ARM MCP Server

Model Context Protocol (MCP) server for AutoRABIT ARM Developer APIs. It provides 29 dedicated tools for CI Jobs, nCino CI Jobs, deployment reporting, version control branch and pull request automation, and SIEM audit logs, plus resources and guided prompts for common workflows.

Requirements

• Node.js 22 or newer

• An AutoRABIT ARM API token

• A separate audit API token only when using SIEM audit tools

Related MCP server: arx-mcp-server

Quick Start

git clone https://github.com/AutoRABIT-AI/ARM-MCP-Server.git
cd ARM-MCP-Server
npm ci
npm run build

Set the required environment variables:

export ARM_BASE_URL="https://pilot.autorabit.com"
export ARM_API_TOKEN="YOUR_ARM_API_TOKEN"

Run the stdio server:

npm start

After the package is published to npm, it can also be run with:

npx -y @autorabit-ai/arm-mcp-server

Quick Start Cookbooks

Connect the server to Codex or Claude Code, then run copy-paste-ready workflows for PR readiness, daily deployment reporting, CI failure triage, nCino build health, audit review, and controlled build/deploy actions:

• ARM MCP Quick Start Cookbooks

MCP Client Configuration

Use the built server from a source checkout:

{
  "mcpServers": {
    "autorabit-arm": {
      "command": "node",
      "args": ["/absolute/path/to/ARM-MCP-Server/dist/index.js"],
      "env": {
        "ARM_BASE_URL": "https://pilot.autorabit.com",
        "ARM_API_TOKEN": "YOUR_ARM_API_TOKEN"
      }
    }
  }
}

For npm-based execution, use npx as the command and ["-y", "@autorabit-ai/arm-mcp-server"] as the arguments.

Configuration

Credentials are read from the process environment and are never accepted as tool arguments. Custom request headers cannot override token, authorization, host, or content-length.

Tools

CI Jobs v1

CI read tools send path and query parameters without GET request bodies. Mutation tools do not retry automatically.

nCino CI Jobs v1

Trigger and monitor an nCino build:

{
  "name": "arm_ncino_trigger_build",
  "arguments": {
    "jobName": "nCino Feature Migration",
    "title": "Release 26.3",
    "deploy": true,
    "commitFeature": false,
    "note": "Triggered from MCP",
    "rollbackEnabled": true,
    "deployedSFOrg": "Production",
    "projectType": "SalesForceFeature"
  }
}

{
  "name": "arm_ncino_poll_build_status",
  "arguments": {
    "jobName": "nCino Feature Migration",
    "buildNumber": 42
  }
}

Version Control Branch and Pull Request

arm_create_branch_pr_from_manifest starts an asynchronous request and returns a requestId. ARM creates a branch from baseBranch, retrieves the metadata listed in packageManifest from the target org, commits it to the new branch, updates the Jira story when jiraKey is sent, and creates a pull request. Poll arm_get_branch_pr_status for per-step progress, the branch, the commit, the Jira update, the pull request URL, and any error with partial results. If a step fails after ARM created the branch, ARM deletes that branch and reports it in the status response. To commit onto a branch that already exists in the repository, set useExistingBranch to true and send its branchName: the branch need not be registered in ARM (ARM registers it if needed), and it is never deleted, even on failure. Existing-branch commits and new-branch commits both appear in ARM Commit History. For DX (source format) repositories, send sfdxFolderName to choose the package directory when the repository has more than one. The create tool does not retry automatically.

{
  "name": "arm_create_branch_pr_from_manifest",
  "arguments": {
    "packageManifest": "<?xml version=\"1.0\" encoding=\"UTF-8\"?><Package xmlns=\"http://soap.sforce.com/2006/04/metadata\"><types><members>*</members><name>ApexClass</name></types><version>66.0</version></Package>",
    "orgName": "Dev Sandbox",
    "repoName": "salesforce-repo",
    "baseBranch": "main",
    "jiraKey": "AR-12345"
  }
}

Deployment Reporting v1

{
  "name": "arm_list_deployments",
  "arguments": {
    "status": "Successful",
    "fromDate": "2026-07-01",
    "toDate": "2026-07-31",
    "destSfOrg": "production@example.com",
    "limit": 25
  }
}

SIEM Audit Logs

Audit downloads enforce a configurable byte limit, write files with owner-only permissions, and return an MCP resource_link to the local ZIP. Download ranges cannot exceed 90 days.

Optional Generic Tool

arm_call_api supports additional same-origin /api/ endpoints. It is hidden and blocked by default because it expands the server's action surface. Set ARM_ENABLE_GENERIC_TOOL=true only when the MCP client needs unmodeled endpoints.

Resources

• arm://docs/overview

• arm://docs/cijobs-v1

• arm://docs/ncino-cijobs-v1

• arm://docs/deployments-v1

• arm://docs/auth

• arm://docs/audit-logs

Prompts

• arm_quick_deploy_guide

• arm_rollback_guide

• arm_trigger_build_guide

• arm_poll_status_guide

• arm_deployment_report_guide

• arm_ncino_build_and_monitor_guide

• arm_ncino_build_report_guide

• arm_audit_logs_guide

Docker

docker build -t arm-mcp-server .
docker run -i --rm \
  -e ARM_BASE_URL \
  -e ARM_API_TOKEN \
  arm-mcp-server

For Docker Compose:

cp .env.example .env
docker compose run --rm arm-mcp-server

Development

npm ci
npm run typecheck
npm test
npm audit
npm pack --dry-run

Contract tests launch the compiled MCP server over stdio and verify tool discovery, resources, prompts, authentication headers, HTTP methods, paths, payloads, error signaling, and security controls against a local mock server.

See CONTRIBUTING.md for contribution requirements, SECURITY.md for private vulnerability reporting, and SUPPORT.md for support channels.

API Sources

• AutoRABIT ARM Developer API references

• AutoRABIT CI Jobs Postman documentation

• AutoRABIT nCino API references

• AutoRABIT nCino Postman documentation

• AutoRABIT Deployment Postman documentation

License

MIT