Provides monitoring and interaction capabilities for Drone CI, including webhook parsing, HMAC signature verification, and management of CI/CD pipeline state.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Drone CI MCP Server Check the status of the latest build for the web-app repository"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server scaffold for Drone CI.
This repository currently provides:
a TypeScript project scaffold,
a working Drone HTTP client (read + action endpoints),
a real MCP server entrypoint on stdio (SDK-based),
MCP tool/resource definitions for Drone CI monitoring,
webhook parsing and HMAC signature verification,
optional Drone webhook HTTP receiver with in-memory build-state cache,
basic policy/state modules,
initial unit tests.
Still pending before production use:
webhook event processing to store richer build metadata from payloads,
persistence backend (DB/Redis) for state beyond process memory,
broader integration tests against mock Drone API/webhook payloads.
Related MCP server: AWS AppRunner MCP Server
See docs/implementation-plan.md.
Node.js 20+
npm 10+
Install dependencies:
npm installReview the required environment variables:
cp .env.example .envThen export the values in your shell or pass them explicitly in your MCP client configuration. This project does not load .env automatically.
3. Build:
npm run buildRun tests:
npm testStart:
npm startnpm start launches the MCP server on stdio. Configure your MCP client to spawn:
command: node
args: dist/index.js
env: DRONE_BASE_URL, optional tuning vars (and DRONE_WEBHOOK_SECRET only if webhook is enabled)
Example MCP config:
{
"mcpServers": {
"drone-ci": {
"command": "node",
"args": ["G:\\projets\\mcp-drone-ci\\dist\\index.js"],
"env": {
"DRONE_BASE_URL": "https://drone.example.com",
"DRONE_TOKEN": "replace-with-drone-token",
"MCP_ENABLE_WRITE_ACTIONS": "false",
"MCP_WEBHOOK_PORT": "0",
"MCP_RECONCILE_INTERVAL_MS": "5000"
}
}
}
}Windows/JetBrains/Codex note:
do not rely on custom parent environment variables such as DRONE_BASE_URL or DRONE_TOKEN being inherited automatically by a local stdio MCP process,
many MCP stdio launchers only forward a safe subset of environment variables, so DRONE_* values must usually be set explicitly in the server env block,
do not set DRONE_TOKEN to a placeholder like "${DRONE_TOKEN}" in MCP env if your client does not expand placeholders; otherwise the literal string is sent and Drone authentication fails (401).
Client compatibility note:
MCP tool inputSchema values are intentionally kept permissive to improve compatibility with clients such as JetBrains and Codex.
Strict business validation still happens in the tool handlers, so invalid empty strings or non-positive integers are rejected at execution time rather than at MCP discovery/schema time.
drone_ping is available as a minimal no-input diagnostic tool to verify that a client can discover and invoke tools correctly.
To enable webhook-driven state cache:
Set MCP_WEBHOOK_PORT to a non-zero port (for example 8080).
Set DRONE_WEBHOOK_SECRET to the shared secret configured in Drone.
Configure Drone webhook target to:
http://<host>:<MCP_WEBHOOK_PORT><MCP_WEBHOOK_PATH>
default path is /webhook/drone
Optional fallback polling:
set MCP_RECONCILE_INTERVAL_MS (for example 5000) to periodically refresh active builds from Drone API.
Read tools:
drone_ping: minimal diagnostic tool returning { ok: true, server: "mcp-drone-ci" }
drone_list_repos: list repositories visible to the Drone token
drone_list_builds: list build summaries for a repository
drone_get_build: fetch full details for one build
drone_get_build_logs: fetch one stage/step log stream, with optional truncation
drone_get_cached_build_state: inspect webhook-cached build state
Action tools (only when MCP_ENABLE_WRITE_ACTIONS=true):
drone_restart_build
drone_stop_build
drone_approve_build
drone_decline_build
Build filters supported by drone_list_builds:
owner and repo are always required
optional prNumber
optional sourceBranch
optional targetBranch
optional page and limit
Numeric inputs:
build identifiers and pagination values are exposed as generic MCP numbers for broad client compatibility
integer, positivity, and max-value checks are enforced by the server when the tool is executed
filtered drone_list_builds searches report when the repository scan limit is hit, instead of silently returning a false negative
Example:
{
"name": "drone_list_builds",
"arguments": {
"owner": "leuzeus",
"repo": "gowire",
"prNumber": 510,
"sourceBranch": "S076-gcmp-v2-planning",
"targetBranch": "dev",
"limit": 5
}
}This MCP is designed so agents can stay efficient if they use the tools in the intended order:
Use drone_list_builds to search.
Use drone_get_build only for the specific build you want to inspect in detail.
Use drone_get_build_logs with limitChars when you need failure evidence.
Important behavior:
drone_list_builds returns compact build summaries, not full build payloads
the full build message and other verbose fields are reserved for drone_get_build
MCP JSON responses are serialized compactly to reduce token overhead
Recommended agent patterns:
prefer owner/repo + prNumber for PR-centric queries
otherwise use owner/repo + sourceBranch + targetBranch
keep limit small whenever possible
avoid drone_list_repos unless cross-repository discovery is explicitly needed
avoid broad drone_list_builds calls without filters on large repositories
Recommended order of precision:
owner/repo + buildNumber
owner/repo + prNumber
owner/repo + sourceBranch + targetBranch
owner/repo + targetBranch
Required:
DRONE_BASE_URL: Drone base URL (for example https://drone.example.com)
DRONE_TOKEN: Drone API token
Optional:
DRONE_ALLOW_INSECURE_HTTP (default false, only set true for trusted internal Drone deployments without TLS)
DRONE_TIMEOUT_MS (default 10000)
DRONE_MAX_RETRIES (default 2)
MCP_ENABLE_WRITE_ACTIONS (default false)
MCP_RECONCILE_INTERVAL_MS (default 0, disabled)
MCP_WEBHOOK_PORT (default 0, disabled)
MCP_WEBHOOK_PATH (default /webhook/drone)
DRONE_WEBHOOK_SECRET (required when MCP_WEBHOOK_PORT > 0)
Do not commit real tokens or webhook secrets.
Keep .env local and use .env.example as template only.
Use a read-only Drone token by default.
Keep write actions disabled (MCP_ENABLE_WRITE_ACTIONS=false) until authorization guardrails are in place.
This repository is configured to enforce:
branch protection on main (PR required, stale review dismissal),
required status check (test),
linear history and no force-push,
signed commits on protected branch,
secret scanning and push protection,
Dependabot security updates.
Get one build details by build number.
| Name | Required | Description | Default |
|---|---|---|---|
| owner | Yes | ||
| repo | Yes | ||
| buildNumber | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavioral traits. It only implies a read operation but fails to mention any side effects, authentication requirements, or error handling (e.g., if build not found). The agent gets no safety information.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler. It is front-loaded with the core action. However, it could be slightly more informative without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given three required parameters and no output schema, the description is insufficient. It does not describe the return value, pagination, or how to interpret the result. Sibling tools exist but no guidance on selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions 'build number' but does not explain the owner and repo parameters. The description adds no semantic value beyond the schema's parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the verb 'Get' and the resource 'one build details' with the method 'by build number.' It clearly distinguishes from sibling tools like drone_get_build_logs. However, it omits mentioning that owner and repo are required parameters for identification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus siblings such as drone_list_builds or drone_get_build_logs. The description does not specify prerequisites or context for use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get logs for one build stage/step.
| Name | Required | Description | Default |
|---|---|---|---|
| owner | Yes | ||
| repo | Yes | ||
| buildNumber | Yes | ||
| stageNumber | Yes | ||
| stepNumber | Yes | ||
| limitChars | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description does not disclose any behavioral traits such as permissions required, rate limits, or behavior when logs exceed limitChars. The agent has no insight beyond the basic function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise at 8 words, front-loaded with the core purpose. While terse, it avoids fluff, but could be slightly expanded with minimal cost to conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters, no output schema, and no annotations, the description is insufficient. It does not explain the return format, pagination (if any), or how to interpret logs, leaving the agent with many unknowns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description does not add meaning to any of the 6 parameters. Parameter names are somewhat self-explanatory, but no details on constraints (e.g., limitChars default, maximum) or format are given.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Get logs) and the specific resource (one build stage/step), distinguishing it from sibling tools like drone_get_build which likely returns build metadata.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. Does not mention prerequisites (e.g., need build number) or conditions where this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Read webhook-cached build state. If buildNumber is omitted, returns recent snapshots for the repository.
| Name | Required | Description | Default |
|---|---|---|---|
| owner | Yes | ||
| repo | Yes | ||
| buildNumber | No | ||
| limit | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavior. It mentions caching and conditional results, but does not address side effects, permissions, rate limits, or staleness beyond the term 'cached'. The lack of annotation burden means more detail is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loaded with the core action and a key conditional. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters (2 required), no output schema, and no annotations, the description is incomplete. It omits details on limit, return format, and what constitutes 'recent snapshots'. A tool of this complexity needs more context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. Only buildNumber is indirectly explained via the conditional phrase. Owner, repo, and limit are not described. The description fails to add meaning to most parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Read' and the resource 'webhook-cached build state', distinguishing it from sibling tools like drone_get_build (which likely retrieves live build state). It also explains behavior when buildNumber is omitted.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a conditional usage hint regarding buildNumber, but does not explicitly state when to use this tool versus siblings or any prerequisites. It gives implied context but lacks clear guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List builds for a repository.
| Name | Required | Description | Default |
|---|---|---|---|
| owner | Yes | ||
| repo | Yes | ||
| page | No | ||
| limit | No | ||
| prNumber | No | ||
| sourceBranch | No | ||
| targetBranch | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, and the description does not disclose any behavioral traits such as pagination (despite page/limit parameters), filtering, rate limits, or side effects. The agent cannot anticipate behavior beyond a simple list.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise (one sentence) but under-specified. While it has no filler, it fails to provide essential context, making it insufficient for effective tool usage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 7 parameters (2 required), 0% schema coverage, no output schema, and no annotations, the description is woefully incomplete. It lacks information on pagination, filtering, ordering, and return format, leaving the agent underinformed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries full burden to explain parameters. It does not define owner, repo, page, limit, prNumber, sourceBranch, or targetBranch. The agent must guess their semantics from names alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'builds for a repository', indicating a list operation. It is sufficiently specific to distinguish from sibling tools like drone_get_build (singular fetch) and drone_list_repos (list repositories). However, it lacks detail on scope or filtering.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidelines are provided. The description does not mention when to use this tool over alternatives, typical contexts, or prerequisites such as requiring owner and repo parameters. The agent must infer usage from the parameter schema alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List repositories visible to the Drone token.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| limit | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits, but it only says 'visible to the Drone token', omitting details on pagination, authentication, rate limits, or data returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that gets to the point, though it could be slightly more informative without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, no output schema, and simple parameters, the description is too sparse. It lacks context about pagination, token scoping, or the structure of returned data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema parameter coverage is 0%, yet the description does not explain the 'page' and 'limit' parameters. It adds no value beyond the raw schema, failing to compensate for low coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List repositories visible to the Drone token' with a specific verb and resource, and it distinguishes from sibling tools that list builds or get builds.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like drone_list_builds. The description merely states what it does without any contextual hints or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Minimal diagnostic tool for MCP client compatibility checks.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must carry the full burden. It only says it's a diagnostic tool but does not describe what it actually does (e.g., what it pings, expected response, side effects). The behavioral transparency is very low.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no extraneous words. It efficiently conveys the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, no output schema), the description captures the essential purpose. However, it omits what the tool returns or how to interpret results, which would be useful for completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, and schema coverage is 100%. Per guidelines, baseline is 4 for 0 params. The description does not add param info, but no param info is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it's a 'minimal diagnostic tool for MCP client compatibility checks,' specifying the verb ('diagnostic'), resource ('MCP client compatibility'), and scope. It distinguishes itself from sibling tools that focus on builds and repos.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, nor is there any mention of prerequisites or context for its use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0drone_get_builddrone_get_build_logsdrone_get_cached_build_statedrone_list_buildsdrone_list_reposdrone_pingScored across 6 tools
Each tool targets a distinct purpose: build details, logs, cached state, listing builds, listing repos, and a ping diagnostic. No overlapping functionality.
All tools follow a consistent drone_<verb>_<noun> pattern, making them predictable and easy to navigate.
Six tools is well-scoped for a CI integration, covering core retrieval operations without unnecessary bloat.
The set focuses on read-only operations (get, list, ping) but lacks build creation, cancellation, or update actions, which are common for CI workflows.
A simple Typescript MCP server built using the official MCP Typescript SDK and smithery/cli. This…
A TypeScript MCP server for Home Assistant, enabling programmatic management of entities, automati…
A MCP server built for developers enabling Git based project management with project and personal…
Create, deploy, and operate MCP servers directly from your GitHub repositories.