Skip to main content
Glama

depot-mcp: MCP server for Depot (depot.dev)

A Model Context Protocol server, read-only by default, for Depot, the container build and CI acceleration service. It gives a coding agent Depot's own answer to "why did CI fail?" and "why did this build fail?", plus the run history, cache effectiveness, registry contents, CI configuration, and usage data behind those answers.

CI npm MCP Registry License Node

Community project. Not affiliated with, endorsed by, or supported by Depot. Source-available under Apache 2.0 with the Commons Clause; see License.

Not to be confused with: The Home Depot, Chromium's depot_tools, Steam depots, Perforce depots, or any other "depot". This server talks only to api.depot.dev.

Contents

Related MCP server: deployment-intelligence-mcp

Why this exists

Depot ships a good agent story already, but it is not MCP. Depot's answer is Agent Skills: SKILL.md files that teach an agent to drive the depot CLI, plus a documented CI API and llms.txt. Depot's own post announcing Skills notes two limitations: skills work best in clients that implement the SKILL.md convention, and they are "sometimes notorious for not being automatically used by agents."

This server covers the gaps that leaves:

  • Agents without a shell. Skills require a logged-in depot binary on the machine. A tool call does not.

  • Clients that don't read SKILL.md. MCP is client-agnostic.

  • Reliable invocation. A registered tool with a description is discovered through the protocol rather than hopefully retrieved.

  • A read-only boundary. A skill cannot stop an agent from running depot ci rerun. This server can, and does; see Read-only model and security.

The flagship tool is a thin, careful wrapper around something Depot already built: GetFailureDiagnosis, a server-side failure analysis that clusters a run's failures by root cause and returns a diagnosis, a suggested fix, and the evidence lines, already bounded so it fits in a context window. Most of this server's value is exposing that well.

How it compares to Depot Agent Skills

Depot Agent Skills

depot-mcp

Needs the depot CLI installed and logged in

yes

no

Works in clients without SKILL.md support

no

yes

Invocation

agent must retrieve the skill

tool is listed in tools/list

Can mutate Depot (rerun, cancel, reset)

yes, anything the CLI can

off by default; opt-in write tools behind DEPOT_MCP_ALLOW_WRITES, each dry-run first; deletion behind a second flag; no reset

Output bounded for a context window

depends on the CLI command

every tool

Maintained by

Depot

community

As of 2026-09-05 no standalone Depot MCP server exists (first-party or otherwise, in the official registry, on npm, or on PyPI), and Depot's own guidance for agents without a shell is to call the CI API directly. This server is that API call, shaped for an agent.

Status

  • Read-only by default. With DEPOT_MCP_ALLOW_WRITES unset, no tool that can change anything is registered. Setting it adds ten write tools, every one of which dry-runs first and refuses unsafe requests before any write: cancel run or workflow, cancel job, retry failed jobs, retry one job, rerun workflow, dispatch workflow (optionally limited by DEPOT_MCP_DISPATCH_ALLOWLIST), set or delete a CI variable, create project, update project; see Write tools. Stopping or killing a sandbox needs the beta flag as well, and deleting a project needs DEPOT_MCP_ALLOW_DESTRUCTIVE on top; see Destructive writes. There is no reset, secret-writing, or token-minting tool.

  • Depot CI is beta, per Depot's own documentation. The CI tools are the most valuable ones here and also the most likely to shift under you.

  • Four beta tools are opt-in. DEPOT_MCP_ENABLE_BETA=1 adds read-only tools for Depot sandboxes (depot.sandbox.v1) and the Depot registry (depot.registry.v1beta1). Those APIs are published only as protos, one of them beta in its name, so the tools stay hidden unless you ask for them; see Beta.

  • Verified against a real Depot organization. Every read tool, prompt, and resource was run live with organization, user, and project tokens; every write tool was dry-run live, and every write except the two sandbox tools was applied for real in a trial organization on 2026-09-08 (npm run verify:apply), including dispatch, project update, and project delete. Sandbox stop and kill are covered by the verification script but have only been dry-run, because the trial organization had no sandbox to stop.

  • MCP protocol revision 2025-11-25. This server is built on the @modelcontextprotocol/sdk 1.x line, which speaks 2025-11-25. The current spec revision is 2026-07-28, implemented by the v2 packages (@modelcontextprotocol/server 2.0.0, published 2026-07-28), which also serve 2025-11-25 clients. Every current client negotiates 2025-11-25, so nothing is lost today. Moving to v2 is a planned, contained change: the SDK is imported in nine files and the transport wiring lives in src/index.ts.

Prerequisites

  • Node.js 20 or newer (node --version). The Docker image needs no Node on the host.

  • A Depot Organization token. Depot dashboard, Organization Settings, API Tokens. A user token from depot login also works but spans every organization you belong to, so set DEPOT_ORG_ID too.

  • Project tokens will not work. Depot's own scope matrix excludes them from Depot CI and the API entirely.

Which token can do what

Depot has three kinds of token and they are not interchangeable. Verified live on 2026-09-06, including with a user token belonging to an organization owner:

Tool group

Organization token

User token

depot_whoami

yes

yes

Depot CI: depot_diagnose_ci_failure, depot_list_ci_runs, depot_get_ci_run, depot_get_ci_job, depot_get_ci_attempt, depot_list_ci_workflows, depot_get_ci_workflow, depot_wait_for_ci_run, depot_get_ci_logs, depot_get_ci_job_summary, depot_get_ci_metrics, depot_list_ci_artifacts, depot_get_ci_artifact_url, depot_compare_ci_runs

yes

yes

depot_list_ci_secrets, depot_list_ci_variables

yes

admins and owners only

depot_list_images

yes

yes

depot_list_projects, depot_get_project, depot_audit_trust_policies, depot_list_project_tokens, depot_list_builds, depot_get_build, depot_diagnose_build, depot_get_usage, depot_list_project_usage, depot_get_cache_summary

yes

no: Depot answers 401 Invalid token, whatever the user's role

Beta: depot_list_sandboxes, depot_get_sandbox, depot_list_registry_repositories, depot_get_registry_image

yes

not tested yet

Project token

runs nothing

The full matrix, per tool and per Depot service, with how to obtain each token, is in docs/tokens.md. depot_whoami reports which kind it holds and names the tools that will not work.

Create a dedicated token for this server so you can revoke it independently. Depot has no read-only token scope; read the security section before you paste one anywhere.

Installation

Every client below runs the same command over stdio. The only things that vary are the file the config lives in and how that client lets you keep the token out of the file.

The generic config, which works as-is in Claude Desktop, Cursor, Windsurf, Cline, JetBrains, and most other clients:

{
  "mcpServers": {
    "depot": {
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "YOUR_DEPOT_TOKEN"
      }
    }
  }
}

Add "DEPOT_ORG_ID": "..." to env if your token can see more than one organization. Every tool is prefixed depot_, and tool names are stable across releases.

Claude Code

claude mcp add depot --scope user --env DEPOT_TOKEN=YOUR_DEPOT_TOKEN -- npx -y depot-mcp

Or commit a .mcp.json at the repository root so the whole team gets it. Claude Code expands ${VAR} and ${VAR:-default} in command, args, env, url, and headers, so the token stays in each developer's shell environment and out of git. Copy .mcp.json.example:

{
  "mcpServers": {
    "depot": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "${DEPOT_TOKEN}",
        "DEPOT_ORG_ID": "${DEPOT_ORG_ID:-}"
      }
    }
  }
}

Claude Code prompts on every MCP tool call regardless of readOnlyHint. To stop being asked, allow the read-only tools in .claude/settings.json: "permissions": { "allow": ["mcp__depot__*"] }.

Claude Desktop

Two options.

Extension bundle (one click). Download depot-mcp.mcpb from the releases page, open it with Claude Desktop (or Settings, Extensions, Advanced settings, Install extension), and paste the token into the settings form. The token field is marked sensitive in manifest.json, so Claude Desktop stores it in the OS keychain rather than in a JSON file.

Manual JSON. Edit ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows and add the generic config above.

Cursor

Install in Cursor

The button pre-fills the server; fill in DEPOT_TOKEN when Cursor shows the config. Or edit ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project). Cursor resolves ${env:NAME} in command, args, env, url, and headers, so a committed project file can read the token from the environment:

{
  "mcpServers": {
    "depot": {
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "${env:DEPOT_TOKEN}"
      }
    }
  }
}

VS Code and GitHub Copilot

Install in VS Code Install in VS Code Insiders

The buttons register the server and prompt for the token once, storing it as a VS Code secret. Equivalent .vscode/mcp.json (safe to commit: the token is an input, not a value):

{
  "inputs": [
    {
      "type": "promptString",
      "id": "depot-token",
      "description": "Depot Organization token",
      "password": true
    }
  ],
  "servers": {
    "depot": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "${input:depot-token}"
      }
    }
  }
}

Or from a terminal: code --add-mcp '{"name":"depot","command":"npx","args":["-y","depot-mcp"],"env":{"DEPOT_TOKEN":"YOUR_DEPOT_TOKEN"}}'. Copilot Chat in VS Code uses whatever is in mcp.json; use "MCP: Open User Configuration" for a user-level file.

GitHub Copilot coding agent

Repository Settings, Copilot, Coding agent, MCP configuration. Secrets must be Copilot environment secrets whose names start with COPILOT_MCP_:

{
  "mcpServers": {
    "depot": {
      "type": "local",
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "$COPILOT_MCP_DEPOT_TOKEN"
      },
      "tools": ["*"]
    }
  }
}

OpenAI Codex CLI

codex mcp add depot --env DEPOT_TOKEN=YOUR_DEPOT_TOKEN -- npx -y depot-mcp

Or in ~/.codex/config.toml. env_vars forwards named variables from your shell so the token need not be written into the file:

[mcp_servers.depot]
command = "npx"
args = ["-y", "depot-mcp"]
env_vars = ["DEPOT_TOKEN", "DEPOT_ORG_ID"]

Gemini CLI

gemini mcp add -e DEPOT_TOKEN=YOUR_DEPOT_TOKEN depot npx -y depot-mcp

Or in ~/.gemini/settings.json. Gemini CLI expands $VAR and ${VAR} inside env:

{
  "mcpServers": {
    "depot": {
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "$DEPOT_TOKEN"
      }
    }
  }
}

Windsurf

~/.codeium/windsurf/mcp_config.json, or Windsurf Settings, Cascade, MCP Servers, Manage. Use the generic config above.

Zed

settings.json:

{
  "context_servers": {
    "depot": {
      "command": "npx",
      "args": ["-y", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "YOUR_DEPOT_TOKEN"
      }
    }
  }
}

Cline

Cline panel, MCP Servers, Configure (or ~/.cline/mcp.json for the CLI). The generic config works; Cline also accepts "disabled": false and "autoApprove": ["depot_whoami", "depot_diagnose_ci_failure"] per server.

JetBrains AI Assistant

Settings, Tools, AI Assistant, Model Context Protocol (MCP), Add, then paste the generic config as JSON. If you already configured Claude Desktop, "Import from Claude" picks it up.

Docker

No Node.js on the host. The image is stdio, so -i is required and -t must not be used. Pass the token from your environment rather than on the command line:

docker build -t depot-mcp .
export DEPOT_TOKEN=YOUR_DEPOT_TOKEN
docker run -i --rm -e DEPOT_TOKEN -e DEPOT_ORG_ID depot-mcp

Client config for the image:

{
  "mcpServers": {
    "depot": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "DEPOT_TOKEN", "depot-mcp"],
      "env": {
        "DEPOT_TOKEN": "YOUR_DEPOT_TOKEN"
      }
    }
  }
}

A published image at ghcr.io/akshayjain3450/depot-mcp and a Docker MCP Catalog entry are planned; see Where to find it.

From a clone

Works today, before the npm publish:

git clone https://github.com/akshayjain3450/depot-mcp.git
cd depot-mcp
npm install
npm run build

Then replace "command": "npx", "args": ["-y", "depot-mcp"] in any block above with "command": "node", "args": ["/absolute/path/to/depot-mcp/dist/index.js"]. For Claude Code:

claude mcp add depot --env DEPOT_TOKEN=YOUR_DEPOT_TOKEN -- node /absolute/path/to/depot-mcp/dist/index.js

Checking it works

npx @modelcontextprotocol/inspector npx -y depot-mcp      # or: node dist/index.js

Then, from your agent, ask it to call depot_whoami. That confirms the token, reports which organizations and projects it can see, and warns about the organization ambiguity described under Configuration.

The binary also answers two flags without needing a token:

npx depot-mcp --version   # prints the version from package.json
npx depot-mcp --help      # usage, environment variables, exit codes

Importing the package (import { createServer } from 'depot-mcp') gives you the server factory without starting anything; only the depot-mcp binary opens stdio.

Compatibility

The server speaks stdio only. Anything that can launch a local process and talk MCP 2025-11-25 (or negotiate down to it) works. "Tested" means exercised end to end by a maintainer with a real token; "verified" means the config shape was checked against the vendor's documentation on 2026-09-05 but not run.

Client

Transport

Status

Notes

MCP Inspector

stdio

tested

npm run inspect

CI stdio smoke (initialize + tools/list)

stdio

tested

runs on every commit, Node 20 and 22

Claude Code

stdio

verified

${VAR} expansion in .mcp.json; prompts per call unless allowlisted

Claude Desktop

stdio, .mcpb

verified

honours readOnlyHint for auto-approval

Cursor

stdio

verified

${env:VAR}; one-click deeplink

VS Code / Copilot Chat

stdio

verified

inputs keep the token out of the file; one-click link

GitHub Copilot coding agent

stdio (type: local)

verified

secrets must be prefixed COPILOT_MCP_

OpenAI Codex CLI

stdio

verified

env_vars forwards from the shell

Gemini CLI

stdio

verified

$VAR expansion in env

Windsurf

stdio

verified

generic config

Zed

stdio

verified

context_servers key

Cline

stdio

verified

autoApprove per tool

JetBrains AI Assistant

stdio

verified

can import Claude Desktop config

Docker (any client)

stdio via docker run -i

verified

image built in CI; distroless runtime

Streamable HTTP / remote

not offered

the token would leave the machine; see Security

If you run it somewhere not listed, open an issue with the client name and the config that worked.

Where to find it

Planned distribution, in order of usefulness. Items marked pending need the npm publish first.

Channel

Identifier

Status

npm

depot-mcp

pending (release.yml publishes with provenance on a v* tag)

Official MCP Registry

io.github.akshayjain3450/depot-mcp (server.json)

pending; mcp-publisher publish after npm

Claude Desktop extension

depot-mcp.mcpb on GitHub releases (manifest.json)

pending

Docker MCP Catalog

PR to docker/mcp-registry with a server.yaml pointing at this repo's Dockerfile

pending

GitHub Container Registry

ghcr.io/akshayjain3450/depot-mcp

pending

Smithery

listing only; Smithery dropped hosted stdio servers in September 2025, and this server is stdio by design

pending

Glama, PulseMCP, awesome-mcp-servers

directory listings

pending

Never look for it under @depot/* or dev.depot/*; those namespaces belong to Depot, and this project is not theirs.

Configuration

Every setting is an environment variable, set in your client's config.

Variable

Required

Default

Purpose

DEPOT_TOKEN

yes

Depot API token. Must be a single line of printable ASCII; a line break copied from a wrapped terminal is rejected at startup without echoing the value. The server refuses to start without it (exit code 78).

DEPOT_ORG_ID

no

Sent as x-depot-org. Set this if your token can see more than one organization (see below).

DEPOT_PROJECT_ID

no

Default container-build project, so build tools can be called without one.

DEPOT_API_URL

no

https://api.depot.dev

Override the API endpoint. Must be https://; plain http:// is accepted only for localhost, for running against a stub.

DEPOT_MCP_MAX_LOG_PAGES

no

20

Cap on log/step pages fetched per tool call, so one call can't walk a gigabyte of logs.

DEPOT_MCP_OUTPUT_BUDGET

no

24000

Hard character ceiling on any single tool result.

DEPOT_MCP_ENABLE_BETA

no

0

Also register the four read-only beta tools for Depot sandboxes and the Depot registry. Off by default because their Depot APIs may change without notice. depot_whoami reports whether it is on.

DEPOT_MCP_ALLOW_WRITES

no

0

Reserved for a future version; currently a no-op. The gate exists so mutating tools can be added later without reworking registration. v1 defines none, so setting this changes nothing; depot_whoami will say so.

DEPOT_MCP_ALLOW_WRITES

no

0

Set to 1 to register the five Depot CI write tools. Unset, they are not registered at all, so tools/list never shows them. Every write defaults to dryRun: true; depot_whoami reports which write tools are registered.

DEPOT_MCP_ALLOW_WRITES

no

0

Set to 1 to register the write tools. Every one defaults to dryRun: true; a client without the flag never sees them. The startup line on stderr and depot_whoami both say whether writes are on.

DEPOT_MCP_DISPATCH_ALLOWLIST

no

Comma-separated owner/name:workflow.yml entries that depot_dispatch_ci_workflow may start, for example acme/api:deploy.yml,acme/api:nightly.yml. When set, a dispatch of anything else is refused before any request; when unset, any repository the token can see may be dispatched. Repository names match case-insensitively, workflow file names exactly. A malformed entry stops the server at startup.

DEPOT_MCP_ALLOW_DESTRUCTIVE

no

0

Set to 1, together with DEPOT_MCP_ALLOW_WRITES, to also register the irreversible writes (depot_delete_project). On its own it does nothing: a server with writes off can never delete. Each destructive tool also needs a confirmation argument naming the target. The startup line and depot_whoami say whether this gate is open.

Each Depot API call has an overall deadline of about 40 seconds, with a bounded number of retries (exponential backoff) for unavailable, deadline_exceeded, aborted, and 429 responses. invalid_argument, not_found, permission_denied, and failed_precondition are never retried. A tool that makes several calls (log paging, build diagnosis) can therefore take longer than one deadline; it reports partial results rather than failing outright when a later page times out.

The organization gotcha

This is the single most confusing Depot failure mode, and Depot's own Agent Skill calls it out. A user token spans every organization you belong to. When more than one is visible and DEPOT_ORG_ID is unset, requests resolve against one organization and everything in the others reads as empty rather than as an error. If a list looks wrongly empty, call depot_whoami; it detects exactly this and tells you what to set.

Tools

All 28 always-on tools are prefixed depot_, named depot_<verb>_<noun>, and annotated readOnlyHint: true and destructiveHint: false. Four more read-only tools sit behind DEPOT_MCP_ENABLE_BETA (see Beta); ten reversible write tools behind DEPOT_MCP_ALLOW_WRITES (see Write tools), two sandbox writes behind that flag and the beta flag together, and one irreversible write behind DEPOT_MCP_ALLOW_DESTRUCTIVE on top (see Destructive writes). The writes carry readOnlyHint: false and honest destructiveHint and idempotentHint values. Names are stable: a rename or removal is a breaking change and will be versioned as one.

Diagnosis (start here)

Tool

Answers

depot_diagnose_ci_failure

Why did this CI run/workflow/job/attempt fail? Clustered root causes, AI diagnosis, suggested fix, evidence lines.

depot_diagnose_build

Why did this container build fail? Locates the failing step, returns its error and log tail, plus cache effectiveness. Reports logPageCapHit and logNextPageToken when the step's output was longer than the page cap allowed.

depot_whoami

Is my token valid, and what can it see? Diagnoses the organization ambiguity above, and warns when DEPOT_ORG_ID names an organization the token cannot see.

Depot CI

Tool

Answers

depot_list_ci_runs

Which runs happened recently, and which failed? Filter by status, repo, SHA, trigger, PR.

depot_get_ci_run

What is this run's workflow, job, and attempt tree, and which node broke?

depot_get_ci_job

What happened to this job across its retries? Status, conclusion, recorded error, runner labels, timing, and every attempt with its sandbox id, newest first.

depot_get_ci_attempt

One attempt's own record: status, conclusion, error, sandbox and session ids, timing, whether it is current.

depot_list_ci_workflows

Which workflows ran recently, and which failed? Filter by name, status, repo, SHA, trigger, PR; job counts per workflow.

depot_get_ci_workflow

One workflow's execution history (reruns and retries) and its job -> attempt tree.

depot_wait_for_ci_run

Is it done yet? Polls GetRunStatus for a runId, or GetWorkflow for a workflowId (the thing to watch after a rerun or retry, which start a new execution rather than a new run), for up to timeoutSeconds (default 120, max 300) until the run, the workflow's latest execution, or one job named by untilJobKey is terminal, then reports the outcome, elapsed time, poll count, and every node that changed state. Bounded polling only; a timeout returns timedOut: true and the agent calls again. Never streams.

depot_get_ci_logs

Bounded raw logs for an attempt: tail by default, grep/step/stream filters, forward paging with an exact cursor. Filters run in this server after fetching, so grep still reads up to DEPOT_MCP_MAX_LOG_PAGES pages. When the page cap stops the walk the result says the log continues, and pageCapHit plus nextPageToken let you carry on; it never labels the middle of a log as its tail. Line bodies are capped at 2000 characters (bodyTruncated).

depot_get_ci_job_summary

What did the job publish about itself (the $GITHUB_STEP_SUMMARY equivalent)?

depot_get_ci_metrics

Was this an OOM kill or CPU starvation? CPU/memory for a run, job, or attempt.

depot_list_ci_artifacts

What did the run upload, and what is its signed download URL? Accepts pageToken.

depot_get_ci_artifact_url

A signed download URL for one artifact by id, with its expiry when the URL carries one. The URL is a short-lived bearer capability; the result says so and the tool never fetches it.

depot_compare_ci_runs

What changed between two runs? A job matrix keyed by job key with status in A versus B, duration and peak memory deltas (from GetRunMetrics, blank when Depot has no samples), jobs only in one run, and failure error messages new in B versus resolved in B (from Depot's failure analysis, fetched only for the sides that failed). For regressions between two commits and telling a flaky failure from a deterministic one.

depot_list_ci_secrets

Which CI secrets exist and where do they apply? Names and scoping only; Depot never returns secret values.

depot_list_ci_variables

Which CI variables exist, with values and scoping. Credential-shaped values are redacted (see below).

Container builds, projects, registry, usage

Tool

Answers

depot_list_builds

Recent container builds with duration and cache hit ratio.

depot_get_build

One build's status, timing, cache counters and hit ratio, with terminal and failure flags. Points at depot_diagnose_build when the build failed; cheap enough to poll a running build.

depot_list_projects

Which build projects exist, in which region, on what hardware, with which cache policy? Accepts pageToken.

depot_get_project

One project's full config plus its OIDC trust policies.

depot_audit_trust_policies

Which external CI identities (GitHub repository, Buildkite pipeline, CircleCI or GitLab project) can build into which project, organization-wide? One project with projectId, otherwise the first 50. No policies is a normal answer.

depot_list_project_tokens

Which project tokens exist for a project: id, description, timestamps when Depot has them. Never the secret; Depot reveals it once at creation and this server never creates tokens.

depot_list_images

What is in this project's registry, with digests and sizes?

depot_get_usage

What is driving spend? Build minutes, minutes saved by cache, GitHub Actions runner minutes, storage, sandboxes. Dates are UTC; a date-only endAt includes that whole day.

depot_list_project_usage

Every project's build count, build time, and layer cache size for a period, largest cache first, with names resolved. Accepts pageToken.

depot_get_cache_summary

Is this project's cache working? Retention policy against current size, hit ratio over recent builds, minutes saved, and observations (near the size limit, low hit ratio, builds rarer than retention). Depot cannot list cache entries and this server never resets a cache; the tool says both.

Beta (opt-in)

Registered only when DEPOT_MCP_ENABLE_BETA=1. They are read-only like everything else, but they sit on Depot APIs that Depot publishes only as protos (depot.sandbox.v1, depot.registry.v1beta1, beta in its name), so field names, states, and paging can change under them without a Depot changelog entry. Every description says so. Verified live on 2026-09-06 with an Organization token: each RPC answered the JSON binding (empty lists on a trial organization, Depot's own not_found for unknown ids).

Tool

Answers

depot_list_sandboxes

Which Depot sandboxes exist, in what state, on which image, with what resources? Filter by state and creation time; token paging. Environment variables are reported by name only.

depot_get_sandbox

One sandbox's lifecycle timing, exit code, error message, metered CPU and network usage, and environment variable names. Never values.

depot_list_registry_repositories

Which repositories are in the organization's registry, how big, when last pushed, and does each have a retention policy? Pages by number (page, hasMore).

depot_get_registry_image

What does this repository tag or digest point at? Digest, size, tags, push time, and the manifest summarised: platforms of a multi-platform index, or layer count and config digest of a single image.

Not exposed, deliberately: sandbox creation, command execution, or timeout changes; registry token listing or creation; any deletion. Stopping or killing a sandbox is a write, so depot_stop_sandbox and depot_kill_sandbox exist only when DEPOT_MCP_ALLOW_WRITES is set as well; see Write tools. The fifth beta tool in the roadmap, depot_list_test_results, needs the depot CLI and is not built.

Write tools (opt-in)

Registered only when DEPOT_MCP_ALLOW_WRITES=1. Without the flag they do not exist as far as the client can tell: they are absent from tools/list, and a call to one fails as an unknown tool. depot_whoami reports whether they are registered and names them.

Every write tool works the same way:

  1. dryRun defaults to true. The call reads the current state with Depot's read RPCs and returns a preview of what would change, plus the exact arguments to resend.

  2. Resend with dryRun: false after the user has confirmed. The tool reads the state again, applies its refusal rules to that fresh state, and only then calls the one mutating RPC. Depot's own 412 answers are translated into a readable message.

Each applied write logs one line to stderr, [depot-mcp write] <tool> <ids> <time>, so an operator can see what an agent changed. The token never appears in it.

Tool

Depot RPC

Refuses

depot_cancel_ci_run

CancelRun, or CancelWorkflow when workflowId is given

a run or workflow that is already terminal; a workflowId outside the named run

depot_cancel_ci_job

CancelJob

a job that is already terminal; a job outside the named runId

depot_retry_ci_failed_jobs

RetryFailedJobs

a workflow still running; a workflow with no failed or cancelled jobs; a runId with several workflows (pass workflowId); any failed job at 3 or more attempts unless force: true

depot_retry_ci_job

RetryJob

a job that is not failed or cancelled; a job at 3 or more attempts unless force: true

depot_rerun_ci_workflow

RerunWorkflow

a workflow still running; a workflow with failed jobs unless allowFullRerun: true, since retrying only the failed jobs is cheaper

depot_dispatch_ci_workflow

DispatchWorkflow

a repo and workflow file not on DEPOT_MCP_DISPATCH_ALLOWLIST when one is set; a repo that is not owner/name; a workflow that is a path rather than a file basename; an empty ref; more than 20 inputs or any value over 1000 characters. The preview shows the last run of that workflow and says plainly that a new run may deploy or spend minutes

depot_set_ci_variable

SetVariableVariant

a value the redaction rules classify as a credential (use a Depot secret); a name that already belongs to a secret

depot_delete_ci_variable

DeleteVariableVariant, or DeleteVariable with allVariants: true

a selector matching zero or several variants; a whole-variable delete without allVariants

depot_create_project

CreateProject

a duplicate project name unless allowDuplicateName: true; a region other than us-east-1 or eu-central-1

depot_update_project

UpdateProject

a call that changes nothing (every value equals the current one); a regionId other than the project's own, since Depot does not move projects; cacheKeepGb or cacheKeepDays below 1. The preview shows the diff, warns when the cache shrinks (eviction) and when the hardware changes (cost), and sends both cache numbers together because Depot reads an omitted one as zero

depot_stop_sandbox (needs DEPOT_MCP_ENABLE_BETA too)

StopSandbox, beta depot.sandbox.v1

a sandbox already finished, cancelled, or failed; Depot's own 412 for the same case is translated

depot_kill_sandbox (needs DEPOT_MCP_ENABLE_BETA too)

KillSandbox, beta depot.sandbox.v1

the same as stop; kill is the forced version and lands the sandbox in cancelled

Annotations: readOnlyHint: false on all twelve; destructiveHint: true on the cancels, the variable delete, and the sandbox kill; idempotentHint: false on retries, reruns, dispatch, and project creation, which create new attempts, runs, or projects.

What has been verified live. Every write tool has been dry-run against a real Depot organization, so the preview path, the read RPCs it depends on, and every refusal rule have been exercised. The apply path has been exercised for every write except sandbox stop and kill, which the trial organization had no sandbox to run against; npm run verify:apply is where that happens, and docs/verification/apply-0.2.1.md is the record. The request field names for the CI writes are documented by Depot; those for the variable and project writes come from the v3beta2 bindings vendored in Depot's open-source CLI and from depot/proto, so treat the first real apply of each as a verification step.

Destructive writes (second gate)

Some writes cannot be undone, and no dry run makes deleting the wrong thing recoverable. Those sit behind a second flag, DEPOT_MCP_ALLOW_DESTRUCTIVE, which only counts when DEPOT_MCP_ALLOW_WRITES is set too. With writes on and the second flag off, tools/list does not show them and depot_whoami says the destructive gate is off. Each one also needs a confirmation argument that names what is being destroyed, typed by the user rather than copied from a listing.

Tool

Depot RPC

Confirmation

Refuses

depot_delete_project

DeleteProject

confirmProjectName must equal the project's current name exactly

a name mismatch, before any mutating call; a project with a build in the last 24 hours unless force: true. The preview shows the project, how many builds it has, and when the last one ran, so a person sees what goes

Annotations: destructiveHint: true, idempotentHint: true. What the delete removes: the project, its layer cache, build history, registry images, trust policies, and project tokens.

Prompts

Seven prompts chain the tools into workflows an agent would otherwise have to work out step by step. Every argument is stripped to the characters its kind can contain (a repository to owner/name, an id to letters, digits, ., _, -) and JSON-quoted before it is interpolated, so a hostile argument cannot rewrite the instructions.

Prompt

Arguments

What it does

diagnose-latest-failure

repo?

Find the last failed run, diagnose it, propose a fix.

explain-build-slowness

projectId?

Builds plus usage: is it cache misses or more work?

triage-failures-today

repo?, hours? (default 24)

List the window's failed and cancelled runs, group them by repo, workflow and failed jobs, diagnose up to 5 distinct groups, report a table marking each group recurring or new, and say which look safe to retry. It never asks the agent to retry anything; this server cannot.

compare-ci-runs

runA, runB

Run trees and metrics for both, diagnosis of the failing side; reports status diffs, duration and peak memory deltas per job, and failure groups present in one run but not the other.

cache-audit

projectId?

Projects with their cache policies, the last 20 builds of each, and 30 days of usage; flags hit ratios under 50%, cold builds, and short retention. States that resetting a project's cache is not offered.

debug-missing-secret

name, repo, branch?, workflow?

depot_list_ci_secrets and depot_list_ci_variables with the scoping filters; explains which variant would match the job and why it might not see it.

watch-run

runId

Poll depot_get_ci_run until the run finishes (bounded at 20 polls), then diagnose it on failure or list its artifacts on success.

Resources

Four read-only resources expose the same data by URI, for clients that attach context with @ mentions or resource pickers rather than tool calls. Each one calls the same Depot RPC and parser as the matching tool, returns text/plain, respects DEPOT_MCP_OUTPUT_BUDGET, and turns a Depot error into a readable JSON-RPC error. The templates carry no list callback and nothing subscribes: every read is a fresh request.

URI

Content

depot://ci/run/{runId}

The run's workflow, job and attempt tree, as depot_get_ci_run renders it (from GetRunStatus only).

depot://ci/runs/failed

The 20 most recent failed CI runs, newest first.

depot://project/{projectId}/builds

The project's 20 most recent container builds with cache hit ratios.

depot://projects

Every project with region, hardware and cache policy.

Output is always bounded

Every tool caps its own output and tells the agent when it truncated:

  • Log tools page forward into a ring buffer and return the tail, since GetJobAttemptLogs pages oldest-first with no tail parameter.

  • depot_diagnose_ci_failure propagates Depot's own bounds object as plain-language notes, and distinguishes what Depot dropped from what this server dropped, so a partial diagnosis never looks complete.

  • Every result respects DEPOT_MCP_OUTPUT_BUDGET.

Read-only model and security

Read the first point carefully.

  • Depot has no read-only token scope. An Organization token that can call ListRuns can also call CancelRun, RerunWorkflow, and DeleteProject. Nothing about the credential you hand this server makes it safe. This server's tool registration is the entire safety boundary: it is read-only by default because it registers no mutating tool unless DEPOT_MCP_ALLOW_WRITES is set, not because the token is restricted. With the flag set, the write tools exist, each dry-runs first, and each refuses server-side before calling Depot, but a dryRun: false call does change Depot. depot_dispatch_ci_workflow can start a workflow, bounded by DEPOT_MCP_DISPATCH_ALLOWLIST when set. There is still no tool that resets a project, deletes an image or secret, or mints a token. Treat readOnlyHint as a hint to the client, not as enforcement.

  • Irreversible writes sit behind a second gate. DEPOT_MCP_ALLOW_DESTRUCTIVE adds depot_delete_project only when DEPOT_MCP_ALLOW_WRITES is also set, and the tool refuses unless confirmProjectName matches the project's current name. Turning writes off turns deletion off with them; see Destructive writes.

  • Some operations are permanently out of scope, not merely deferred: ProjectService/ResetProject (deletes all cached data; a plausible-sounding "fix" with an irreversible, invisible, expensive blast radius), CIService/Run (executes arbitrary workflow content on your infrastructure), token and secret writes (CreateToken returns the secret, which would land in a transcript), image and tag deletion, and ShareBuild (creates a public URL; data exposure disguised as a read).

  • The token is never logged, echoed, or written to disk. It is read from the environment only, never printed in errors or in depot_whoami. Error messages from the transport layer and from Depot's own error envelopes are scrubbed of the token before they reach the model, in case a misconfigured endpoint echoes request headers. This server does not read ~/.config/depot/depot.yaml, so it cannot pick up ambient credentials you did not intend to give it.

  • CI variable values are scrubbed. Depot withholds secret values server-side, but returns variable values verbatim, and variables get misused as secret storage. Values whose name or content looks like a credential are replaced with a placeholder, and the result reports which rule fired so you still know the variable exists.

  • Create a dedicated Organization token for this server so you can revoke it independently.

  • stdio only, no listening port. The token crosses no network boundary other than TLS to api.depot.dev.

  • CI logs are untrusted text. Log lines, step summaries, artifact names, variable values, and Depot's AI diagnoses are derived from repository content, so anyone who can push to a repository that runs on Depot CI can put words in them. This server returns them; it does not act on them. Your agent might. Summaries fence that text between --- begin untrusted CI content --- and --- end untrusted CI content ---, label Depot's diagnosis and suggested fix as unverified, and carry a contentWarning field in structured output. The server instructions tell the model to treat it as data, never as commands.

  • Depot stores CLI credentials in plaintext (mode 0600), not the OS keychain: ~/Library/Application Support/depot/depot.yaml on macOS, ~/.config/depot/depot.yaml on Linux. Relevant if you copy a token from there. Note that the CLI prefers that stored login over DEPOT_TOKEN, so the CLI and this server can be looking at different organizations.

How clients treat the annotations differs: Claude Desktop uses readOnlyHint for auto-approval, Claude Code prompts on every call unless the tool is allowlisted, and Cursor uses its own run modes. Report security problems as described in SECURITY.md.

Limitations

  • Container builds cannot be started through Depot's API at all, by anyone. Running a build means acquiring an mTLS BuildKit endpoint and transferring the local build context; the depot CLI embeds a BuildKit fork to do it. Builds here are observability only. A human runs depot build, or CI does.

  • Container build steps are read over Connect's binary protobuf encoding, not JSON. Depot's JSON binding of GetBuildSteps fails on Depot's side (the server cannot encode its own response), so this server carries a small dependency-free protobuf codec for the two build-step RPCs, built from Depot's published build.proto. As of 2026-09-06, GetBuildStepLogs returns a server-side internal error on both encodings, so depot_diagnose_build reports the failing step and its recorded error but usually not the step's log lines; the result says so explicitly instead of failing.

  • depot.ci.v1 has reference docs but no published schema. It is absent from both depot/proto and the Buf Schema Registry. There is nothing to generate types from and nothing to diff for breaking changes. Rather than assert a contract nobody publishes, responses are read through tolerant accessors that accept either camelCase or snake_case, handle protobuf's int64-as-string encoding, and strip enum name prefixes. Missing fields degrade to "unknown" instead of crashing.

  • depot_get_ci_metrics returns Depot's raw document alongside the fields it recognises, because Depot documents that these RPCs return CPU and memory summaries without publishing their field names.

  • depot.ci.v3beta2 is beta in its name. The secrets and variables tools are the most breakage-prone. Their list filters are undocumented, so filtering happens in this server and the request sent to Depot is empty.

  • No log streaming. Depot caps concurrent log streams per token and per organization, and a careless streaming tool could exhaust that for your whole org, including your real CI. This server polls the unary GetJobAttemptLogs instead, which Depot's docs explicitly bless.

  • There is no wait_for_run_to_finish tool, deliberately. Long polls fit badly inside a tool-call timeout. Ask for status again instead; the agent can poll across turns.

Architecture

flowchart LR
    Client["MCP client<br/>(Claude Code, Cursor, VS Code, Codex, ...)"]
    Server["depot-mcp<br/>node dist/index.js"]
    API["api.depot.dev<br/>Connect JSON over HTTPS"]

    Client -- "JSON-RPC over stdio<br/>tools, prompts, resources" --> Server
    Server -- "POST /depot.ci.v1.CIService/GetFailureDiagnosis<br/>Authorization: Bearer DEPOT_TOKEN<br/>x-depot-org: DEPOT_ORG_ID" --> API
    API -- "JSON, read through tolerant accessors" --> Server
    Server -- "text summary + structuredContent,<br/>capped by DEPOT_MCP_OUTPUT_BUDGET" --> Client

One process, one credential, no listening port, no protobuf toolchain. Depot's Connect binding is plain JSON over HTTP POST, so the client is a fetch wrapper with retry. Tools are one module each under src/tools/; shared helpers (budget, redact, resolve, ci-target) keep them small and their output predictable. Design notes, the Depot API survey, and the prior-art review live in docs/ and research/.

Troubleshooting

Symptom

Cause and fix

claude mcp list shows Failed to connect and the log says sh: depot-mcp: command not found

You started Claude Code inside the depot-mcp repository itself: npx sees a project of the same name and skips the install. Start claude from any other directory, or point the registration at node <clone>/dist/index.js.

Server exits immediately with code 78

DEPOT_TOKEN is unset or empty. The client's env block is the usual place it went missing.

A project, build, or usage tool says unauthenticated while CI tools work

You have a user token. Those services accept only Organization tokens; see Which token can do what.

Every list is empty but the token is valid

Multi-organization token without DEPOT_ORG_ID. Call depot_whoami; it names the organizations it can see.

permission_denied or unauthenticated

Project token (not supported), a revoked token, or the wrong organization. depot_whoami distinguishes them.

depot_diagnose_ci_failure returns state: empty

The run had no failures Depot could cluster, or the ID is not a failed run. depot_list_ci_runs with status: ["failed"] finds one.

state: over_limit

The target is too broad. The result lists narrowerTargets; re-call with a workflow or job ID.

Result says truncated: true

Expected. Use the hint in the result (narrower filter, grep, pageToken) or raise DEPOT_MCP_OUTPUT_BUDGET.

depot_list_sandboxes or a registry repository tool is not in the tool list

They are beta and off by default. Set DEPOT_MCP_ENABLE_BETA=1 in the server's env; depot_whoami confirms whether it is on.

Client shows "response was interrupted" or context errors

The client's own MCP output cap. Prefer the diagnose tools over raw logs, lower tailLines, or use grep.

npx hangs on first run

It is downloading the package. Run npx -y depot-mcp once in a terminal, then restart the client.

Nothing in the client but the Inspector works

stdout must carry only JSON-RPC. If you added logging, send it to stderr.

429 resource_exhausted

Depot's per-token or per-organization limit. Wait; the server already backs off and retries.

deadline_exceeded after about 40 seconds

Depot did not answer within the per-call deadline. Retry; if it persists, narrow the request (fewer pages, a job instead of a run).

DEPOT_API_URL must be an https URL

Only https:// endpoints are accepted, except http://localhost for a local stub.

A write tool is missing from the tool list

DEPOT_MCP_ALLOW_WRITES is unset. That is the default; set it to 1 in the client's env block and restart the server. depot_stop_sandbox and depot_kill_sandbox also need DEPOT_MCP_ENABLE_BETA=1.

depot_dispatch_ci_workflow says the workflow is not on the allowlist

DEPOT_MCP_DISPATCH_ALLOWLIST is set and does not list that owner/name:workflow.yml. Add it, or unset the variable to allow any repository the token can see.

A write tool is missing from the tool list

DEPOT_MCP_ALLOW_WRITES is unset. That is the default; set it to 1 in the client's env block and restart the server.

depot_delete_project is missing although writes are on

DEPOT_MCP_ALLOW_DESTRUCTIVE is unset. It needs both flags; depot_whoami reports the destructive gate as off.

depot_delete_project answers confirmProjectName ... is not this project's current name

The confirmation did not match. Read the name from the dry-run preview or depot_get_project and have the user confirm it; the check is exact.

A write tool answers Refused ... before calling Depot

A precondition failed on the fresh read (target already terminal, workflow still running, nothing failed, attempt cap). The message names the rule; dryRun: true shows the current state.

The server writes one line to stderr on startup (depot-mcp 0.1.0 ready on stdio ...); most clients show stderr in their MCP logs.

Development

npm install
npm run typecheck   # tsc --noEmit, strict
npm run lint        # eslint with type-aware rules
npm test            # vitest, no network or Depot account needed
npm run build       # emit dist/
npm run inspect     # build, then open the MCP Inspector
npm run smoke:stdio # handshake + tools/list against dist/, no token needed
DEPOT_MCP_ENABLE_BETA=1 npm run smoke:stdio   # the same with the four beta tools registered

Tests drive a real Client against a real McpServer over the SDK's InMemoryTransport, with fetch stubbed to return recorded fixtures in test/fixtures/. They assert the full round trip: input validation, output-schema conformance, annotations, character budgets, and error translation. The fixtures cover all four GetFailureDiagnosis states (focused_failure, grouped_failures, over_limit, empty), empty results, and Connect error envelopes.

Live check against your own Depot organization

DEPOT_TOKEN=YOUR_DEPOT_TOKEN npm run smoke

This runs read-only calls only, prints what it found, and reports which checks passed, failed, or were skipped. It skips the failure-diagnosis check if your organization has no failed run to analyse; without one, the flagship tool cannot be exercised.

Before a release, npm run verify runs every tool, prompt, and resource against each token kind in .env and prints a cross-token matrix; docs/verification.md explains the matrix, the opt-in apply run, and the Claude Code session test a human does once per release.

Layout

src/
  index.ts          entrypoint: config, stdio transport
  server.ts         McpServer construction and instructions
  config.ts         environment resolution, fail-fast validation
  prompts.ts        the two chained workflows
  depot/
    client.ts       fetch against Depot's Connect JSON binding, with retry
    api.ts          typed RPC surface
    errors.ts       Connect error codes -> actionable messages
    shape.ts        tolerant accessors for an unpublished schema
  lib/
    tool.ts         registration, validation, error translation in one place
    write.ts        the write pattern: dryRun default, preview, refusal, audit line
    budget.ts       character budgets and truncation
    diagnosis.ts    parsing and shaping the GetFailureDiagnosis document
    ci-tree.ts      run -> workflow -> job -> attempt parsing
    ci-detail.ts    GetJob and GetWorkflow parsing, terminal states, attempt counts
    ci-target.ts    loose identifier resolution
    redact.ts       credential scrubbing
    write.ts        the dryRun / preview / refuse / apply shape of every write tool
    build.ts  project.ts  resolve.ts  time.ts
  tools/            one module per tool group; index.ts holds the write and beta gates
                    (beta.ts lists sandboxes.ts and registry-beta.ts)
  tools/            one module per tool group; index.ts holds the write and destructive gates,
                    writes.ts the gated lists, ci-writes.ts the five CI write tools,
                    projects-admin.ts the project update and delete
test/               vitest: unit, tool round-trips over InMemoryTransport, fixtures
docs/               design notes and distribution details
research/           the API and design research this was built from
.github/            CI, release, smoke and metadata scripts, templates
server.json         MCP Registry entry      manifest.json   Claude Desktop .mcpb manifest
Dockerfile          distroless stdio image  .mcp.json.example  Claude Code project config

research/ documents the Depot API, the MCP design decisions, and the prior-art survey this implementation follows. It is worth reading before changing anything non-obvious.

Contributing

Read CONTRIBUTING.md first. The short version: keep it read-only by default and every write behind the gate and its dry run, keep the token out of everything, keep output bounded, test through the MCP client harness, and sign off your commits (git commit -s). Bug reports and feature requests have templates; security issues go through SECURITY.md, not the issue tracker.

License

Apache License 2.0 with the Commons Clause License Condition v1.0. See LICENSE and NOTICE.

In plain words, you may:

  • use it, at home or at work, including inside commercial CI pipelines and paid products that happen to use Depot;

  • modify it, fork it, and redistribute it, as long as the LICENSE and NOTICE files travel with it;

  • contribute changes back under the same terms.

You may not:

  • sell it, charge for hosting it, or offer a paid product or service whose value comes entirely or substantially from this server's functionality.

Because of the Commons Clause this is source-available, not open source under the OSI definition. Everything else in Apache 2.0 (patent grant, no warranty, attribution) applies unchanged.

Depot is a trademark of its owner. This project is unaffiliated with Depot Technologies Inc.

Available Tools

28 tools
depot_audit_trust_policiesAudit Depot OIDC trust policies across projectsA
Read-onlyIdempotent

List every OIDC trust policy across your Depot container build projects and summarise which external CI identities (a GitHub repository, a Buildkite pipeline, a CircleCI project, a GitLab project) can build into which project.

Use this for access reviews: "who can push builds into our projects without a token", "is a repository we archived still trusted", "does any project trust a repository outside our organization". A project with no trust policies is common and fine; its builds authenticate with a token instead.

Pass projectId to audit one project; otherwise the first 50 projects are checked with one ListTrustPolicies call each. Read-only: adding or removing a trust policy is not offered by this server. Organization token only.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectIdNoLimit the audit to one project. Without it, up to 50 projects are audited.

Output Schema

ParametersJSON Schema
NameRequiredDescription
notesYes
projectsYes
identitiesYes
policyCountYes
projectCapHitYes
projectsFailedYes
projectsAuditedYes
projectsWithPoliciesYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description explicitly states it is read-only, that adding/removing trust policies is not offered, that an organization token is required, and that projects without trust policies are normal rather than errors.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well structured in three focused paragraphs: purpose, use cases, and parameter/behavior notes. No irrelevant details or redundant filler beyond what helps the agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Complete for an audit-style tool. It explains default scope, per-project behavior, authentication requirements, read-only nature, and an important edge case (projects with no trust policies). The output schema is present, so return values do not need to be described.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers projectId well with 100% coverage. The description adds useful nuance about auditing the first 50 projects by default and making one ListTrustPolicies call per project, giving the agent a clearer mental model.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states a specific action: listing every OIDC trust policy across Depot projects and summarizing which external CI identities can build into which project. This is distinct from sibling tools that focus on builds, runs, logs, or tokens.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit use cases for access reviews, such as 'who can push builds without a token' and 'is a repository we archived still trusted'. It also explains how the optional projectId parameter changes scope and what happens by default.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_compare_ci_runsCompare two Depot CI runsA
Read-onlyIdempotent

Compare two Depot CI runs side by side: which jobs changed status, got slower or faster, used more memory, appeared or disappeared, and which failures are new in the second run versus fixed since the first.

Use this when the question is about the difference between two runs rather than one run on its own: "what regressed between these two commits", "is this failure new or was it already broken on main", "did the retry fail the same way" (a flaky failure produces a different error message across runs; a deterministic one repeats), or "why is this run slower than the last one".

runA is the baseline (older, or known-good) and runB is the run under question; deltas read B minus A. Jobs are matched by their job key, so both runs should come from the same workflow or the matrix will be mostly "only in A" and "only in B". Failure fingerprints come from Depot's failure analysis and are only fetched for the sides that actually failed.

For a single run, use depot_diagnose_ci_failure instead: it explains the failure with diagnosis, suggested fix, and evidence lines, none of which this tool returns.

ParametersJSON Schema
NameRequiredDescriptionDefault
runAYesBaseline run id (the older or known-good run), as returned by depot_list_ci_runs.
runBYesRun id to compare against the baseline (the newer or suspect run). Deltas are B minus A.
maxJobsNoCap on job matrix rows. Rows that changed (status or presence) are kept first.
includeDiagnosisNoFetch Depot failure analysis for each failed side to list failures new in B and resolved in B. Set false to compare only status, timing, and memory.

Output Schema

ParametersJSON Schema
NameRequiredDescription
jobsYes
runAYes
runBYes
notesYes
metricsYesWhether GetRunMetrics answered for each side.
onlyInAYes
onlyInBYes
failuresYes
diagnosisYesWhether a failure diagnosis was fetched for each side.
truncatedYes
jobsOmittedYesRows dropped by maxJobs; changed rows are kept first.
jobsReturnedYes
statusChangesYes
contentWarningYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent annotations, the description discloses key behavioral details: deltas are read as B minus A, jobs are matched by job key, mismatched workflows yield mostly 'only in A'/'only in B' rows, and failure fingerprints are fetched only for sides that actually failed. It also states the tool returns no diagnosis, suggested fix, or evidence lines, which is important behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average, but every sentence earns its place: a front-loaded summary, usage examples, parameter/direction semantics, a matching caveat, and an explicit sibling alternative. It is well-structured into four focused paragraphs with no fluff or repetition of schema boilerplate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity and the presence of a rich output schema plus full parameter descriptions, the description covers all necessary operational context: when to use it, how runs are matched, direction of deltas, failure-fingerprint behavior, and how it differs from the diagnostic sibling. Nothing essential is missing for an agent to select and call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaningful semantics beyond the schema: it explains that jobs are matched by job key, warns that both runs should come from the same workflow or the matrix will be mostly 'only in A'/'only in B', and clarifies the runA/runB direction with 'deltas read B minus A'. This materially helps an agent invoke the parameters correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Compare'), names the resource ('two Depot CI runs'), and enumerates the exact dimensions compared (status, timing, memory, presence, failures). It also explicitly distinguishes itself from the sibling depot_diagnose_ci_failure by stating what this tool does not return, making selection unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use guidance with concrete example questions ('what regressed between these two commits', 'is this failure new or was it already broken on main') and an explicit when-not-to-use statement pointing to depot_diagnose_ci_failure for single-run diagnosis. This leaves no ambiguity about tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_diagnose_buildDiagnose a Depot container build failureA
Read-onlyIdempotent

Explain why a Depot container build failed: locate the step that broke and return its error and the tail of its logs, alongside cache effectiveness for the build.

Use this for "why did my docker build fail". Unlike Depot CI, container builds have no server-side AI diagnosis, so this tool does the legwork an agent would otherwise do by hand: read the build, page through its steps, pick the step that reported an error (or the last step that actually executed), and fetch only that step's logs.

Pass projectId when you know it. Depot's build record does not include a project id and the steps API requires one, so without it this tool has to scan recent builds across your projects, which costs several extra requests. DEPOT_PROJECT_ID works as a default.

Also reports cachedSteps vs totalSteps and secondsSaved, which is the fastest way to see whether a slow build is a cache miss problem rather than a code problem.

Read-only: this cannot start, retry, or cancel a build. Container builds cannot be triggered through Depot's API at all. If asked to start one, say that the user runs "depot build" locally or CI runs it; do not run the CLI on the user's behalf or look for a token to do so.

ParametersJSON Schema
NameRequiredDescriptionDefault
buildIdYesThe build id, as shown by depot_list_builds or the Depot dashboard.
projectIdNoThe project that owns the build. Strongly preferred: without it the server has to search.
tailLinesNoHow many trailing log lines to return from the failing step.

Output Schema

ParametersJSON Schema
NameRequiredDescription
buildYes
notesYes
logTailYes
projectIdYes
stepCountYes
failingStepNo
cacheSummaryYes
logTruncatedYes
logPageCapHitYes
logsUnavailableNo
logNextPageTokenNo
stepsUnavailableNo
logLinesTruncatedYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool read-only and idempotent, but the description adds meaningful behavioral detail: it cannot start, retry, or cancel builds, container builds cannot be triggered via Depot's API, omitting projectId triggers a costly project scan, and it reports cachedSteps vs totalSteps and secondsSaved. These details go well beyond the structured annotations and are consistent with them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average but front-loads the core purpose and every major section earns its place: what it returns, when to use it, parameter guidance, cache metrics, and the read-only boundary. Minor redundancy exists around the build being untriggerable, but the structure is clear and logical.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has an output schema and annotations covering read-only/idempotent behavior, so the description does not need to restate return values. It fully covers selection criteria, parameter trade-offs, failure semantics, and boundary conditions, making it complete for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds valuable parameter context: projectId is strongly preferred because the steps API requires it and omitting it forces a multi-project search, with DEPOT_PROJECT_ID as a default. It also explains the meaning of tailLines implicitly through 'tail of its logs' and notes the default behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Explain why a Depot container build failed' and details exactly what it returns: the broken step, its error, log tail, and cache effectiveness. It explicitly contrasts this tool with Depot CI diagnosis, distinguishing it from sibling tools such as depot_diagnose_ci_failure.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit trigger phrase ('why did my docker build fail'), names the alternative domain (Depot CI) where server-side AI diagnosis exists, and clarifies that this tool is for container builds that lack that diagnosis. It also provides operational guidance about when to pass projectId and when not to attempt starting a build.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_diagnose_ci_failureDiagnose a Depot CI failureA
Read-onlyIdempotent

Explain why a Depot CI run, workflow, job, or attempt failed.

Reach for this first whenever someone asks why CI failed, what broke the build, or to fix a failing job. It calls Depot's server-side failure analysis, which clusters every failure in the target by root cause and returns, for each cluster: the error message, an AI-written diagnosis, a suggested fix, and the exact log lines that are the evidence.

Prefer this over depot_get_ci_logs. Depot bounds this response server-side, so it costs far less context than raw logs, and it already works out which job is the real root cause rather than a downstream casualty. Use depot_get_ci_logs afterwards only if you need more detail on a specific attempt.

Pass whichever identifier you have in "id" — a run, workflow, job, or attempt ID. This server works out which kind it is; set "targetType" only when you already know it and want to skip that step.

How to read the returned "state":

  • "focused_failure": one clear culprit. Read representativeAttempts.

  • "grouped_failures": several distinct root causes, clustered by fingerprint. Read failureGroups.

  • "over_limit": too many failures to analyse at this level. narrowerTargets gives the IDs to call this tool again with.

  • "empty": Depot found no failure evidence. The target may still be running, may have succeeded, or may be old enough that its logs have aged out.

Diagnoses and suggested fixes are generated by Depot's AI and can be wrong — treat them as a lead to verify, not a fact. Read-only: this never retries, cancels, or triggers anything.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesA Depot CI identifier: a run, workflow, job, or attempt ID. Pass whatever you have — the server resolves which kind it is.
targetTypeNoWhat kind of thing "id" refers to. Omit unless you know it; the server otherwise infers it, falling back to trying each kind in turn.
maxEvidenceLinesNoCap on evidence log lines per failing attempt. Set 0 to get diagnoses and fixes without any log lines.
maxFailureGroupsNoCap on how many clustered root causes to return. Raise only if 5 was not enough.

Output Schema

ParametersJSON Schema
NameRequiredDescription
stateYesOne of focused_failure, grouped_failures, over_limit, empty, or unknown.
targetYes
contextYes
nextStepsYesDepot's suggested follow-ups, rewritten as calls to this server's tools.
truncationYes
emptyReasonNo
aiDisclosureNo
failureGroupsYes
contentWarningYesReminder that names, log lines, and diagnoses here are unverified CI output.
narrowerTargetsYesPresent when state is over_limit: narrower ids to re-run this tool against.
resolvedTargetTypeYesThe target kind that Depot accepted for this id.
representativeAttemptsYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint and idempotentHint, and the description reinforces this with "Read-only: this never retries, cancels, or triggers anything." It also discloses that diagnoses are AI-generated and can be wrong, and explains the server-side bounding behavior that limits context cost.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured into clearly labeled sections: purpose, when to use, parameter guidance, how to read the returned state, and a caution about AI-generated content. Every paragraph earns its place and the most important guidance is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description correctly focuses on interpretation rather than raw return format. It explains all meaningful states, gives actionable guidance for each, names the sibling tool to use afterward, and warns about reliability. Nothing essential is missing for correct invocation and response interpretation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaningful guidance beyond the schema by explaining that "id" accepts any identifier kind and the server resolves it, and that "targetType" is only needed to skip inference. This is valuable semantic context not present in the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: "Explain why a Depot CI run, workflow, job, or attempt failed." It clearly distinguishes this diagnostic tool from log retrieval and other CI tools by emphasizing root-cause analysis over raw logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says "Reach for this first whenever someone asks why CI failed" and names the alternative with a clear preference rule: "Prefer this over depot_get_ci_logs" and use logs only for more detail on a specific attempt. This leaves no ambiguity about when to choose this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_buildGet a Depot container buildA
Read-onlyIdempotent

Show one Depot container build: its status, when it was created, started and finished, how long it ran, and how much of it the cache served.

Use this to check on a specific build by id: "did build X succeed", "is it still running", "how well did the cache do". It is one request and returns quickly, so it is the right way to poll a build that is in progress; call it again after a pause rather than waiting inside a tool.

It does not explain a failure. When the status is failed, error, or canceled, call depot_diagnose_build with the same buildId (and the projectId, if you know it) to find the failing step and its logs. For a list of recent builds use depot_list_builds; for Depot CI runs, which are a different product, use depot_get_ci_run.

ParametersJSON Schema
NameRequiredDescriptionDefault
buildIdYesThe build id, as shown by depot_list_builds or the Depot dashboard.

Output Schema

ParametersJSON Schema
NameRequiredDescription
hintNoThe next tool to call, when there is an obvious one.
buildYes
failureYesTrue for failed, error, or canceled.
terminalYesTrue once the build has stopped, whatever the result.
cacheSummaryYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds valuable behavioral context beyond annotations: it is one fast request, it returns cache statistics, and it does not diagnose failures. This shapes agent expectations about latency and limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average but every sentence earns its place: output summary, use cases, polling guidance, failure limitation, and sibling routing. It is front-loaded with the core purpose and structured so an agent can scan it quickly. There is no redundant text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value details are not required in the description. The description covers the resource scope, expected data, polling behavior, failure-handling path, and relationships to relevant sibling tools. For a simple single-resource read, this is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single parameter, buildId, and it already documents where the id comes from. The description references 'specific build by id' and 'same buildId', but adds no new semantic detail beyond the schema. Baseline 3 is appropriate given full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Show one Depot container build') and explicitly enumerates the returned data (status, timestamps, duration, cache served). It distinguishes container builds from CI runs and references sibling tools like depot_get_ci_run, so an agent can immediately identify what this tool covers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance ('check on a specific build by id'), polling recommendations ('call it again after a pause'), and when-not-to-use instructions ('does not explain a failure'), routing to depot_diagnose_build, depot_list_builds, and depot_get_ci_run as appropriate. This leaves no ambiguity about selecting alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_cache_summarySummarise a Depot project cacheA
Read-onlyIdempotent

Report the health of one Depot project's layer cache: the retention policy against the current cache size, the cache hit ratio over recent builds, the time the cache saved, and plain-language observations (cache near its size limit, low hit ratio, builds arriving less often than the retention keeps layers).

Use this for "is our cache working", "why are builds not hitting cache", and "are we about to evict layers". It combines depot_get_project (policy), depot_list_project_usage (current size), depot_list_builds (per-build cache counters) and depot_get_usage (minutes billed and saved) so you do not have to.

What it cannot do: Depot's API does not list individual cache entries, so there is no per-layer view, and this server never resets a project's cache. Requires a projectId or DEPOT_PROJECT_ID, and an Organization token.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectIdNoThe project to summarise. Falls back to DEPOT_PROJECT_ID; depot_list_projects lists the options.
windowDaysNoUsage window in days, ending now, for cache size and minutes saved. Maximum 90.
buildSampleNoHow many of the most recent builds to aggregate the hit ratio over. Maximum 100.

Output Schema

ParametersJSON Schema
NameRequiredDescription
cacheYes
notesYes
policyYes
sampleYes
windowYes
billingNo
projectIdYes
limitationsYes
projectNameNo
observationsYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, and non-destructive behavior. The description adds useful context by mentioning it never resets the cache, requires an Organization token, and has no per-layer visibility, going beyond the annotation baseline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured into three short paragraphs covering purpose, usage, and limitations. Every sentence contributes meaningful guidance without redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that an output schema exists, return-value details are not required. The description provides sufficient context for invocation, including input fallback, aggregation logic, authentication need, and explicit non-capabilities, making it complete for an agent to decide and call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully describes all three parameters with types, defaults, and bounds. The description adds valuable semantics: projectId falls back to DEPOT_PROJECT_ID, windowDays is an ending-now usage window, and buildSample aggregates the most recent builds.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Report') and a clear resource ('Depot project's layer cache'), with a precise summary of the metrics covered. The intended use cases ('is our cache working', etc.) and the fact that it aggregates multiple underlying tools make its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly lists when to use the tool with concrete user questions and clearly states what it cannot do (no per-layer view, never resets cache). It also explains that it combines several other endpoints, giving an agent clear situational guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_ci_artifact_urlGet a signed download URL for one Depot CI artifactA
Read-onlyIdempotent

Mint a short-lived signed download URL for one Depot CI artifact, by artifact id.

Use this when you already know which artifact you want (from depot_list_ci_artifacts) and need to fetch it: a JUnit report to read the failing test names, a screenshot from a browser test, a built binary. Download it with curl or fetch as soon as you have the URL, since Depot signs it for minutes, not hours.

The URL is a bearer capability. Anyone holding it can download the artifact until it expires, so treat it like a credential: use it immediately and never write it anywhere durable (commit messages, issues, chat, files). This tool returns the URL only; it does not download the artifact or read its contents, and it cannot upload, replace, or delete anything.

To see what a run produced, or to get URLs for several artifacts in one call, use depot_list_ci_artifacts (with withDownloadUrl=true) instead.

ParametersJSON Schema
NameRequiredDescriptionDefault
artifactIdYesThe artifact id, as returned by depot_list_ci_artifacts.

Output Schema

ParametersJSON Schema
NameRequiredDescription
warningYesHandling instructions: the URL is a bearer capability.
expiresAtNoWhen the signature expires, when the URL says so.
artifactIdYes
downloadUrlYesSigned HTTPS URL. Short-lived; do not store it.
expiresInSecondsNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent annotations, it discloses that the URL expires in minutes, is a bearer capability, should not be persisted, returns only the URL, and cannot upload, replace, or delete artifacts.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well structured with clear paragraphs, but repeats the short-lived signed URL idea and the download-with-curl instruction, making it slightly more verbose than necessary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only tool, it fully covers how to use it, what it returns, its security implications, and when to use the sibling listing tool instead.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The sole parameter artifactId has a schema description that already covers its meaning and provenance; the tool description adds minimal extra parameter-level detail beyond that.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it mints a short-lived signed download URL for one Depot CI artifact by artifact ID, and distinguishes itself from depot_list_ci_artifacts as the targeted single-artifact retrieval tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use this when you already know which artifact you need, and names depot_list_ci_artifacts with withDownloadUrl=true as the alternative for listing artifacts or getting multiple URLs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_ci_attemptGet a Depot CI job attemptA
Read-onlyIdempotent

Show one attempt of a Depot CI job: its status, conclusion, recorded error, sandbox and session ids, timing, and whether it is the job's current attempt, with the parent job, workflow, and run for context.

Use this when you hold an attemptId (from depot_get_ci_run, depot_get_ci_job, or a diagnosis) and need that attempt's own record, for example to confirm which sandbox a retry ran in or how long it took before failing.

It does not explain the failure and does not return logs. For root cause, call depot_diagnose_ci_failure with the same id and targetType "attempt"; for raw output, depot_get_ci_logs; to compare all attempts of the job, depot_get_ci_job.

ParametersJSON Schema
NameRequiredDescriptionDefault
attemptIdYesThe attempt id, as shown by depot_get_ci_run or depot_get_ci_job (attemptId=...).

Output Schema

ParametersJSON Schema
NameRequiredDescription
jobYes
runYes
attemptYes
workflowYes
contentWarningYesReminder that names and error messages come from CI output and are unverified.

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, covering the safety profile. The description adds behavioral context beyond those annotations by telling the agent that the tool returns contextual parent job/workflow/run information and does not return logs or failure explanations, which is essential for setting expectations before invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loads the core purpose and return fields before moving to usage conditions and exclusions. Each sentence earns its place, and the routing to sibling tools is compactly presented without restating schema details or adding fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only one parameter, a rich description, a robust output schema, and annotations covering safety and idempotence, the description is complete for an agent to select and invoke the tool correctly. It covers what the tool returns, when to use it, what it does not do, and exactly which alternatives to choose for other needs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage and already describes attemptId as shown by depot_get_ci_run or depot_get_ci_job. The description enhances this by specifying that attemptId can come from depot_get_ci_run, depot_get_ci_job, or a diagnosis, and by clarifying that the same id can be reused with a targetType of 'attempt' for diagnosis, adding useful source and relationship context beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb-resource pair ('Show one attempt of a Depot CI job') and immediately lists the concrete fields returned, including status, conclusion, sandbox and session ids, timing, and current-attempt flag. It also distinguishes itself from siblings by explicitly stating what it does not do (explain failure, return logs) and names the tools that fill those gaps.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: 'Use this when you hold an attemptId... and need that attempt's own record,' including concrete examples. It also provides clear exclusion criteria and routes to alternatives: depot_diagnose_ci_failure for root cause, depot_get_ci_logs for raw output, and depot_get_ci_job for comparing attempts.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_ci_jobGet a Depot CI jobA
Read-onlyIdempotent

Show one Depot CI job: its status, conclusion, recorded error, runner labels, timing, and every attempt with the attempt and sandbox ids needed to drill in.

Use this when you already have a jobId (from depot_get_ci_run or a diagnosis) and want to know what happened to that job across retries: which attempt is current, whether earlier attempts failed the same way, how long each took, and where each ran. It fills the gap between the run tree and the raw logs.

It does not explain the failure and does not return logs. For root cause, call depot_diagnose_ci_failure with the same jobId; for a single attempt's record, depot_get_ci_attempt; for the whole run, depot_get_ci_run.

ParametersJSON Schema
NameRequiredDescriptionDefault
jobIdYesThe job id, as shown by depot_get_ci_run (jobId=...) or a diagnosis.

Output Schema

ParametersJSON Schema
NameRequiredDescription
jobYes
runYes
attemptsYesEvery attempt, newest first.
workflowYes
attemptCountYes
contentWarningYesReminder that names and error messages come from CI output and are unverified.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as readOnly, idempotent, and non-destructive. The description adds meaningful behavioral context: it explicitly says the tool 'does not explain the failure and does not return logs,' and that it returns the attempt and sandbox ids needed to drill in. This goes beyond the annotations by setting clear expectations about output boundaries and limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise paragraphs, each with a distinct role: overview of capabilities, when-to-use guidance, and exclusions/alternatives. The core statement 'Show one Depot CI job' is front-loaded, and every sentence earns its place by providing routing or behavioral context without repetition or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The single required parameter is fully documented in the schema, an output schema exists, annotations cover the safety and idempotency profile, and the description adds usage conditions, source of the jobId, and sibling routing. There is no missing information an agent would need to select and invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has only one required parameter, jobId, with 100% description coverage, and the schema description already says it is 'as shown by depot_get_ci_run (jobId=...) or a diagnosis.' The description repeats this source context but adds no new semantic detail about format, constraints, or behavior. Baseline 3 is appropriate because the schema already carries the parameter documentation burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Show one Depot CI job' and enumerates exactly what is returned: status, conclusion, recorded error, runner labels, timing, and every attempt with the attempt and sandbox ids. This clearly distinguishes it from siblings like depot_get_ci_attempt and depot_get_ci_run by scope and output.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use it: 'Use this when you already have a jobId...' and what it is for: understanding retries, current attempt, failures across attempts, timing, and location. It also names alternatives for other needs: depot_diagnose_ci_failure for root cause, depot_get_ci_attempt for a single attempt, and depot_get_ci_run for the whole run, plus clarifies what it does not do.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_ci_job_summaryGet a Depot CI job step summaryA
Read-onlyIdempotent

Read the step summary a Depot CI job authored for itself — the equivalent of GitHub Actions' $GITHUB_STEP_SUMMARY.

This is markdown the job's own steps chose to publish: test result tables, coverage deltas, lint counts, deployment URLs. When a job writes one, it is usually a far better explanation of what happened than its logs, because a human decided what mattered.

Most jobs write nothing here, and an empty result is normal rather than an error. If it comes back empty, use depot_diagnose_ci_failure for a failure, or depot_get_ci_logs for raw output.

"id" accepts an attempt id, a job id, or a run id.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesAn attempt id, job id, or run id.
targetTypeNoWhat "id" refers to. Omit to let the server work it out.

Output Schema

ParametersJSON Schema
NameRequiredDescription
emptyYes
targetYes
markdownYes
truncatedYes
contentWarningYesReminder that the markdown was authored by the job itself and is unverified.
originalLengthYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool readOnly, idempotent, and non-destructive; the description adds meaningful behavior beyond that: the summary is job-authored markdown and 'an empty result is normal rather than an error.' This prevents misinterpreting empty output as failure and clarifies the accepted id forms (attempt, job, or run id). No contradiction with annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every paragraph earns its place: purpose, interpretation/value, empty-result handling with sibling routing, and id flexibility. The first sentence is front-loaded with the exact operation, and there is no redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 100% schema coverage, an output schema, and strong annotations, the description covers purpose, usage context, empty behavior, alternatives, and id semantics. An agent has enough information to call the tool correctly and interpret the result without further inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema coverage is 100%, including an enum for targetType and a clear description for id. The description mostly restates the id flexibility without adding syntax or format details beyond the schema. Baseline 3 is appropriate because the schema carries the parameter-semantics weight.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names a specific verb ('Read'), a concrete resource ('step summary a Depot CI job authored for itself'), and anchors it to a familiar GitHub Actions concept ($GITHUB_STEP_SUMMARY). This clearly differentiates the tool from log- or run-level tools like depot_get_ci_logs or depot_get_ci_run even before reading the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells the agent that an empty result is normal and should not be treated as an error. It then routes to siblings: use depot_diagnose_ci_failure for a failure and depot_get_ci_logs for raw output, which is clear when-to-use vs alternatives guidance. It also explains why the summary is preferable to logs when present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_ci_logsGet Depot CI job logsA
Read-onlyIdempotent

Fetch a bounded slice of the persisted logs for a Depot CI job attempt.

Try depot_diagnose_ci_failure first. It is cheaper, it already contains the relevant log lines with a diagnosis attached, and it identifies which job actually broke. Use this tool when you need detail the diagnosis did not include: the full traceback, output from a step that did not fail, or a specific pattern.

Defaults to the last 200 matching lines, because failures land at the end of a log. "grep" (case-insensitive substring, not a regex), "stepKey" and "stream" are applied by this server after it fetches pages from Depot, so they reduce what you receive but not what is read: a grep still walks the log page by page, up to DEPOT_MCP_MAX_LOG_PAGES pages (default 20), and is the most expensive way to use this tool. Prefer stepKey or stream, which at least keep the returned window small.

"id" accepts an attempt id, a job id, or a run id. Given a run id this picks that run's failed job (or its last job) and reads the latest attempt, mirroring what "depot ci logs" does.

Paging contract:

  • Without a pageToken you get the tail: the last "tailLines" matching lines of what was read. If the page cap stops the walk first, the result says so, the lines are the end of what was read rather than the end of the log, and nextPageToken continues forward from there.

  • With a pageToken you get the next window forward: up to "tailLines" lines in order from that point, and a new nextPageToken if more remain. Nothing in a forward window is ever dropped for the character budget; the window just closes early and the token resumes at the exact next line, so following nextPageToken until it is absent yields every line exactly once. That is how to follow a running job's output across turns.

  • Pass tokens back verbatim. Some are issued by this server rather than Depot; both are opaque.

  • Each line body is capped at 2000 characters ("bodyTruncated" marks the ones that were cut).

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesAn attempt id, job id, or run id. Attempt ids give the most precise result.
grepNoCase-insensitive substring filter applied to line bodies by this server after fetching. Not a regular expression.
streamNoKeep only one output stream. stderr alone is often enough to spot a failure.
stepKeyNoKeep only lines from this step, as reported in a line's stepKey.
pageTokenNoContinue forward from a previous nextPageToken instead of returning the tail. Use this to poll a running job or to read a log from the start.
tailLinesNoMaximum log lines per call: the last N of what was read without a pageToken, the next N forward with one.
targetTypeNoWhat "id" refers to. Omit to let the server work it out.
includeTimestampsNoPrefix each rendered line with its ISO timestamp. Costs context; usually not needed.

Output Schema

ParametersJSON Schema
NameRequiredDescription
linesYes
notesYes
targetYes
truncatedYes
pageCapHitYes
linesMatchedYes
pagesFetchedYes
linesReturnedYes
nextPageTokenNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint and idempotentHint, but the description adds substantial behavioral context beyond that: the paging contract, tail vs forward window semantics, page cap behavior, server-side filtering versus what is actually read, body truncation at 2000 characters, and opaque token handling. This fully discloses how the tool behaves at the edges.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every section earns its place: purpose, routing to a cheaper alternative, filter semantics, ID polymorphism, and a detailed paging contract. It is front-loaded with the most important guidance and organized so an agent can quickly extract the key constraints without parsing fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 8 parameters, a paging contract, and ambiguous ID types, the description covers everything needed to call it correctly: default behavior, page limits, continuation tokens, line truncation, and cost guidance. Since an output schema exists, the description is not required to document return values, and nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100%, the description adds meaning the schema alone does not convey: id accepts attempt, job, or run IDs with a defined fallback; grep is a case-insensitive substring, not a regex; pageToken continuation semantics; and the cost implications of grep versus stepKey or stream. This is exactly the kind of parameter knowledge an agent needs to invoke the tool correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Fetch a bounded slice of the persisted logs for a Depot CI job attempt'), and immediately distinguishes itself from depot_diagnose_ci_failure by naming the sibling and explaining when that tool should be used instead. This makes the tool's scope unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use and when-not-to-use guidance: 'Try depot_diagnose_ci_failure first' and 'Use this tool when you need detail the diagnosis did not include.' It also advises preferring stepKey or stream over grep for cost reasons, giving the agent a clear decision procedure.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_ci_metricsGet Depot CI CPU and memory metricsA
Read-onlyIdempotent

Read CPU and memory metrics for a Depot CI run, job, or job attempt.

Use this when a job died without a useful error, was killed abruptly, hit an exit code like 137, or is simply slow — the shapes to look for are memory sitting at its limit (an OOM kill) or CPU pinned at 100% for the whole job (under-provisioned runner).

"id" accepts a run, job, or attempt id and the level is inferred; set "level" to pick explicitly. Note that metrics for a still-running attempt grow between calls, so a snapshot time is reported.

Depot does not publish field names for these responses, so this tool returns the metrics it recognises plus the raw document (bounded) so nothing is lost. Very large metrics results are rejected by Depot itself with a resource-exhausted error — ask for a single attempt rather than a whole run if that happens.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesA run id, job id, or attempt id.
levelNoWhich level "id" refers to. Omit to infer; the server otherwise tries run, then job, then attempt.

Output Schema

ParametersJSON Schema
NameRequiredDescription
idYes
levelYes
metricsYes
rawJsonYesDepot's metrics document as JSON text, truncated if large.
likelyOomNo
rawTruncatedYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only and idempotent, and the description adds meaningful behavioral context: metrics for a running attempt change between calls, a snapshot time is reported, and the response includes the raw document because Depot publishes no field names. It also discloses the resource-exhausted failure mode and a workaround.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then flows from usage triggers to parameter behavior to response shape and failure handling. Every sentence adds information; no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description does not need to enumerate return fields, and it still covers param semantics, changing-data behavior, response composition, and error handling. An agent has enough context to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds important semantic detail: the level is inferred when omitted, and the server tries run, then job, then attempt. This goes beyond the schema's parameter descriptions and clarifies how 'level' and 'id' interact.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Read CPU and memory metrics for a Depot CI run, job, or job attempt.' The stated use cases (OOM kills, exit 137, under-provisioned runner) set it apart from sibling tools like depot_get_ci_logs and depot_get_ci_job_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly instructs when to use the tool: when a job died without a useful error, was killed, hit exit 137, or is slow. It gives diagnostic patterns (memory at limit, CPU pinned) but does not name specific sibling alternatives or say when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_ci_runGet a Depot CI run treeA
Read-onlyIdempotent

Show one Depot CI run as its workflow -> job -> attempt tree, with the status of every node and the ids needed to drill in.

Use this to see the shape of a run: which jobs exist, which failed, and which attempt ids to pass to depot_get_ci_logs or depot_get_ci_metrics. Set failedOnly=true to cut a large matrix down to just the broken jobs.

This does not explain failures — it only reports structure and status. For root cause, call depot_diagnose_ci_failure with the same run id.

ParametersJSON Schema
NameRequiredDescriptionDefault
runIdYesThe run id, as returned by depot_list_ci_runs.
failedOnlyNoShow only jobs that failed or were cancelled. Useful for wide build matrices.

Output Schema

ParametersJSON Schema
NameRequiredDescription
runYes
jobCountYes
workflowsYes
failedJobCountYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as readOnly, idempotent, openWorld=false, and non-destructive. The description adds important behavioral context beyond annotations: the tool only reports structure and status, does not explain failures, and returns node ids needed for drilling into logs/metrics. This is exactly the kind of limitation disclosure that helps an agent avoid misusing the result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight paragraphs, each earning its place: first defines the output, second gives concrete usage and the flag, third states the limitation and routes to the correct alternative. No filler or repetition of annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only tree tool with an output schema and full parameter schema coverage, the description supplies all required context: what the output looks like, which jobs/attempts to inspect, how to filter, what the tool does not do, and which sibling to call for root cause. Nothing an agent needs to select or invoke the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both runId and failedOnly clearly. The description reinforces failedOnly's purpose ('cut a large matrix down to just the broken jobs') but does not add meaning beyond what the schema provides. A baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: 'Show one Depot CI run as its workflow -> job -> attempt tree' with node statuses and drill-in IDs. It distinguishes itself from siblings by explicitly noting this tool does not explain failures and that root cause belongs to depot_diagnose_ci_failure.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance on when to use the tool ('Use this to see the shape of a run'), how to use failedOnly for large matrices, and when not to use it ('does not explain failures') with a clear alternative call: depot_diagnose_ci_failure. It also tells the agent which attempt ids to pass to depot_get_ci_logs or depot_get_ci_metrics.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_ci_workflowGet a Depot CI workflowA
Read-onlyIdempotent

Show one Depot CI workflow: its status and timing, its parent run, its execution history (every rerun or retry, oldest first), and its job -> attempt tree with the ids needed to drill in.

Use this when you have a workflowId (from depot_list_ci_workflows, depot_get_ci_run, or a diagnosis) and want to see how the workflow has been rerun and which of its jobs and attempts failed. It is the workflow-level counterpart of depot_get_ci_run.

It does not explain failures or return logs. For root cause, call depot_diagnose_ci_failure with the same id and targetType "workflow"; for one job across its attempts, depot_get_ci_job; for a whole run with several workflows, depot_get_ci_run.

ParametersJSON Schema
NameRequiredDescriptionDefault
workflowIdYesThe workflow id, as returned by depot_list_ci_workflows or depot_get_ci_run.

Output Schema

ParametersJSON Schema
NameRequiredDescription
runYes
jobsYes
jobCountYes
workflowYesThe workflow as it stands now. startedAt, finishedAt and durationSeconds are those of the latest execution when Depot lists executions; the top-level timing Depot returns spans from the first start to the last finish and is not the time anything ran.
executionsYesRerun and retry lineage in the order Depot reports it, oldest first.
executionCountYes
failedJobCountYes
latestExecutionNoThe execution with the highest number: the one whose timing the summary reports.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds valuable behavioral details beyond annotations: execution history is ordered oldest first, the response includes IDs for drilling in, and the tool explicitly does not explain failures or return logs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a clear front-loaded summary of what is returned, followed by when to use it, then what it does not do and which alternatives to choose. Every sentence earns its place and there is no redundant restatement of the title or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With one parameter, rich annotations, and an output schema present, the description is complete for an agent to select and invoke the tool correctly. It covers what the tool returns, where the input comes from, its limitations, and how it relates to sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the single required parameter workflowId is already documented in the schema. The description reinforces that the ID comes from depot_list_ci_workflows or depot_get_ci_run, but adds no new format or syntax detail, which matches the baseline for full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Show') and resource ('one Depot CI workflow') and enumerates exactly what is returned: status/timing, parent run, execution history, and job→attempt tree with IDs. It also distinguishes itself from siblings by calling itself the 'workflow-level counterpart of depot_get_ci_run.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use guidance: use when you have a workflowId and want to see reruns and failed jobs/attempts. It also names alternatives and exclusion conditions: for root cause use depot_diagnose_ci_failure, for one job use depot_get_ci_job, for a whole run use depot_get_ci_run, and it clarifies it does not explain failures or return logs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_projectGet one Depot project and its trust policiesA
Read-onlyIdempotent

Show one Depot container build project's full configuration together with its OIDC trust policies.

Use this to check build capacity and cache retention for a specific project, and to audit which external CI systems are allowed to exchange an OIDC token for Depot credentials — trust policies are the answer to "how does our GitHub Actions workflow authenticate to Depot without a stored token".

Trust-relationship tokens carry project-token permissions, which means they cannot reach the Depot CI API or the Depot API; only container builds and the registry.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectIdYesThe project id, from depot_list_projects.

Output Schema

ParametersJSON Schema
NameRequiredDescription
projectYes
trustPoliciesYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable security context beyond annotations: trust-relationship tokens carry project-token permissions and cannot reach the Depot CI API or Depot API, only container builds and the registry. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a front-loaded purpose sentence, followed by use cases and a security note. Each paragraph adds distinct information, though it is slightly longer than a purely minimal definition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only single-resource tool with an output schema, the description covers purpose, use cases, and authentication semantics. Nothing needed to select and invoke the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single projectId parameter is already documented as coming from depot_list_projects. The description adds no additional parameter-level meaning, so it does not need to compensate; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Show one Depot container build project's full configuration together with its OIDC trust policies.' This clearly distinguishes it from sibling list/diagnostic tools by narrowing scope to a single project and its trust policies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit use cases: 'check build capacity and cache retention for a specific project' and 'audit which external CI systems are allowed to exchange an OIDC token for Depot credentials.' It does not explicitly name when-not-to-use alternatives, but the 'specific project' framing makes the boundary clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_get_usageGet Depot usage and spend driversA
Read-onlyIdempotent

Report Depot usage for a period: container build minutes and minutes saved by caching, GitHub Actions runner minutes by repository and workflow, storage, and agent sandbox minutes.

Use this for cost questions — "what is burning our Depot minutes", "which repo dominates our runner bill", "is the cache actually paying for itself". minutesSaved against minutesBilled is the cache's return on investment; a project with high billed minutes and low saved minutes is where to look first.

This is also the only place Depot exposes managed GitHub Actions runner data through the API, and it is aggregated: there is no per-job runner list.

Pass projectId to scope to one container build project, which returns build counts, duration and layer cache size instead of the organization-wide breakdown. Defaults to the last 30 days.

ParametersJSON Schema
NameRequiredDescriptionDefault
daysNoLook back this many days from now. Ignored when startAt and endAt are both given.
endAtNoEnd of the window, RFC 3339 or YYYY-MM-DD. Dates are UTC. A date-only value is inclusive: "2024-01-31" covers all of 31 January. Requires startAt.
startAtNoStart of the window, RFC 3339 or YYYY-MM-DD. Dates are UTC; a date-only value means midnight at the start of that day. Requires endAt.
projectIdNoScope to one container build project instead of the whole organization.

Output Schema

ParametersJSON Schema
NameRequiredDescription
notesYes
scopeYes
storageYes
periodEndYes
periodStartYes
agentSandboxYes
projectUsageNo
containerBuildYes
githubActionsJobsYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, and the description adds valuable behavioral context: the data is aggregated, there is no per-job detail, projectId changes the response shape, and the default window is 30 days. It also explains the meaningfulness of minutesSaved vs minutesBilled, which goes beyond the structured schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized for a complex usage-reporting tool and is front-loaded with a concise summary of what it returns. Every sentence adds value: use cases, the uniqueness of the runner data, aggregation caveats, and scope behavior. There is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with an output schema, read-only annotations, and a rich input schema, this description is complete. It covers what data is returned, when to use it, how scope changes, exclusions, and default behavior. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by explaining that projectId returns build counts, duration, and layer cache size instead of the organization-wide breakdown, and by confirming the default look-back period. It does not deeply discuss startAt/endAt semantics, but the schema already covers those.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: it reports Depot usage for a period, enumerating build minutes, caching savings, runner minutes, storage, and sandbox minutes. It clearly differentiates this from sibling list/diagnose tools by framing it as the cost/spend reporting endpoint and noting it is the only API exposure for managed runner data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to use this for cost questions and gives concrete examples like 'what is burning our Depot minutes' and 'which repo dominates our runner bill'. It also clarifies that there is no per-job runner list, preventing misuse, and explains when to pass projectId to change scope.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_buildsList Depot container buildsA
Read-onlyIdempotent

List recent container builds for a Depot project, with duration and cache effectiveness for each.

Use this to find a build to diagnose, or to answer "are our builds getting slower" — every row carries cachedSteps, totalSteps and secondsSaved, so a run of builds with a low cache hit ratio is visible immediately without opening the dashboard.

Requires a projectId; DEPOT_PROJECT_ID is used when set, and depot_list_projects lists the options. These are container builds only, not Depot CI runs — use depot_list_ci_runs for those.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum builds to return.
pageTokenNonextPageToken from a previous call.
projectIdNoThe project to list builds for. Falls back to DEPOT_PROJECT_ID.

Output Schema

ParametersJSON Schema
NameRequiredDescription
buildsYes
returnedYes
projectIdYes
nextPageTokenNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as read-only, idempotent, and non-destructive. The description adds useful behavioral context: it mentions the returned fields (cachedSteps, totalSteps, secondsSaved), the DEPOT_PROJECT_ID fallback, and that results are 'recent', which conveys ordering without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short paragraphs, each earning its place: the first defines the core function, the second gives concrete diagnostic use cases, and the third covers required context and sibling differentiation. No filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with an output schema, the description covers what the tool returns, how to select a project, when to use it, and what it is not. An agent has everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all three parameters with descriptions, so the baseline is 3. The description adds extra semantic value by stating 'Requires a projectId' despite the schema having no required fields, explaining the DEPOT_PROJECT_ID fallback, and pointing to depot_list_projects as a source for valid IDs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List recent container builds for a Depot project, with duration and cache effectiveness for each.' It clearly distinguishes container builds from CI runs, and the semantics are aligned with the title and annotations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'to find a build to diagnose, or to answer are our builds getting slower.' It also names the alternative: 'use depot_list_ci_runs for those' and points to depot_list_projects for project ID discovery.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_ci_artifactsList Depot CI artifactsA
Read-onlyIdempotent

List the artifacts a Depot CI run, workflow, job, or attempt uploaded, optionally with signed download URLs.

Use this to find out what a run produced — test reports, JUnit XML, coverage output, built binaries, screenshots from a failed browser test. Filter to one job or attempt by passing its id alongside runId.

Set withDownloadUrl=true to also fetch signed HTTPS URLs, which are minted one request per artifact and capped at 10 per call. This tool never downloads or reads artifact contents; it returns metadata and links only.

ParametersJSON Schema
NameRequiredDescriptionDefault
jobIdNoNarrow to one job.
limitNoMaximum artifacts to return.
runIdNoThe run whose artifacts you want.
attemptIdNoNarrow to one attempt.
pageTokenNoContinue a previous listing: pass the nextPageToken from the last call, with the same filters.
workflowIdNoNarrow to one workflow within the run.
withDownloadUrlNoAlso mint a signed download URL per artifact. Costs one extra request each, capped at 10.

Output Schema

ParametersJSON Schema
NameRequiredDescription
notesYes
returnedYes
artifactsYes
nextPageTokenNo

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds important behavioral detail beyond those annotations: signed URLs are minted one request per artifact, capped at 10 per call, and the tool only returns metadata and links without downloading contents. This is exactly the kind of context an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: the first sentence captures the core operation, the second gives practical use cases, and the third explains the optional signed-URL behavior and its constraints. No sentence is wasted, and the most decision-relevant detail (never downloads contents) is included early.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and annotations covering safety, the description provides the remaining behavioral context an agent needs: what artifacts are for, how to narrow results, how signed URLs behave, and the cap. Pagination is handled by the schema's pageToken description, so nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter. The description adds some relational context (e.g., passing jobId/attemptId alongside runId, withDownloadUrl costing extra requests) but does not substantially expand beyond the schema's own descriptions. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List'), a precise resource ('artifacts'), and the exact scope ('a Depot CI run, workflow, job, or attempt'). It also clarifies what the tool does not do ('never downloads or reads artifact contents'), making its purpose unmistakable even among many sibling CI tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: 'Use this to find out what a run produced' with concrete examples, and explains when to filter by job or attempt. It does not explicitly compare against sibling tools like depot_get_ci_logs or depot_get_ci_job_summary, so an agent is left to infer those boundaries, but the guidance is otherwise strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_ci_runsList Depot CI runsA
Read-onlyIdempotent

List recent Depot CI runs, newest first, optionally filtered by status, repository, commit, trigger, or pull request.

Use this to find the run someone is talking about — "my last failed build", "did main go green", "what ran for PR 412" — and then pass the returned runId to depot_diagnose_ci_failure or depot_get_ci_run.

The fastest path to diagnosing a recent breakage is status=["failed"] with limit=1, then depot_diagnose_ci_failure on the runId that comes back.

Returns identity, status and timing only. It does not return logs or failure detail; use depot_diagnose_ci_failure for that.

ParametersJSON Schema
NameRequiredDescriptionDefault
prNoPull request number. Depot requires repo to be set alongside this.
shaNoFilter to runs for one commit SHA.
repoNoRepository in "owner/name" form. Required when filtering by pr.
limitNoMaximum runs to return in one call.
statusNoKeep only runs in these states. "finished" means completed successfully; a failed run reports "failed".
triggerNoFilter by what started the run, for example "push" or "workflow_dispatch".
pageTokenNonextPageToken from a previous call, to fetch the following page.

Output Schema

ParametersJSON Schema
NameRequiredDescription
runsYes
returnedYes
nextPageTokenNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description only needs to add context beyond safety. It adds newest-first ordering, the limited return payload ('identity, status and timing only'), and the explicit absence of logs or failure detail. Pagination behavior is not described in prose, but the schema's pageToken parameter covers that gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and ordering, then moves to use cases, a recommended call pattern, and finally the boundary of what the tool returns. Every sentence earns its place and no sentence merely repeats the schema or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with a rich input schema and an output schema, the description covers ordering, filtering, return scope, exclusions, and next steps with the returned runId. An agent can both select this tool over siblings and invoke it correctly without needing further inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds value by grouping the optional filters into a readable list and by providing a concrete recommended argument combination: status=['failed'] with limit=1. It does not redefine each parameter, but the invocation pattern gives the agent useful guidance beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'List recent Depot CI runs' including ordering ('newest first'). It clearly names the filter dimensions and explicitly contrasts itself with depot_diagnose_ci_failure and depot_get_ci_run by stating what it returns and what it does not. This cleanly separates it from sibling list/detail/diagnosis tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives concrete use cases ('find the run someone is talking about', 'did main go green', 'what ran for PR 412') and a recommended fast path: status=['failed'] with limit=1, then depot_diagnose_ci_failure. It also explicitly says the tool does not return logs or failure detail and directs the agent to depot_diagnose_ci_failure for that, so when-to-use and when-not-to-use are both clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_ci_secretsList Depot CI secret names and scopingA
Read-onlyIdempotent

List the names and scoping of Depot CI secrets. Values are never returned — Depot's API does not expose them at all, by design.

Use this to answer "why can't my job see $FOO". Depot models a secret as one name with several variants, each scoped by repository, environment, branch, and workflow attributes; a job that cannot see a secret usually means no variant matches that job's scope. Compare what this returns against the job you are debugging.

Filtering happens in this server, because Depot's v3beta2 list filters are undocumented. Note that depot.ci.v3beta2 is a beta API and the most likely of Depot's surfaces to change.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNoCase-insensitive substring match on the name.
branchNoKeep variants scoped to this branch.
workflowNoKeep variants scoped to this workflow.
repositoryNoKeep variants scoped to this repository, plus unscoped ones.
environmentNoKeep variants scoped to this environment.

Output Schema

ParametersJSON Schema
NameRequiredDescription
secretsYes
returnedYes
valuesAvailableYesAlways false: Depot never returns secret values over the API.

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent annotations, the description discloses that secret values are never exposed by design, that filtering happens server-side because the API's filters are undocumented, and that the beta API surface is likely to change. These are meaningful behavioral traits that aid safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the most important fact (names/scoping, no values) and every sentence adds distinct value: use case, scoping model, server-side filtering, and beta API warning. There is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with an output schema and five well-described optional parameters, the description covers purpose, behavioral constraints, filtering rationale, and API stability. An agent has enough context to select and call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline applies; each parameter already has a clear description. The description only notes that filtering happens server-side, which does not add parameter-specific meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool lists Depot CI secret names and scoping, and immediately notes that values are never returned. This is a specific verb+resource pairing, though it does not explicitly distinguish itself from the sibling depot_list_ci_variables.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a concrete use case: answer 'why can't my job see $FOO' by comparing returned scoped variants against the failing job. It provides clear context but does not name alternatives or state when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_ci_variablesList Depot CI variables and their scopingA
Read-onlyIdempotent

List Depot CI variables, their values, and their scoping.

Use this for the same "why can't my job see $FOO" question as depot_list_ci_secrets, and to check that a variable holds what you expect for a given branch or environment. Depot models a variable as one name with several variants, each scoped by repository, environment, branch, and workflow.

Unlike secrets, Depot does return variable values. Because variables are routinely misused to hold credentials, this server redacts any value whose name or content looks like a secret and reports which rule fired, so a redacted value still tells you the variable exists.

Filtering happens in this server. depot.ci.v3beta2 is a beta API and the most likely of Depot's surfaces to change.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNoCase-insensitive substring match on the name.
branchNoKeep variants scoped to this branch.
workflowNoKeep variants scoped to this workflow.
repositoryNoKeep variants scoped to this repository, plus unscoped ones.
environmentNoKeep variants scoped to this environment.

Output Schema

ParametersJSON Schema
NameRequiredDescription
returnedYes
variablesYes
redactedCountYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent annotations, the description discloses meaningful behavior: values are returned, secret-looking values are redacted with the firing rule reported, filtering happens server-side, and the API is beta and subject to change. This is substantial extra context that helps an agent know what to expect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and then layers usage, scoping model, redaction behavior, and beta warning in a logical order. Each sentence earns its place; nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a full input schema, an output schema, and annotations, the description still adds the missing context an agent needs: valuation behavior, redaction rules, scoping semantics, and API stability. It is complete for both selection and correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds useful conceptual background about scoping variants and server-side filtering, but it does not add per-parameter semantics beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List Depot CI variables, their values, and their scoping.' It also differentiates itself from the closely related depot_list_ci_secrets tool by explicitly noting that Depot returns variable values here, unlike secrets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a concrete use case: answering the 'why can't my job see $FOO' question, and explicitly names depot_list_ci_secrets as the related alternative. The 'Unlike secrets' sentence clarifies the key distinction and helps the agent choose the correct tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_ci_workflowsList Depot CI workflowsA
Read-onlyIdempotent

List recent Depot CI workflows, newest first, with each one's status and job counts, optionally filtered by workflow name, status, repository, commit, trigger, or pull request.

Use this when the question is about a named workflow rather than a whole run: "is the deploy workflow green", "which CI workflows failed today", "how many jobs failed in the release workflow". A run groups every workflow a push triggered; this lists the workflows themselves, each with its parent runId.

Returns identity, status, and counts only. It does not return jobs or failure detail: pass a workflowId to depot_get_ci_workflow for its jobs and rerun history, or to depot_diagnose_ci_failure with targetType "workflow" for root cause.

ParametersJSON Schema
NameRequiredDescriptionDefault
prNoPull request number. Depot requires repo to be set alongside this.
shaNoFilter to workflows for one commit SHA.
nameNoKeep only workflows with this name, as written in the workflow YAML "name:" field.
repoNoRepository in "owner/name" form. Required when filtering by pr.
limitNoMaximum workflows to return in one call.
statusNoKeep only workflows in these states. "finished" means completed successfully; a failed workflow reports "failed". Omit for every state.
triggerNoFilter by what started the workflow, for example "push" or "workflow_dispatch".
pageTokenNonextPageToken from a previous call, to fetch the following page.

Output Schema

ParametersJSON Schema
NameRequiredDescription
returnedYes
workflowsYes
nextPageTokenNo

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only, idempotent, and non-destructive, so the safety profile is covered. The description adds behavioral substance beyond that: results are newest-first, each workflow carries its parent runId, and only identity/status/counts are returned rather than jobs or failure detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized into summary, usage, and limitation/routing sections; the key fact is front-loaded and each sentence carries information. It is longer than a single line but justified by the need to disambiguate from run-level siblings.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and annotations covering safety, the description supplies the remaining decision context: when to choose this tool, what it omits, and where to go for jobs or root cause. There is no obvious missing information an agent needs to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents all eight optional filters and their constraints. The description only lists the filter dimensions (name, status, repo, commit, trigger, PR) without adding syntax or format details, matching the baseline for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names a specific verb ('List'), a resource ('Depot CI workflows'), an ordering ('newest first'), and the returned fields ('status and job counts'). The second paragraph explicitly distinguishes it from run-level tools by explaining that a run groups workflows while this returns the workflows themselves, so it stands apart from depot_list_ci_runs and siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit 'Use this when...' condition with concrete example questions about named workflows. It also states what it does not do and routes to alternatives: depot_get_ci_workflow for jobs and rerun history, and depot_diagnose_ci_failure with targetType 'workflow' for root cause.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_imagesList images in a Depot project registryA
Read-onlyIdempotent

List the container images stored in a Depot project's registry, with tag, digest, push time, and size.

Use this to check whether a build actually pushed what you expected, to find the digest behind a tag before a deploy, or to see when an image was last refreshed.

Requires a projectId; DEPOT_PROJECT_ID is used when set, and depot_list_projects lists the options.

Read-only: this cannot delete tags or images. Image deletion is deliberately not exposed by this server, since it is irreversible and something may be deploying what you delete.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum images to return.
pageTokenNonextPageToken from a previous call.
projectIdNoThe project whose registry to list. Falls back to DEPOT_PROJECT_ID.

Output Schema

ParametersJSON Schema
NameRequiredDescription
imagesYes
returnedYes
projectIdYes
nextPageTokenNo

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/idempotentHint/destructiveHint annotations, the description explicitly states the operation cannot delete tags or images and explains WHY deletion is not exposed—it is irreversible and something may be deploying what you delete. It also discloses the DEPOT_PROJECT_ID fallback behavior, adding context the annotation booleans alone do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence carries the core purpose, followed by short paragraphs for use cases, environment/parameter behavior, and a safety note. Every sentence earns its place, though four paragraphs is slightly more than strictly necessary for a simple list operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with an output schema, 100% schema parameter coverage, and four safety annotations, the description covers purpose, use cases, the projectId mechanism, and the read-only guarantee. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters are already fully documented (limit bounds and default, pageToken semantics, projectId fallback). The description only restates the projectId fallback in prose without adding new parameter-level detail, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List the container images stored in a Depot project's registry, with tag, digest, push time, and size.' It names the exact returned fields, and no sibling tool covers image listing, so it is trivially distinguishable from the other fourteen depot_* tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Three concrete use cases are given: verifying a build pushed what was expected, finding the digest behind a tag before deploy, and checking when an image was last refreshed. It also routes the agent to depot_list_projects when the projectId is unknown. No alternative tool is named for exclusion, but the provided scenarios make selection unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_projectsList Depot container build projectsA
Read-onlyIdempotent

List Depot container build projects with their region, runner hardware, and cache policy.

Use this to find a projectId for depot_list_builds, depot_diagnose_build, or depot_list_images, and to check configuration that affects build speed: which region a project builds in, how large its runners are, and how much layer cache it retains before eviction.

These are container build projects. Depot CI runs are organised by repository and workflow instead — use depot_list_ci_runs for those.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum projects to return.
regionIdNoFilter to one region, for example "us-east-1" or "eu-central-1".
pageTokenNoContinue a previous listing: pass the nextPageToken from the last call.

Output Schema

ParametersJSON Schema
NameRequiredDescription
projectsYes
returnedYes
nextPageTokenNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description does not need to repeat safety traits. It adds useful context beyond annotations by specifying what fields are returned and by clarifying the tool's scope relative to Depot CI runs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and payload, then provides concrete use cases and an explicit sibling distinction. Every sentence earns its place and there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of this read-only list tool, the presence of an output schema, and strong annotations, the description is complete. It tells the agent what to use the tool for, what it returns, and when to choose a different tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents all three parameters with 100% coverage, including defaults and examples. The description adds no parameter-specific detail, but the baseline of 3 is appropriate because the schema carries the full semantic burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List'), a specific resource ('Depot container build projects'), and key returned data ('region, runner hardware, cache policy'). It clearly distinguishes itself from CI-run tools by explicitly saying these are container build projects, not CI runs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use this tool: to find a projectId for list/diagnose operations and to check build-speed-related configuration. It also explicitly tells the agent to use depot_list_ci_runs for CI runs instead, providing a clear alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_project_tokensList Depot project tokensA
Read-onlyIdempotent

List the project tokens that exist for one Depot container build project: token id, description, and timestamps when Depot provides them. Never the token secret, which Depot only reveals once, at creation, and this server never creates one.

Use this for credential inventory and access reviews: "which tokens exist for this project", "is there a token nobody remembers creating". Pair it with depot_audit_trust_policies for the OIDC side of the same question.

Read-only: creating, rotating, or revoking a token is not offered by this server. Organization token only.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectIdYesThe project whose tokens to list, from depot_list_projects.

Output Schema

ParametersJSON Schema
NameRequiredDescription
notesYes
tokensYes
returnedYes
projectIdYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint, idempotentHint, destructiveHint), the description discloses security-relevant behavior: the token secret is never returned, the server never creates tokens, and creating/rotating/revoking is not offered. It also notes 'Organization token only,' adding an auth/scope constraint not present in annotations or schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well front-loaded, with the main purpose in the first sentence and caveats/use cases following. It is slightly longer than strictly necessary due to some overlap between 'this server never creates one' and the later 'creating, rotating, or revoking a token is not offered,' but no sentence is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter read-only list tool with an output schema and clear annotations, the description covers the key context: what is listed, what is never exposed, why to use it, how it relates to a sibling, and the auth scope. There is no significant gap an agent would need to fill before calling it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, projectId, is already documented in the schema with a description and a source hint ('from depot_list_projects'). The tool description reinforces that the parameter identifies one Depot container build project, providing context beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description names the exact verb ('List'), resource ('project tokens'), and scope ('for one Depot container build project'), and states what is returned (id, description, timestamps). It also explicitly excludes the token secret, making the purpose precise and distinct from any token-management or secret-list sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit use cases ('credential inventory and access reviews') and example questions, and names the complementary sibling depot_audit_trust_policies for the OIDC side. It does not explicitly enumerate when to use one of the other list tools instead, but it clearly marks read-only scope and the absence of create/rotate/revoke operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_list_project_usageList Depot usage per projectA
Read-onlyIdempotent

List every Depot container build project's build count, total build time, and layer cache size for a period, in one call.

Use this for "which project holds the most cache", "which projects are actually building", and "where is our storage going". Rows are sorted by layer cache size, largest first, and carry the project name when depot_list_projects can supply it. For minutes billed and minutes saved by caching use depot_get_usage; for one project's cache health use depot_get_cache_summary.

Organization token only. Defaults to the last 30 days; Depot pages long lists, so re-call with pageToken when nextPageToken is set.

ParametersJSON Schema
NameRequiredDescriptionDefault
daysNoLook back this many days from now. Ignored when startAt and endAt are both given.
endAtNoEnd of the window, RFC 3339 or YYYY-MM-DD. Dates are UTC. A date-only value is inclusive: "2024-01-31" covers all of 31 January. Requires startAt.
startAtNoStart of the window, RFC 3339 or YYYY-MM-DD. Dates are UTC; a date-only value means midnight at the start of that day. Requires endAt.
pageTokenNoContinue a previous listing: pass the nextPageToken from the last call.

Output Schema

ParametersJSON Schema
NameRequiredDescription
notesYes
totalsYes
projectsYes
returnedYes
periodEndYes
periodStartYes
nextPageTokenNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnly, idempotent, and non-destructive behavior, and the description adds no contradictions. It further explains behavioral details such as sorting by layer cache size, default time window of 30 days, and the dependency between startAt and endAt, making the tool's runtime behavior fully transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured across three sentences. It avoids redundancy for the most part, though the repeated pattern 'use for ... for ... use' is slightly verbose but still efficient. Overall, every sentence adds value without unnecessary filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, usage scenarios, distinguishing features from siblings, and important behavioral nuances such as sorting, defaults, and pagination. Since an output schema is provided, the lack of return value details is acceptable, making the description contextually complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers all four parameters with 100% coverage, so the baseline is 3. The description adds useful context about defaults (30 days) and pagination (re-call with pageToken), which enriches parameter understanding beyond the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (List), the resource (Depot usage per project), and the scope (build count, build time, layer cache size) in one call. It also distinguishes this tool from sibling tools by focusing on per-project usage, which makes its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use this tool (for questions like which project holds the most cache) and contrasts it with sibling tools (depot_get_usage for minutes billed/saved, depot_get_cache_summary for one project's cache health). It also provides pagination guidance with nextPageToken, giving clear actionable instructions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_wait_for_ci_runWait for a Depot CI run or workflow to finishA
Read-onlyIdempotent

Wait, for a bounded time, until a Depot CI run, one workflow in it, or one job reaches a terminal state, then report the outcome and which nodes changed state while waiting.

Use this after a push or a rerun when the next step depends on the result: "wait for the run to finish, then diagnose it if it failed". Pass runId to watch a whole run. Pass workflowId to watch one workflow: this is what to do after depot_rerun_ci_workflow or depot_retry_ci_failed_jobs, which start a new execution of the same workflow rather than a new run; the wait ends when the latest execution is terminal. With both ids the workflow is watched and must belong to that run. Pass untilJobKey to return as soon as one job is done instead of the whole target, for example the test job when the deploy job behind it does not matter yet.

This is bounded polling, not a stream. It calls GetRunStatus (or GetWorkflow) every pollSeconds until the target is finished, failed, or cancelled, or until timeoutSeconds is spent, whichever comes first, then returns. It never subscribes to Depot's log or status streams. If the result says timedOut=true the target is still going: call this tool again with the same id to keep waiting; the changes list shows what moved in the meantime. Keep timeoutSeconds below your MCP client's own tool-call timeout, or the client will give up before this tool does.

A run or workflow that is already finished returns immediately after one poll, so this is also a cheap way to check "is it done yet". For the structure use depot_get_ci_run or depot_get_ci_workflow; for why it failed use depot_diagnose_ci_failure.

ParametersJSON Schema
NameRequiredDescriptionDefault
runIdNoThe run id to wait on, as returned by depot_list_ci_runs. Required unless workflowId is given; with workflowId it is only cross-checked.
workflowIdNoWait for this workflow instead of a whole run, as shown by depot_get_ci_run (workflowId=...) or returned by depot_rerun_ci_workflow. The wait ends when its latest execution is terminal.
pollSecondsNoSeconds between status requests, 2 to 30. Each poll is one request to Depot; lower values give faster answers at the cost of more requests.
untilJobKeyNoReturn as soon as this job reaches a terminal state, even if the run or workflow is still going. Accepts the job key, display name, or job id as shown by depot_get_ci_run.
timeoutSecondsNoLongest this call may wait, 5 to 300 seconds. On expiry the tool returns timedOut=true rather than an error; call again to keep waiting.

Output Schema

ParametersJSON Schema
NameRequiredDescription
jobNoThe job named by untilJobKey, when it was found.
notesYes
pollsYes
runIdNo
failedYesTrue when the target ended in failed or cancelled.
statusNoStatus of the watched run, or of the latest execution of the watched workflow, at the last poll.
changesYesNodes whose state differs between the first and last poll.
outcomeYesWhy the wait ended: the run finished, the workflow (its latest execution) finished, the named job finished, or the timeout expired.
jobCountYes
timedOutYes
executionNoWhen watching a workflow: which execution the wait followed.
workflowIdNoPresent when a workflow was watched.
pollSecondsYes
initialStatusNoThe same status at the first poll.
elapsedSecondsYes
failedJobCountYes
timeoutSecondsYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description reveals key behavioral traits beyond annotations: it is bounded polling, not a stream; it calls GetRunStatus/GetWorkflow each poll; it returns timedOut=true rather than erroring; it can be re-invoked to keep waiting; and it returns immediately for already-finished targets. This matches the readOnlyHint and idempotentHint annotations without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but densely informative; each paragraph covers a distinct aspect: use case, polling mechanics and timeout behavior, and sibling-tool routing. It front-loads the purpose and keeps practical caveats like MCP client timeout near the relevant mechanics.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex polling tool with optional-looking parameters, the description fully explains the id constraints, poll/timeout ranges, terminal states, repeated-call behavior, and cheap 'is it done yet' usage. With an output schema present and all parameter semantics covered, nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and each parameter already has a rich schema description, but the tool description adds crucial cross-parameter semantics: runId is required unless workflowId is given, workflowId waits for the latest execution, and untilJobKey accepts job key, display name, or id. This goes well beyond the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('wait'), resource ('Depot CI run, workflow, or job'), and outcome ('report outcome and changed nodes'). It also distinguishes itself from sibling tools by naming depot_get_ci_run, depot_diagnose_ci_failure, depot_rerun_ci_workflow, and depot_retry_ci_failed_jobs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance ('after a push or a rerun when the next step depends on the result') and clear alternatives ('For structure use depot_get_ci_run... for why it failed use depot_diagnose_ci_failure'). It also explains when to pass workflowId vs runId and when untilJobKey is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

depot_whoamiCheck the Depot token and its visible scopeA
Read-onlyIdempotent

Verify the configured Depot token and report which organizations and projects it can actually see.

Call this first whenever another Depot tool returns an empty list or a permission error. Depot's most common confusing failure is a token that spans several organizations with none selected: requests then resolve against the wrong organization and return empty results rather than an error. This tool says plainly whether that is happening and what to set.

Also reports whether write tools are enabled (DEPOT_MCP_ALLOW_WRITES) and which mutating tools are registered, whether the destructive gate is open (DEPOT_MCP_ALLOW_DESTRUCTIVE, which adds depot_delete_project only when writes are on too), and whether the beta sandbox and registry tools are registered (DEPOT_MCP_ENABLE_BETA). With the write flag unset no mutating tool exists, and nothing here can retry, cancel, rerun, or delete anything.

Never returns the token or any part of it.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
apiUrlYes
failuresYes
projectsYes
warningsYes
betaToolsYes
tokenKindYes
activeOrgIdNo
betaEnabledYes
tokenSourceYes
orgSelectionYes
projectCountNo
mutatingToolsYes
organizationsYes
writesEnabledYes
destructiveToolsYes
destructiveEnabledYes
mutatingToolsAvailableYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond the readOnlyHint and idempotentHint annotations by explicitly stating it never returns the token or any part of it, and details the conditions under which write, destructive, beta, and registry tools are registered. This provides strong behavioral transparency with no contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the primary purpose and then expands into relevant behavioral details. While somewhat lengthy, each sentence adds meaningful context about capabilities, limitations, and environment flags, so the structure is reasonably tight and purposeful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters and an output schema, the description fully explains what the tool checks, what it reports, and what it will never return. It also covers environmental dependencies and relationships to sibling tools, making it complete for an agent to know when and how to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the input schema is empty, so there are no parameter semantics to explain. The description still adds useful context about what the tool inspects and reports, making the parameter dimension non-issue and slightly above the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool verifies the configured Depot token and reports which organizations and projects it can see, using specific verbs like 'verify' and 'report.' This distinguishes it from sibling tools that focus on CI runs, builds, images, or usage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly instructs to call this tool first when another Depot tool returns an empty list or permission error, and explains the common token scoping failure. It also provides guidance about when mutating tools are absent and what the tool cannot do, giving clear actionable direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 17 tool updatesv0.2.1
    • Addeddepot_audit_trust_policies
    • Addeddepot_compare_ci_runs
    • Changeddepot_diagnose_build2 fields changed
      • addedOutput schema / properties / logsUnavailable
        Added value: +{
        +  "type": "boolean"
        +}
      • addedOutput schema / properties / stepsUnavailable
        Added value: +{
        +  "type": "boolean"
        +}
    • Addeddepot_get_build
    • Addeddepot_get_cache_summary
    • Addeddepot_get_ci_artifact_url
    • Addeddepot_get_ci_attempt
    • Addeddepot_get_ci_job
    • Changeddepot_get_ci_logs1 field changed
      • addedOutput schema / properties / lines / items / properties / stepName
        Added value: +{
        +  "type": "string"
        +}
    • Addeddepot_get_ci_workflow
    • Changeddepot_list_ci_secrets2 fields changed
      • addedOutput schema / properties / secrets / items / properties / id
        Added value: +{
        +  "type": "string"
        +}
      • addedOutput schema / properties / secrets / items / properties / variants / items / properties / id
        Added value: +{
        +  "type": "string"
        +}
    • Changeddepot_list_ci_variables2 fields changed
      • addedOutput schema / properties / variables / items / properties / id
        Added value: +{
        +  "type": "string"
        +}
      • addedOutput schema / properties / variables / items / properties / variants / items / properties / id
        Added value: +{
        +  "type": "string"
        +}
    • Addeddepot_list_ci_workflows
    • Addeddepot_list_project_tokens
    • Addeddepot_list_project_usage
    • Addeddepot_wait_for_ci_run
    • Changeddepot_whoami8 fields changed
      • addedOutput schema / properties / betaEnabled
        Added value: +{
        +  "type": "boolean"
        +}
      • addedOutput schema / properties / betaTools
        Added value: +{
        +  "items": {
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • addedOutput schema / properties / destructiveEnabled
        Added value: +{
        +  "type": "boolean"
        +}
      • addedOutput schema / properties / destructiveTools
        Added value: +{
        +  "items": {
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • addedOutput schema / properties / mutatingTools
        Added value: +{
        +  "items": {
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • removedOutput schema / properties / mutatingToolsAvailable / const
        Removed value: -0
      • addedOutput schema / properties / tokenKind
        Added value: +{
        +  "enum": [
        +    "organization",
        +    "user",
        +    "unknown"
        +  ],
        +  "type": "string"
        +}
      • changedOutput schema / required
        Previous value: -[
        -  "apiUrl",
        -  "tokenSource",
        -  "organizations",
        -  "orgSelection",
        -  "projects",
        -  "writesEnabled",
        -  "mutatingToolsAvailable",
        -  "warnings",
        -  "failures"
        -]New value: +[
        +  "apiUrl",
        +  "tokenSource",
        +  "tokenKind",
        +  "organizations",
        +  "orgSelection",
        +  "projects",
        +  "writesEnabled",
        +  "destructiveEnabled",
        +  "betaEnabled",
        +  "betaTools",
        +  "mutatingToolsAvailable",
        +  "mutatingTools",
        +  "destructiveTools",
        +  "warnings",
        +  "failures"
        +]
  2. 16 tool updatesv0.1.0
    • First observeddepot_diagnose_build
    • First observeddepot_diagnose_ci_failure
    • First observeddepot_get_ci_job_summary
    • First observeddepot_get_ci_logs
    • First observeddepot_get_ci_metrics
    • First observeddepot_get_ci_run
    • First observeddepot_get_project
    • First observeddepot_get_usage
    • First observeddepot_list_builds
    • First observeddepot_list_ci_artifacts
    • First observeddepot_list_ci_runs
    • First observeddepot_list_ci_secrets
    • First observeddepot_list_ci_variables
    • First observeddepot_list_images
    • First observeddepot_list_projects
    • First observeddepot_whoami

TDQS

A4.3/5.0

Scored across 28 tools

Disambiguation5/5

Each tool maps to a distinct resource/action; the CI hierarchy (run, workflow, job, attempt) is cleanly separated across get/list/diagnose tools, and risky pairs like builds vs CI runs or diagnose vs logs are explicitly cross-referenced. No two tools appear to serve the same purpose.

Naming Consistency4/5

The set follows a consistent depot_<verb>_<object> snake_case convention, with list/get/diagnose verbs and clear resource nouns. Minor deviations like depot_whoami and depot_wait_for_ci_run break the pure verb_noun pattern but remain predictable.

Tool Count2/5

With 28 tools this crosses the 'too many' threshold and creates a heavy selection surface for an agent, even though the Depot API scope is broad. Splitting this into CI, build/registry, and admin/usage servers would make the surface easier to navigate.

Completeness4/5

The read-only observability domain is covered very well: diagnosis, comparison, waiting, logs, metrics, artifacts, job summaries, build diagnostics, cache, usage, tokens, trust policies, and secret/variable scoping are all present. The main gap is the lack of mutating tools (rerun, retry, cancel, delete), which descriptions reference but do not expose; this is a deliberate read-only design rather than a fatal omission.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Read-only MCP tools for coding agents to audit deployment targets, detect fabricated code, review backlog, database schema, analytics, ML models, architecture docs, and decision lenses.
    11
    7 npm
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    A secure, local-first MCP server for read-only inspection and troubleshooting of development environments, exposing narrow, typed, auditable capabilities for repository inspection, log summarization, Docker review, and security scanning without granting unrestricted machine access.
    MIT
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to investigate production incidents by exposing service health, logs, and deployment data through MCP tools.
    5 npm
    -