinning | Minibridge pinned to a release archive and checksum-verified at build |
SBOM and provenance | Attestations published for every image and release asset |
Continuous scanning | CodeQL, |
Verified, not asserted
Every tool is exercised against four Jenkins LTS lines in CI, and the chart is
installed into real k3s clusters across four Kubernetes versions β install,
upgrade, helm test, uninstall. A probe speaks MCP through the proxy and asserts
denied tools are absent from tools/list and refused on call.
The Jenkins account remains the outer boundary: these controls only narrow what that account can already do.
Server policy β always enforced
Applied in-process, so it holds whether or not the proxy is deployed.
Setting | Default | Effect |
|
| Glob allowlist for job reads, discovery, builds, and mutations. Queue cancellation resolves the owning job before authorization; traversal segments are rejected |
|
| Additional case-insensitive globs for build parameter names whose values |
|
| Refuses every write tool |
|
| Master gate for job updates/deletes, build stops, queue cancellation, and node offlining |
|
|
|
|
|
|
|
|
|
Jenkins permissions remain the outer boundary: these settings can only narrow what the account is already allowed to do.
minibridge proxy β optional
Enabled with minibridge.enabled=true, which selects the -minibridge image.
It filters tools before they reach the server and inspects content in both
directions.
Tool policy accepts individual names or these groups:
Group | Tools |
|
|
|
|
|
|
|
|
| every tool |
minibridge:
enabled: true
tools:
deny: ["@destructive", "@admin"] # denied tools are hidden and refusedContent guardrails are listed at the top of this file and configured under
minibridge.guardrails. All are off by default; enable only what the
environment needs.
Threat model, required production controls, secret handling and the known limitations are in SECURITY.md.
π©Ί Troubleshooting
Start with the workload and /readyz; readiness validates local configuration
but deliberately does not call Jenkins. A ready pod can still be blocked by
DNS, firewall rules, NetworkPolicy, TLS, a proxy/SSO redirect, credentials, or
Jenkins permissions.
The troubleshooting guide has the diagnostic commands and symptom-to-fix table. Jenkins versions, plugins, CSRF, and least-privilege permissions are covered in the compatibility guide.
π οΈ Development
make install
make lint
make coverage
make verify-versionWith Helm installed:
make helm-lint
make helm-templateFull Docker-based Jenkins TLS integration test:
make integrationπ·οΈ Releases and versioning
One semantic version covers the Python package, the image and the chart. The chart pins no image tag of its own:
image:
repository: ghcr.io/grglzrv/jenkins-mcp-server
tag: "" # empty means use Chart.appVersionChart.appVersion is the image tag, so a chart version identifies exactly one
application build. Chart-only changes therefore still take a full version bump β
the trade for that guarantee.
To cut a release: complete every [Unreleased] category in CHANGELOG.md, then
NEW_VERSION=2.10.10
make version VERSION="$NEW_VERSION" # promotes the notes, rewrites every version pinCommit, open a pull request, and merge once the checks pass. Merging publishes
automatically; no manual tag is needed. The workflow refuses to publish unless
the requested version matches VERSION, every pin agrees, the release notes are
complete, and release-impacting changes carry a strictly newer version.
Published per release:
ghcr.io/grglzrv/jenkins-mcp-server:<version> # also <major>.<minor>, <major>, latest
ghcr.io/grglzrv/jenkins-mcp-server:<version>-minibridge
oci://ghcr.io/grglzrv/charts/jenkins-mcp-server --version <version>Every push to main also publishes :edge, which the chart never references;
opt in with image.tag: edge.
Full procedure, script reference and review checklist: docs/releasing/RELEASE.md.
π Documentation
π Licence and attribution
Released under the MIT Licence β see LICENSE. That covers this
repository only. The -minibridge image additionally bundles
Minibridge by
Acuvity, under Apache 2.0, alongside its base
image's own packages; docker/Dockerfile.minibridge pins the exact Minibridge
source commit, verifies its checksum, and applies the repository's documented
compatibility backports before building it. The guardrail model this project's
Rego policy follows also originates with Acuvity's
MCP server registry.
This is an independent project, not affiliated with or endorsed by the Jenkins project or the Continuous Delivery Foundation. Jenkins is a registered trademark of the Continuous Delivery Foundation.
Available Tools
24 toolscancel_queue_itemA
Remove a queued item before it starts.
Destructive: the request to build is discarded. Takes the queue item id from get_queue, which is not a build number. Use stop_build for a build that is already running. Requires MCP_ALLOW_BUILD_WRITE, MCP_ALLOW_DESTRUCTIVE and MCP_ALLOW_BUILD_STOP.
| Name | Required | Description | Default |
|---|---|---|---|
| item_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so: it labels the operation destructive, states the concrete consequence ('the request to build is discarded'), and enumerates the three required permissions (MCP_ALLOW_BUILD_WRITE, MCP_ALLOW_DESTRUCTIVE, MCP_ALLOW_BUILD_STOP). This is exactly the behavioral context an agent needs before calling a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads purpose, then destruction, then parameter source, then the alternative tool, then auth requirements. Every sentence adds distinct information with no repetition of the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-argument cancel tool with no output schema, the definition covers purpose, consequence, argument provenance, sibling routing, and permission prerequisites. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and there is a single parameter, so the description must compensate. It does well by naming the source of item_id (get_queue) and explicitly disambiguating it from a build number, but it does not describe the integer format or error behavior for stale/invalid ids beyond what the schema implies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Remove/cancel) and resource (queued item) with precise scope ('before it starts'), and explicitly contrasts with the sibling stop_build for running builds. An agent can distinguish it from get_queue_item and stop_build without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names the alternative (stop_build) and the exact condition that selects it (build already running), defining when NOT to use this tool. It also tells the agent where the required argument comes from (get_queue), leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
copy_jobA
Copy an existing job's configuration to a new name.
The target inherits the source's settings, including its enabled or disabled state; build history and workspaces are not copied. Both source and target must be inside MCP_ALLOWED_JOBS. Jenkins requires Job/ExtendedRead on the source and Job/Create on the target parent; it also requires source Job/Configure when extended-read redacts secrets.
| Name | Required | Description | Default |
|---|---|---|---|
| source_job | Yes | ||
| target_job | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden well: it discloses what the copy inherits (settings, enabled/disabled state), what is deliberately not copied (build history, workspaces), an environment-level constraint (MCP_ALLOWED_JOBS), and the Jenkins permissions required (Job/ExtendedRead on source, Job/Create on target parent, Job/Configure when secrets are redacted). It stops short of stating what happens if the target already exists or whether it errors/overwrites.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action, then the copy semantics, then the constraints. Four dense sentences with almost no filler; the permission clause reads as a list but every item is actionable information rather than padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-param mutation tool with no annotations and no output schema, the description covers inheritance semantics, scope gating, and authorization. The remaining gap is failure behavior (existing target, permission-denied outcome), which an agent would need to call this confidently, but the essentials are present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the two parameters (source_job, target_job) rely entirely on the description. It adds a meaningful constraint that both must be in MCP_ALLOWED_JOBS, but gives no format guidance (full path vs name), no path-shape example, and no statement on whether target_job may pre-exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Copy an existing job's configuration to a new name') and explicitly scopes what is and isn't inherited (settings/state yes, history/workspaces no). That scope statement implicitly separates it from siblings like create_job_from_xml and update_job_config, though no sibling is named.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides real operating context (both jobs must be inside MCP_ALLOWED_JOBS, source/target permission requirements) but never says when to prefer this over create_job_from_xml, create_pipeline_job, or update_job_config, nor any when-not condition. Usage is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_job_from_xmlA
Create a job from a raw config.xml.
Fails if the name already exists. Prefer create_pipeline_job or create_multibranch_pipeline unless you need full control of the XML. Do not place plaintext credentials in the XML; reference Jenkins-managed credential IDs. The encoded body must fit MCP_MAX_REQUEST_BYTES.
| Name | Required | Description | Default |
|---|---|---|---|
| job_name | Yes | ||
| config_xml | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and largely meets it: it discloses the duplicate-name failure mode, a security rule about not embedding plaintext credentials (use Jenkins-managed credential IDs), and a request-size ceiling. It stops short of covering permissions/auth requirements or what happens to the job after creation, but this is unusually rich behavioral context for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short, front-loaded sentences with no filler: purpose first, then failure/alternatives, then the security warning, then the size constraint. Every sentence carries distinct operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-annotation, no-output-schema, two-param creation tool, the description covers usage, failure behavior, security, and size limits. Return-value details are absent, but the tool's response is low-stakes and the main decision inputs are all present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% with two required parameters, so the description must compensate. It clarifies config_xml as 'raw config.xml' and adds the encoded-body size limit, but job_name is left entirely unexplained. Partial compensation only.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create a job from a raw config.xml') and explicitly distinguishes itself from the sibling creation tools create_pipeline_job and create_multibranch_pipeline. An agent can tell exactly what this tool produces and when it is the right choice.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit routing advice: 'Prefer create_pipeline_job or create_multibranch_pipeline unless you need full control of the XML,' naming the alternatives and the condition that selects them. It also states a precondition (fails if the name already exists) and a constraint on use (body must fit MCP_MAX_REQUEST_BYTES).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_multibranch_pipelineA
Create a multibranch Pipeline that discovers branches from a Git repository.
Requires the workflow-multibranch, branch-api and git plugins. Run scan_multibranch_pipeline afterwards to populate branches immediately. repository_url must not contain embedded credentials, a query string, or a fragment. credentials_id names a credential already stored in Jenkins; never pass a token, password or private key in that field. script_path must be a canonical repository-relative path. The generated XML must fit MCP_MAX_REQUEST_BYTES.
| Name | Required | Description | Default |
|---|---|---|---|
| job_name | Yes | ||
| description | No | Managed by Jenkins MCP | |
| script_path | No | Jenkinsfile | |
| credentials_id | No | ||
| repository_url | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does so well: it discloses plugin dependencies, a hard payload limit ('generated XML must fit MCP_MAX_REQUEST_BYTES'), credential-handling rules ('never pass a token, password or private key'), and URL/path validity constraints. These are exactly the failure modes an agent needs warned about before calling a write tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded and every subsequent sentence encodes a distinct constraint, so there is no filler. The constraint clauses run together in one dense block without sub-structuring, which slightly harms scannability but wastes no words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a five-parameter mutation tool with no annotations and no output schema, the description covers the operationally risky details (credentials, URL format, size limit) thoroughly. It does not explain what happens on name collision or what the call returns, but return format is arguably outside its remit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds real meaning for three of five parameters: repository_url restrictions (no embedded credentials, query string, or fragment), credentials_id semantics (must name a stored Jenkins credential, not a raw secret), and script_path canonicality. job_name and description receive no guidance, leaving a small gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a precise verb+resource+scope: 'Create a multibranch Pipeline that discovers branches from a Git repository.' The 'multibranch' qualifier implicitly separates it from the sibling create_pipeline_job, but it never names that sibling or explicitly contrasts a single-branch pipeline, so an agent must infer the distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear operational context: plugin prerequisites (workflow-multibranch, branch-api, git) and the follow-up step 'Run scan_multibranch_pipeline afterwards to populate branches immediately', which ties this tool to a named sibling. It stops short of stating when NOT to use this tool or when create_pipeline_job would be the better choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_pipeline_jobA
Create a Pipeline job from an inline Jenkinsfile.
The script runs in the Groovy sandbox. Requires workflow-job and workflow-cps, both included in the workflow-aggregator plugin. Reference Jenkins credential IDs; do not put plaintext secrets in the Jenkinsfile. The generated XML must fit MCP_MAX_REQUEST_BYTES.
| Name | Required | Description | Default |
|---|---|---|---|
| job_name | Yes | ||
| description | No | Managed by Jenkins MCP | |
| jenkinsfile | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, this description carries the full burden and does notable work: Groovy sandbox execution, required plugins, credential-ID-only guidance against plaintext secrets, and a MCP_MAX_REQUEST_BYTES size constraint. It stops short of stating idempotency (behavior when the job already exists) or the response shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, purpose front-loaded, each sentence contributing a distinct operational fact. No redundancy or padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with zero annotations and no output schema, the description covers environment, security, and size constraints well. It leaves gaps on return values and what happens on name collision, but is otherwise sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It adds genuine content constraints for the jenkinsfile parameter (sandbox, credential references, size limit), but job_name and description remain undocumented beyond self-explanatory titles, so coverage is partial.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Create), resource (Pipeline job), and source format (inline Jenkinsfile). The 'inline Jenkinsfile' scoping cleanly separates it from create_job_from_xml and create_multibranch_pipeline without needing to name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Prerequisites are spelled out (workflow-job and workflow-cps via workflow-aggregator), which implies the environment needed to use it. However, it never says when to prefer this over create_job_from_xml or create_multibranch_pipeline, so alternative selection is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_jobA
Delete a job and all of its build history.
Destructive and irreversible through this server: Jenkins core removes the job and its builds, so recovery requires an external backup. Disabled by default; requires MCP_ALLOW_JOB_WRITE, MCP_ALLOW_DESTRUCTIVE and MCP_ALLOW_JOB_DELETE. Confirm with get_job first.
| Name | Required | Description | Default |
|---|---|---|---|
| job_name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so: it declares the operation destructive and irreversible, explains why recovery needs an external backup, and enumerates the exact environment gates that must be enabled. This is exactly the behavioral context an agent needs before firing an unrecoverable write.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the destructive outcome, then recovery implications, then prerequisites. Every sentence carries distinct, actionable information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter destructive tool with no annotations and no output schema, the definition covers what is removed, irreversibility, and the required gating flags. Only minor gaps remain: no statement of error behavior for a non-existent job and no explicit non-destructive alternative.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single parameter 'job_name' has no schema description, so the description is the only place semantics could be supplied. It never states the expected identifier form (display name vs. full path vs. URL segment) or what happens on a name mismatch, adding essentially no meaning beyond the schema's field name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource with scope ('Delete a job and all of its build history'), which cleanly separates it from siblings like disable_job or list_jobs. The addition of 'all of its build history' disambiguates the blast radius beyond a bare delete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear preconditions ('Disabled by default; requires MCP_ALLOW_JOB_WRITE, MCP_ALLOW_DESTRUCTIVE and MCP_ALLOW_JOB_DELETE') and a workflow directive ('Confirm with get_job first'). It does not name a non-destructive alternative such as disable_job for the case where history should be preserved, so it stops short of full when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
disable_jobA
Disable a job so Jenkins stops building it.
Queued builds are not cancelled; use cancel_queue_item for those. The job and its history are kept, so this is reversible with enable_job.
| Name | Required | Description | Default |
|---|---|---|---|
| job_name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral load, and it does: queued builds are unaffected, the job and its history survive, and the action is reversible. It omits what happens to currently running builds and any permission requirements, which keeps it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, zero filler, and the core effect is front-loaded before the caveats and the alternative-tool pointer. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a reversible state-change tool with no annotations and no output schema, the description covers the essential behavior an agent needs: effect, side-effect boundary, reversibility, and an alternative. Only permission/authorization context and the running-build question are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never mentions job_name or its expected format. Given there is exactly one self-evident required parameter, this is a minor gap rather than a damaging one, so a baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (disable) and resource (job) with the effect ('so Jenkins stops building it'), and distinguishes itself from siblings by naming cancel_queue_item and enable_job. An agent can route between disable_job, enable_job, cancel_queue_item, and delete_job without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent away from this tool when the goal is cancelling queued builds ('use cancel_queue_item for those') and notes reversibility via enable_job. It stops short of a direct when-to-use-vs-delete_job statement, but the alternative coverage is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
enable_jobB
Enable a job so Jenkins will build it. Safe to call when already enabled.
| Name | Required | Description | Default |
|---|---|---|---|
| job_name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses idempotency (safe on an already-enabled job), which is real behavioral value, but omits permissions needed, error behavior for a missing job, and whether the change is reversible.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with the action stated first and the safety note second. Nothing is padded or redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter mutation with no annotations and no output schema, the idempotency note covers the most important behavioral trait, but the undocumented parameter and absent auth/error context leave gaps an agent would need.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
One parameter at 0% schema coverage means the description must compensate, and it does not: job_name is never described, so an agent gets no guidance on format (plain name vs folder path) or valid values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Enable a job') and adds the effect ('so Jenkins will build it'). The sibling set includes disable_job, so the direction of the toggle is unambiguous, though it never names the sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The clause 'Safe to call when already enabled' gives useful idempotency guidance, but there is no explicit statement of when to enable versus alternatives, nor any prerequisites or permission requirements.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_build_consoleA
Read a build's console output.
Output is truncated to MCP_MAX_LOG_BYTES; pass the returned next_start back as start to continue reading, which is how a running build is followed. build_number accepts a number or an alias such as lastBuild. Invalid or incomplete Jenkins pagination metadata is refused rather than guessed.
| Name | Required | Description | Default |
|---|---|---|---|
| start | No | ||
| job_name | Yes | ||
| build_number | No | lastBuild |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does disclose real behavior: output is truncated to MCP_MAX_LOG_BYTES, pagination continues via the returned next_start, and invalid/incomplete pagination metadata is refused rather than guessed. It omits auth requirements and what happens for a nonexistent build or job.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences, front-loaded with the core action, then truncation, then continuation, then alias/error behavior. Every sentence carries distinct, non-redundant information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description still covers the return shape (truncated log plus next_start) and the continuation loop, plus an error-refusal policy. It stops short of describing failure modes like missing jobs/builds or permission requirements, which an agent might need.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it documents two of three parameters meaningfully: build_number accepts a number or an alias such as lastBuild, and start is the continuation cursor fed by next_start. Only job_name is left to inference, and it is self-evident from the name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Read a build's console output.' This implicitly separates it from the sibling get_build_info (metadata) by naming the console output, but it never explicitly names or contrasts any sibling, so a 4 rather than a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It supplies one usage context implicitly: 'which is how a running build is followed,' telling the agent this tool is the way to tail a live build. It gives no explicit when-not guidance or named alternative (e.g. get_build_info for status), so guidance is implied rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_build_infoA
Get one build's result, timing, duration and parameters.
build_number accepts a number or an alias such as lastBuild, lastSuccessfulBuild or lastFailedBuild. Secret-like parameter names and password/token/credential parameter classes have redacted values. Complex plugin parameter values and unrelated action/change-set payloads are not returned.
| Name | Required | Description | Default |
|---|---|---|---|
| job_name | Yes | ||
| build_number | No | lastBuild |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does real work here: it discloses that secret-like parameter names and password/token/credential classes are redacted, and that complex plugin values and action/change-set payloads are omitted. That is substantive behavioral disclosure about the shape and safety of the response. It stops short of stating read-only semantics, auth requirements, or behavior for a nonexistent build.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences, front-loaded with the core purpose, then parameter semantics, then output caveats. Every sentence adds information and none is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description does the heavy lifting: it summarizes the returned fields and flags redaction and payload omissions. The main gap is the undescribed required job_name parameter and no note on failure behavior when a build does not exist.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does explain build_number well (integer or aliases lastBuild/lastSuccessfulBuild/lastFailedBuild), but job_name is never described at all, leaving one of two parameters undifferentiated across schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('Get one build's result') and enumerates exactly what is returned: result, timing, duration and parameters. That field list distinguishes it from siblings like get_build_console or list_running_builds without needing to open either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied by the returned fields (build status/timing rather than console text), but the description never states when to prefer this over get_build_console, get_job, or list_running_builds, nor any exclusions or prerequisites. Guidance is present only at the parameter level (alias values), not at the tool-selection level.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_jobA
Get one job's current state: description, buildable flag, health and the most recent build references. Use get_job_config for its XML definition, or get_build_info for a specific build. Plugin actions and upstream/downstream job objects are not returned.
| Name | Required | Description | Default |
|---|---|---|---|
| job_name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses meaningful behavioral content beyond the schema by enumerating what is and is not returned, and 'current state' implies a read operation, but it does not mention permission requirements or side-effect profile explicitly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the resource and return contents, followed by scoping and exclusions in two tight sentences. Every clause carries routing or scope information; nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description fills the main gap by describing the returned fields and exclusions. It is sufficient for correct invocation, though permission and error behavior are left unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and there is one parameter (job_name) with no description. The parameter name is largely self-evident, but the description adds no format, identification, or addressing guidance to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Get) and resource (one job) and enumerates exactly what is returned: description, buildable flag, health, and recent build references. It distinguishes itself from get_job_config and get_build_info directly, so an agent can separate this from its siblings without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes to alternatives with conditions: get_job_config for the XML definition, get_build_info for a specific build. It also states what is out of scope (plugin actions, upstream/downstream job objects), which is exactly the when-not guidance an agent needs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_job_configA
Fetch a job's config.xml definition.
Requires Job/ExtendedRead in Jenkins; Job/Read alone is not enough and fails with 403 while other tools keep working.
| Name | Required | Description | Default |
|---|---|---|---|
| job_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does add real operational context: it requires Job/ExtendedRead and will 403 with Job/Read alone. That failure-mode disclosure is valuable, though it does not state read-only semantics explicitly (implied by 'Fetch') or output behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the action front-loaded and the permission caveat immediately after. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists so return values need no explanation, and the auth caveat covers the main non-obvious risk. Only the job_name semantics and sibling routing remain unaddressed, which is a minor gap for a single-param read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single job_name parameter, and the description adds no format or naming guidance for it. It neither compensates for the gap nor misleads, so it sits at the minimum viable level.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: fetch a job's config.xml definition. This clearly distinguishes it from generic metadata fetches, though it does not explicitly contrast with sibling get_job, which also pertains to a single job.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not guidance versus alternatives like get_job or update_job_config. Usage is only implied by the fact that it returns the raw config.xml, which the agent must infer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_nodeA
Get one node's capacity, idle state and offline reason.
Current-build details are intentionally excluded; use list_running_builds for running jobs filtered through MCP_ALLOWED_JOBS. Node names are case sensitive and must not be empty.
| Name | Required | Description | Default |
|---|---|---|---|
| node_name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose real behavioral traits: current-build details are deliberately excluded, and node names are case sensitive and cannot be empty. It does not state the safety/read-only nature explicitly or the response shape, but the input constraints and exclusions are substantive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with what is returned before the exclusions and input constraints. Slightly awkward line wrapping but no wasted content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description supplies the return fields, the intentionally excluded data, an alternative tool, and the input validation rules. The one gap is that it never characterizes the operation as a safe read, but an agent has enough to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single node_name parameter, so the description must compensate, and it does by specifying case sensitivity and that the value must not be empty. This adds meaning well beyond the bare 'string' type in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get one node's') and enumerates the exact data returned: capacity, idle state, offline reason. It also distinguishes itself from the sibling list_running_builds, so an agent can tell it apart without opening another schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent to list_running_builds for current-build details and explains why they are excluded here. It does not name the more directly competing sibling list_nodes (for enumerating all nodes) or set_node_offline, so it stops short of full when/when-not coverage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_queueA
List builds waiting to start, with why each is blocked.
A queue item is not a build yet and has no build number; it gains one when an executor picks it up. Items outside MCP_ALLOWED_JOBS are omitted. Queue actions and build-parameter values are not returned.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the item lifecycle (no build number until an executor picks it up), an authorization-based filter (MCP_ALLOWED_JOBS), and explicit negative scope (queue actions and build-parameter values are not returned). It stops short of mentioning ordering, staleness, or whether the call is read-only in cost terms.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, all front-loaded onto the payload-defining facts, with zero filler. Each sentence adds a distinct piece of information: what is listed, what a queue item is, and what is filtered out.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-annotations, no-output-schema read tool, the description covers identity, lifecycle, filtering, and excluded fields well. Remaining gaps are minor (ordering of items, how blocked reasons are formatted).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4; there is no parameter surface for the description to compensate for or contradict.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List builds') plus its distinguishing scope ('waiting to start'), which separates it from siblings like list_running_builds and get_queue_item. The clarifying sentence that a queue item is 'not a build yet' and has no build number pins down exactly what set is returned.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The MCP_ALLOWED_JOBS filtering constraint implies when results will be incomplete, but the description never says when to reach for get_queue versus get_queue_item or list_running_builds. Usage is inferable from the concept, not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_queue_itemA
Follow one queued build from trigger to executor assignment.
Pass queue_id from trigger_build. While waiting, the response explains why the item is blocked; once Jenkins starts it, executable contains the build number and URL needed by get_build_info. The owning job must match MCP_ALLOWED_JOBS. Jenkins retains completed queue records only briefly.
| Name | Required | Description | Default |
|---|---|---|---|
| item_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations the description carries full load, and it delivers real behavioral context: the response explains why an item is blocked, the 'executable' field appears once Jenkins starts the build, and completed queue records are only briefly retained. It stops short of declaring read-only status or permission/auth requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the tool's purpose, then lifecycle and caveats. Four sentences with little waste, though it is dense and packs several distinct points together.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No annotations or output schema, so the description must supply everything. It covers response contents (block reason, executable fields), the calling workflow, an access constraint, and a retention caveat β nearly complete, missing only explicit read-only/permission framing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% for the single 'item_id' parameter, so the description must compensate. It explains provenance ('Pass queue_id from trigger_build'), but the mismatch between the schema name 'item_id' and the description's 'queue_id' risks confusing the agent about what value to supply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: 'Follow one queued build from trigger to executor assignment.' This clearly distinguishes it from siblings like get_queue (list all), cancel_queue_item (cancel), and trigger_build (create).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names trigger_build as the source of the id and get_build_info as the downstream consumer, establishing the workflow context. It also states a hard constraint (owning job must match MCP_ALLOWED_JOBS), but gives no explicit when-not-to-use or contrast with get_queue.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
jenkins_admin_requestA
Send an arbitrary authenticated request to a Jenkins path.
A powerful escape hatch for endpoints no other tool covers, disabled by default and requiring MCP_ALLOW_ADMIN_REQUEST. MCP_ALLOWED_JOBS still applies to job URLs. The Groovy console additionally requires MCP_ALLOW_SCRIPT_CONSOLE and remains blocked by Minibridge when its sensitive-pattern guardrail is active. Non-read methods can mutate or delete Jenkins state and are not gated by MCP_ALLOW_DESTRUCTIVE; confirm the exact method, path and body first. path must be Jenkins-relative and absolute, for example /api/json. Session and CSRF headers are withheld from the response. Unlike typed mutation tools, raw 3xx responses are returned for the caller to interpret. The encoded body must fit MCP_MAX_REQUEST_BYTES.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | ||
| path | Yes | ||
| method | Yes | ||
| content_type | No | application/json |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden and does so thoroughly: gate flags, that non-read methods mutate or delete state and are NOT gated by MCP_ALLOW_DESTRUCTIVE, that session/CSRF headers are withheld from responses, that raw 3xx responses are passed through unlike typed tools, and the MCP_MAX_REQUEST_BYTES limit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and the escape-hatch framing, then the gating and safety notes. Dense and mostly economical, though the run of environment-variable clauses makes it slightly heavier than necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a high-risk arbitrary-request tool with no annotations and no output schema, the description covers gating, mutation risk, header stripping, redirect behavior, and size limits. An agent has everything needed to invoke it safely and interpret the non-standard response handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It clarifies that path is Jenkins-relative and absolute with the example '/api/json', and that the encoded body must fit MCP_MAX_REQUEST_BYTES. Method semantics (allowed HTTP verbs) are only implied rather than spelled out, so it falls short of full compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Send an arbitrary authenticated request to a Jenkins path.' It also positions itself against siblings by calling itself 'a powerful escape hatch for endpoints no other tool covers,' so an agent can distinguish it from the typed mutation tools without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly defines when to use it ('endpoints no other tool covers') and when it will not work: disabled by default, needs MCP_ALLOW_ADMIN_REQUEST, MCP_ALLOWED_JOBS applies to job URLs, and the Groovy console needs MCP_ALLOW_SCRIPT_CONSOLE. It also warns to confirm method/path/body before non-read calls.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_jobsA
List jobs visible to this server, optionally within a folder.
Returns name, full path, URL and build colour. Pass a folder's full name, for example "Platform", to list its immediate children. Jobs outside MCP_ALLOWED_JOBS are omitted rather than reported as errors. Arbitrary plugin action/property payloads are not returned.
| Name | Required | Description | Default |
|---|---|---|---|
| folder | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does disclose real behavioral traits: it filters results through MCP_ALLOWED_JOBS, omits rather than errors on disallowed jobs, and explicitly limits payloads by excluding plugin action/property data. It does not mention pagination, result-size limits, or auth requirements, so it is strong but not complete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, front-loaded with the core purpose followed by return fields and behavioral caveats. Every sentence adds information an agent needs; no filler or restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description correctly fills the gap by enumerating returned fields (name, full path, URL, build colour) and the allowlist filtering behavior. It leaves pagination and error/auth conditions unaddressed, so it is good but not fully complete for a listing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the lone 'folder' parameter is undocumented in the schema, so the description must compensate. It does: it specifies the expected format ('full name'), gives a concrete example ('Platform'), and defines the effect (list its immediate children), though the 'full name' vs returned 'full path' phrasing is slightly ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List jobs') with an explicit scope qualifier ('visible to this server, optionally within a folder'). It is easy to distinguish from get_job or list_running_builds by the scope, though it never names a sibling directly, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description tells the agent exactly when and how to use the folder argument ('Pass a folder's full name, for example "Platform", to list its immediate children'), which is clear conditional guidance. It stops short of stating when not to use this tool in favor of a sibling such as get_job, so no explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_nodesA
List build nodes with their capacity, idle and offline state.
Executor/current-build details are intentionally excluded; use list_running_builds for running jobs filtered through MCP_ALLOWED_JOBS.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses a scope boundary (executor/current-build data excluded) and hints that list_running_builds output is filtered through MCP_ALLOWED_JOBS, but says nothing about permissions, result size, or pagination for this call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the core action and its returned fields, followed by the exclusion and the routing pointer. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read tool with no output schema and no annotations, the description supplies the essentials: what is listed, which fields matter, and what is deliberately omitted. Return shape and ordering remain unspecified, but that is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so there is nothing to document; the schema trivially covers the empty argument object. Baseline 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List build nodes') and names the attributes returned (capacity, idle and offline state). It distinguishes itself from the builds-oriented sibling list_running_builds, though it does not contrast with the single-node sibling get_node.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent what is out of scope ('Executor/current-build details are intentionally excluded') and routes to the named alternative ('use list_running_builds'). Clear condition for choosing the sibling, but no guidance on when list_nodes itself is preferred over get_node.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_running_buildsA
List builds currently executing across the controller, with their job and build number. Jobs outside MCP_ALLOWED_JOBS are omitted. Use get_build_console to follow one. Plugin-specific executor/action payloads are not returned.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose real behavioral traits: access scoping (jobs outside MCP_ALLOWED_JOBS are omitted) and payload truncation (plugin-specific executor/action payloads are not returned). It does not state ordering, volume limits, or that the call is a safe read, leaving gaps for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each earning its place: what is listed, what is filtered, what to use next, and what is omitted. The core purpose is front-loaded with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must convey return shape, and it does (job and build number) while stating what is excluded from the payload. Minor gaps around result ordering and whether the list is paginated keep it from a 5 for an unannotated listing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing to misinterpret and the baseline is 4. The description correctly implies an unfiltered, no-argument listing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('List') and resource ('builds currently executing') plus the scope ('across the controller') and the fields returned ('their job and build number'). This is clearly distinguishable from siblings like get_queue (queued vs executing) and get_build_console (following a single build).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit routing advice: 'Use get_build_console to follow one,' which names the alternative and the condition that selects it. It also states a usage-relevant constraint (jobs outside MCP_ALLOWED_JOBS are omitted) but offers no other when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_multibranch_pipelineA
Trigger a branch scan on a multibranch Pipeline so newly pushed branches are discovered without waiting for the next scheduled scan.
| Name | Required | Description | Default |
|---|---|---|---|
| job_name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does disclose that this is a trigger (not a read) that causes branch discovery, but it omits meaningful side effects a caller needs, such as whether the scan may immediately kick off builds on newly found branches, what permissions are required, and whether the response is immediate or asynchronous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single well-formed sentence with the action front-loaded and a rationale clause; no filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema and no annotations, the description covers the core action but leaves gaps: the lone parameter is unexplained, the return/behavior after triggering is unspecified, and the preconditions (e.g. that the job must actually be a multibranch pipeline) are unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter job_name has no schema description (0% coverage) and the description never references it, so there is no added meaning about naming, required format, or whether it must reference a multibranch job specifically. With low coverage the description should compensate but does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action (trigger a branch scan) on a specific resource (a multibranch Pipeline), which cleanly separates it from sibling mutation tools like trigger_build or create_multibranch_pipeline. An agent can tell what this does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'so newly pushed branches are discovered without waiting for the next scheduled scan' clause implies the scenario for using it, but there is no explicit when-not guidance or comparison against alternatives such as waiting for the scheduled scan or calling trigger_build. Usage is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_node_offlineA
Take a node offline, or bring it back online.
Taking a node offline is destructive: running builds keep going but no new work is scheduled there, which can stall a pipeline. Requires MCP_ALLOW_NODE_WRITE, and taking offline additionally requires MCP_ALLOW_DESTRUCTIVE.
| Name | Required | Description | Default |
|---|---|---|---|
| message | No | Managed by MCP | |
| offline | Yes | ||
| node_name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full disclosure burden and does so well: it labels the offline action destructive, explains the exact runtime effect on running vs new builds, and states the auth requirements (MCP_ALLOW_NODE_WRITE, plus MCP_ALLOW_DESTRUCTIVE for offline). This is the safety-relevant context an agent needs before mutating a node.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the two-way action, followed by a compact paragraph on destructiveness and prerequisites. Nearly every sentence earns its place; the auth sentence could be tightened slightly, but there is no padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-annotation, no-output-schema mutation tool, the behavioral side is complete β effects, risk level, and prerequisites are all stated. The remaining gap is parameter documentation (0% schema coverage), which an agent would need to supply from convention rather than the definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for three parameters, so the description is the only source of meaning and it explains none of them. The boolean 'offline' is inferable from the prose, but node_name and message (with its 'Managed by MCP' default) get no explanation, leaving the agent to guess at the naming format and the purpose of the message field.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource pair ('Take a node offline, or bring it back online') that precisely names the state mutation this tool performs. It is trivially distinguishable from the read-only siblings list_nodes and get_node, so an agent can select it without inspecting schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly frames the offline branch as destructive and describes the operational consequence (running builds continue, no new work is scheduled, pipelines can stall), plus the required environment gates. It stops short of naming alternatives (e.g. use get_node/list_nodes to inspect state first), so it is clear context rather than explicit when/when-not routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stop_buildA
Stop a running build.
Destructive: the build is abandoned and marked ABORTED, and any work it had done is lost. mode escalates from stop to term and then kill. Freestyle builds support only stop; term and kill are Pipeline-only and require workflow-job. Requires MCP_ALLOW_BUILD_WRITE, MCP_ALLOW_DESTRUCTIVE and MCP_ALLOW_BUILD_STOP.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | stop | |
| job_name | Yes | ||
| build_number | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it flags destructiveness, the resulting ABORTED state, that completed work is lost, the mode escalation semantics, and the three required environment flags (MCP_ALLOW_BUILD_WRITE, MCP_ALLOW_DESTRUCTIVE, MCP_ALLOW_BUILD_STOP).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded one-line summary followed by tightly packed constraints; every sentence adds operational information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation tool with no annotations and no output schema, the description covers effects, preconditions, and mode behavior well. Minor gaps remain, e.g., behavior when the build is already finished or per-job permission nuances.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the schema gives mode only a default, so the description must compensate. It thoroughly explains mode (escalation and build-type restrictions), which is the non-obvious parameter; job_name and build_number are obvious by name but left undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource in the first line: 'Stop a running build.' Clearly distinguishes itself from siblings like trigger_build, get_build_info, and cancel_queue_item.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains the mode escalation path (stop -> term -> kill) and the key constraint that Freestyle builds support only stop while term/kill are Pipeline-only and require workflow-job. It does not explicitly compare against siblings such as cancel_queue_item, so it stops short of a full routing guide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
trigger_buildA
Queue a build.
Returns a validated queue_id and a canonical queue_url built from configured JENKINS_URL, not a build number: the build has not started yet. Poll get_queue_item until its executable has a number, then use get_build_info. For a parameterised job pass parameters, using an empty object to accept every default; omitting it entirely makes Jenkins reject the trigger. Their encoded form must fit MCP_MAX_REQUEST_BYTES.
| Name | Required | Description | Default |
|---|---|---|---|
| job_name | Yes | ||
| parameters | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses that the return is a queue_id/queue_url rather than a build number, that the build has NOT started yet, and that an over-large encoded payload is rejected by MCP_MAX_REQUEST_BYTES. The remaining gap is permissions/auth requirements and whether a repeated trigger is deduplicated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded single-line summary followed by the operational detail, with no filler sentences. The detail paragraph is dense and run-on, but every clause (queue semantics, polling path, parameter rule, size limit) earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and 0% schema description coverage, yet the description names the returned fields and explains what they mean and do not mean. Combined with the polling guidance and parameter rules, an agent has everything needed to call this correctly and handle the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate, and it does for `parameters`: default-vs-null semantics, the empty-object convention, and the size ceiling on the encoded form are all stated. `job_name` itself is left implicit, but its meaning is unambiguous from the tool purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ("Queue a build") and immediately distinguishes itself from siblings by describing the queue-item lifecycle. An agent knows this is the trigger point, not a build-inspection tool, and is routed to get_queue_item / get_build_info as follow-ups.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the when and the follow-up sequence: poll get_queue_item until the executable has a number, then use get_build_info. It also gives a precise rule for parameterised jobs (pass an object, empty object for defaults, omitting makes Jenkins reject the trigger), which is a genuine usage discriminator.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_job_configA
Replace a job's config.xml in full.
Destructive: the previous definition is overwritten with no history kept by this server, and any setting absent from the XML you supply is lost. Read the current config first with get_job_config, and do not place plaintext credentials in the XML. Requires MCP_ALLOW_JOB_WRITE, MCP_ALLOW_DESTRUCTIVE and MCP_ALLOW_JOB_UPDATE. The encoded body must fit MCP_MAX_REQUEST_BYTES.
| Name | Required | Description | Default |
|---|---|---|---|
| job_name | Yes | ||
| config_xml | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden and does so thoroughly: it declares destructiveness, that no history is kept server-side, that omitted settings are lost, warns against plaintext credentials, and enumerates the three required environment flags plus the request byte limit. This is far beyond what the bare schema conveys.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Short, front-loaded, and every sentence carries distinct information: the operation, the destructive consequence, the pre-read step, the credential warning, and the authorization prerequisites. No filler or repetition of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter destructive write with no output schema and no annotations, this covers the safety profile, preconditions, auth requirements, and size constraints an agent needs before calling. Nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must supply all parameter meaning. It does add useful semantics for config_xml (full replacement, omitted settings lost, size-bounded, no credentials), but job_name is never characterized and no format or validity constraints are given for either field.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb and resource ('Replace a job's config.xml in full'), immediately distinguishing it from create_job_from_xml (creation) and get_job_config (read) in the sibling list. An agent knows exactly what operation this is without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit prerequisite workflow ('Read the current config first with get_job_config'), routing the agent to the correct companion tool before mutating. It does not explicitly say when to prefer this over create_job_from_xml or copy_job for cloning, but the 'in full' replacement framing makes the boundary clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
24 tool updates
v2.10.10- First observed
cancel_queue_item - First observed
copy_job - First observed
create_job_from_xml - First observed
create_multibranch_pipeline - First observed
create_pipeline_job - First observed
delete_job - First observed
disable_job - First observed
enable_job - First observed
get_build_console - First observed
get_build_info - First observed
get_job - First observed
get_job_config - First observed
get_node - First observed
get_queue - First observed
get_queue_item - First observed
jenkins_admin_request - First observed
list_jobs - First observed
list_nodes - First observed
list_running_builds - First observed
scan_multibranch_pipeline - First observed
set_node_offline - First observed
stop_build - First observed
trigger_build - First observed
update_job_config
TDQS
Scored across 24 tools
Each tool targets a distinct resource+action, and where overlaps exist (create_job_from_xml vs create_pipeline_job vs create_multibranch_pipeline, get_queue vs get_queue_item, get_build_info vs get_build_console) the descriptions explicitly state when to use which. No two tools appear interchangeable.
Consistent snake_case verb_noun pattern throughout (list_jobs, get_job, delete_job, trigger_build, stop_build, get_queue_item, set_node_offline). The single jenkins_admin_request deviates slightly but remains readable and clearly scoped.
At 24 tools this is on the heavier side, but the Jenkins domain is broad (jobs, builds, queue, nodes, admin) and each tool covers a genuinely distinct operation, so nothing feels redundant. Slightly high for a single server, though every tool earns its place.
Strong lifecycle coverage: job CRUD/config, pipeline creation, build trigger/stop/info/console, queue inspection and cancellation, nodes, plus an admin escape hatch for anything else. Minor gaps remain (e.g. build artifacts, credential listing, views), but the admin tool largely backstops them.
Maintenance
Related MCP Connectors
The MCP server for Azure DevOps, bringing the power of Azure DevOps directly to your agents.
MCP server for generating rough-draft project plans from natural-language prompts.
MCP Server for JFrog, providing tools for development and artifact management.
Personal assistant MCP server with search, execute, packages, jobs, secrets, and integrations.
Related MCP Servers
- AlicenseNot gradedqualityNot gradedmaintenanceA Model Context Protocol (MCP) server that enables AI tools like chatbots to interact with and control Jenkins, allowing users to trigger jobs, check build statuses, and perform other Jenkins operations through natural language.MIT
- AlicenseBqualityDmaintenanceA server that enables interaction with Jenkins CI/CD pipelines from any compatible MCP client (like Claude Desktop), allowing users to manage jobs, builds, coverage reports, and other Jenkins functionality through natural language.1123 npmMIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server for interacting with a Jenkins CI/CD server. Allows you to trigger jobs, check build statuses, and manage your Jenkins instance through MCP.36 npm14Apache 2.0
- AlicenseNot gradedqualityAmaintenanceMCP server for Jenkins to inspect builds, control jobs, and manage pipeline configuration.16 npmMIT