Jenkins MCP Server v2.10.7

Released 2026-09-07.

Highlights

• Refresh the MCP, Pydantic, Ruff, and Python build dependency set while preserving Jenkins, transport, Helm, Kubernetes, and Minibridge behavior.

New Features

• None.

Improvements

• Upgrade MCP to 2.1.1, Pydantic to 2.13.5, Ruff to 0.16.6, and build to 1.6.0.
• Use MCP v2's public mcp.server.MCPServer import instead of its implementation-module path.
• Classify anticipated Jenkins, policy, and semantic-validation failures as MCP 2.1 ToolErrors so agents receive actionable is_error results instead of expected denials being treated as server crashes.
• Translate Pipeline and multibranch template validation at the MCP boundary as the same anticipated input-error class, while preserving ValueError behavior for direct template-library callers.
• Regenerate the hash-checked runtime dependency lock with matching mcp-types 2.1.1 and pydantic-core 2.46.5 releases.

Bug Fixes

• Keep the offline Docker wheel set resolver-consistent with package metadata so image builds do not retain MCP 2.0.0 after the minimum runtime requirement moves to MCP 2.1.1.
• Restore actionable MCP errors for policy, request-limit, validation, and Jenkins operational failures after MCP 2.1 stopped exposing unexpected exception text.
• Keep invalid repository URLs, script paths, and XML 1.0 template inputs actionable under MCP 2.1 instead of reporting them as generic tool crashes.

Breaking Changes

• None.

Known Issues

• None.

Security

• Preserve hash-checked container installs and the existing dependency-review, CodeQL, and pip-audit guardrails for the refreshed dependency set.
• Keep Jenkins response bodies and transport exception strings out of client-visible MCP errors; agents receive sanitized status/hints while audit records retain bounded operational evidence.

Upgrade Notes

• No Jenkins, MCP transport, Minibridge, Kubernetes, Helm, credential, ingress, or policy configuration change is required.

Jenkins MCP Server v2.10.6

Released 2026-08-25.

Highlights

• Refresh the compatible Python runtime and development dependency set while preserving Jenkins, MCP, Helm, Kubernetes, and Minibridge behavior.

New Features

• None.

Improvements

• Upgrade Uvicorn to 0.52.4, Ruff to 0.16.4, and mypy to 2.3.1.
• Refresh MCP HTTP transitive dependencies to httpx2/httpcore2 2.12.0 and idna 3.19 using the repository's reproducible lock workflow.

Bug Fixes

• Regenerate the runtime lock as one resolver-consistent set so Pydantic 2.13.4 retains its required pydantic-core 2.46.4 instead of the incompatible independently bumped 2.48.0 pin.

Breaking Changes

• None.

Known Issues

• None.

Security

• Keep dependency-review, CodeQL, hash-checked container installs, and pip-audit validation enabled for the refreshed dependency set.

Upgrade Notes

• No Jenkins, MCP, Minibridge, Kubernetes, Helm, credential, ingress, or policy configuration change is required.

Jenkins MCP Server v2.10.5

Released 2026-08-16.

Highlights

• Release containers now install a hash-checked, reviewed Python dependency set
  while the published Python package keeps its compatible dependency ranges.

New Features

• Add hash-locked runtime and build dependency manifests for the default and
  Minibridge container images.
• Validate the project on Python 3.14 in CI.

Improvements

• Pin Hatchling 1.32.0 as the build backend and use modern SPDX package license
  metadata.
• Isolate the lock generator in a temporary environment with pip 26.1.2 and
  pip-tools 7.6.1 so verification does not mutate the caller's environment.
• Build application wheels without isolated build dependency resolution after
  installing the hash-checked build dependency set.
• Download only binary runtime and build wheels from hash-checked manifests
  before assembling release images.
• Audit the exact locked runtime dependency set used by release containers and
  reject stale locks in both pull-request CI and release validation.
• Validate both release architectures for the default and Minibridge images in
  pull-request CI before publication.

Bug Fixes

• Add positive regression coverage proving documented uppercase settings aliases
  still work with pydantic-settings 2.15.0.

Breaking Changes

• None.

Known Issues

• The release-container dependency set is resolved for the Python 3.12 Linux
  environment used by published containers; Python package consumers continue to
  use the compatible ranges declared in pyproject.toml.
• Debian packages installed during the image build are still resolved from the
  pinned base image's configured package repositories, so this change does not
  claim byte-for-byte image reproducibility.

Security

• Stop resolving floating Python runtime and build dependency versions while
  rebuilding an unchanged release container.
• Pin the CI OPA policy binary to v1.17.0 and verify its published SHA-256 digest
  instead of downloading the mutable releases/latest asset.
• Pin the Python and Go container base tags to their current multi-architecture
  manifest digests while retaining tags for Dependabot visibility.

Upgrade Notes

• No Jenkins, MCP, Minibridge, Kubernetes, Helm, credential, ingress, or policy
  configuration change is required.

Jenkins MCP Server v2.10.4

Released 2026-08-16.

Highlights

• The Python runtime and build toolchain are refreshed to current compatible
  releases while preserving the existing Jenkins MCP configuration and tool
  contracts.

New Features

• None.

Improvements

• Upgrade pydantic-settings to 2.15.0, uvicorn to 0.52.3, ruff to 0.16.3,
  and Hatchling to 1.32.0.
• Uvicorn 0.52.3 includes an updated HTTP/1.1 parser path intended to improve
  request parsing performance.
• pydantic-settings 2.15.0 now applies case_sensitive consistently to init
  kwargs and config-file sources as well as environment settings.

Bug Fixes

• None in Jenkins MCP Server source code.

Breaking Changes

• None.

Known Issues

• None known.

Security

• The server's explicit case_sensitive=True settings policy remains enforced,
  so mixed/lowercase duplicates cannot override documented uppercase settings;
  regression coverage now includes programmatic initialization under the new
  pydantic-settings behavior.
• pydantic-settings 2.15.0 also prevents nested secret-directory sources from
  following symlinks outside their configured secrets directory. Jenkins MCP
  Server does not currently use that source directly, but ships the hardened
  dependency version.

Upgrade Notes

• No configuration or migration action is required. Upgrade the application and
  Helm chart together as usual.

Jenkins MCP Server v2.10.3

Released 2026-08-15.

Highlights

• Job identities derived from Jenkins URLs now preserve a folder or job that is
  itself literally named job.

New Features

• None.

Improvements

• URL-derived identities must use Jenkins' canonical repeated
  /job/<name>/job/<name> route. Non-canonical interleaving fails closed.

Bug Fixes

• The URL parser previously treated every path segment named job as a route
  marker. A legitimate nested job job/nightly, whose route is
  /job/job/job/nightly/, was therefore misread as job/job/nightly and could
  be hidden or refused by MCP_ALLOWED_JOBS when fullName was unavailable.

Breaking Changes

• None.

Known Issues

• None.

Security

• Malformed paths such as /job/AI/api/json/job/nightly can no longer be
  collapsed into the apparently valid allowlist identity AI/nightly.

Upgrade Notes

• No action required.

Jenkins MCP Server v2.10.2

Released 2026-08-14.

Highlights

• Queue reads and cancellation no longer authorize an ambiguous leaf-only task
  name as though it were a complete Jenkins job path.

New Features

• None.

Improvements

• None.

Bug Fixes

• Queue authorization fell back to task.name when Jenkins omitted both
  task.fullName and a usable task URL. Because name contains only the leaf,
  a nested job such as Production/nightly could be mistaken for the allowed
  top-level job nightly. Ambiguous items now fail closed.

Breaking Changes

• None.

Known Issues

• None.

Security

• Queue listing, item reads, and cancellation now require a folder-qualified
  identity from task.fullName or the repeated /job/<segment> URL path.
  task.name alone is never sufficient for an allowlist decision.
• Jenkins task URLs remain path-only identity metadata and are never fetched.
  Their advertised public origin may legitimately differ from the internal
  Service URL configured by this server.

Upgrade Notes

• No action required.

Jenkins MCP Server v2.10.1

Released 2026-08-14.

Highlights

• Normal Minibridge session cleanup no longer produces false backend WebSocket
  errors on otherwise healthy replicas.

New Features

• None.

Improvements

• The Minibridge image now builds the exact checksum-pinned 0.8.0 source commit
  with a narrow reviewed backport, and runs the affected upstream backend unit
  tests before producing the multi-architecture binary.
• The k3s smoke opens and closes an MCP session directly on each of two replicas,
  waits through Minibridge's idle-session deadline, and rejects the former false
  error in either pod's logs.

Bug Fixes

• Minibridge's WebSocket dependency can report net.ErrClosed when Minibridge
  intentionally closes an idle internal session. The bundled backend treated
  that local shutdown as an unexpected transport failure and emitted
  Backend websocket has closed at error level. The backport now classifies
  net.ErrClosed, including wrapped forms, as normal cleanup while preserving
  error reporting for resets and other genuine transport failures.

Breaking Changes

• None.

Known Issues

• None known.

Security

• None. The backport changes close-error classification only; policy, TLS,
  credentials, and network exposure are unchanged.

Upgrade Notes

• No configuration change is required. Upgrade both direct and -minibridge
  image/chart pins together as usual. The fix affects only the Minibridge image.

Jenkins MCP Server v2.10.0

Released 2026-08-13.

Highlights

• Build triggers now return a verified queue ID, and the new get_queue_item
  tool follows that item until Jenkins assigns the real build number.
• Operators can extend build-parameter redaction with local name globs, while
  Minibridge now removes complete PEM private-key blocks rather than only their
  algorithm label.
• High-level multibranch creation, node transitions, queue responses, audit
  files, and administrator response headers fail closed at previously
  unverified production boundaries.

New Features

• Added the read-only get_queue_item(item_id) tool. It returns projected queue
  state and, after executor assignment, executable.number and URL, while
  enforcing MCP_ALLOWED_JOBS against the owning job.
• Added MCP_REDACT_PARAMETER_PATTERNS and Helm
  mcp.redactParameterPatterns for case-insensitive local parameter-name globs
  such as *_AUTH or SIGNING_*. Built-in secret detection remains active.
• trigger_build now includes a numeric queue_id alongside a canonical
  queue_url rebuilt from configured JENKINS_URL, giving clients a complete
  trigger-to-build workflow without trusting an advertised foreign origin.

Improvements

• Queue-item authorization and cancellation use a narrow Jenkins tree query,
  avoiding download of action/parameter/plugin payloads that are not needed.
• Queue, build-parameter, node, and running-build responses now share strict
  JSON-scalar projection, including rejection of non-finite numbers that cannot
  be emitted as standards-compliant JSON.
• set_node_offline reports whether it changed state and verifies the requested
  state with a follow-up read before returning success.
• The all-tools Jenkins-through-Minibridge smoke now exercises queue-ID
  tracking, the 24-tool surface, and unsafe repository-scheme rejection.
• Runtime settings, Helm schema/wiring, the hardened values example, raw
  Kubernetes configuration, security guidance, compatibility reference, and
  troubleshooting are synchronized with the new behavior.

Bug Fixes

• create_multibranch_pipeline accepted file:, Git external-helper, and
  arbitrary unknown repository schemes, allowing its safe helper to persist or
  invoke remotes outside its documented network Git contract. It now accepts
  only HTTP(S), SSH, git, git+ssh, and canonical SCP-style SSH remotes.
• Minibridge's PEM pattern captured only RSA/OPENSSH from a private-key
  header, so response rewriting replaced the algorithm while leaving the key
  body visible. The complete PEM block is now the redaction unit.
• A successful build-trigger HTTP status with no Location, a query/fragment,
  unsupported scheme, invalid queue ID, or non-queue route returned queued: true with no trustworthy item to follow. The queue route is now validated and
  any advertised public origin/prefix is replaced with configured
  JENKINS_URL, preserving internal-Service/public-root deployments safely.
• Queue/task/executable, node, and running-build selected fields could still
  carry arbitrary nested plugin values despite their documented scalar
  contracts; projections now omit those values and malformed containers fail.
• set_node_offline used Jenkins' toggle endpoint and immediately echoed the
  requested state, so a concurrent change, disappearing cloud agent, or plugin
  no-op could be reported as success. A post-write state mismatch now fails.
• Existing audit and rotation-lock files retained permissive pre-existing mode
  bits because O_CREAT applies 0600 only to new files. POSIX descriptors are
  now repaired to owner read/write on every open.
• Audit metadata containing NaN or infinity produced non-standard JSONL. Those
  values now receive an explicit omission marker.
• jenkins_admin_request withheld a fixed list of session/CSRF headers but
  forwarded plugin-defined token, credential, secret, or session headers. It
  now applies sensitive-name detection to arbitrary response-header names.
• Queue cancellation fetched depth-one queue objects—including actions and
  parameter values—only to resolve the owning job. It now requests the same
  minimal projected identity used by get_queue_item.

Breaking Changes

• None. Existing tool names and documented fields remain available. Unsafe or
  untrackable repository/queue responses, non-standard numeric values, and
  undocumented sensitive header/plugin passthrough are intentionally refused
  or removed.

Known Issues

• Jenkins parameter values are visible to the MCP transport before application
  projection runs. Keep real secrets in Jenkins password/credential types and
  use mcp.redactParameterPatterns as defence in depth for local string-name
  conventions.
• The plain git:// transport remains supported for compatibility but is not
  encrypted; prefer HTTPS or SSH for production repositories.

Security

• Closed local-file/external-helper repository schemes in the high-level
  multibranch helper, complete-PEM redaction in Minibridge, custom sensitive
  administrator headers, and permissive pre-existing audit-file modes.
• Queue/node/running-build responses and queue authorization no longer process
  or return undocumented nested plugin payloads.
• Operator-defined parameter redaction closes the documented gap where an
  ordinary string parameter stores a secret under a locally innocuous name.

Upgrade Notes

• No mandatory configuration change. Reconnect MCP clients after rollout to
  discover get_queue_item and the enriched trigger_build result.
• Add local secret-name globs under mcp.redactParameterPatterns where ordinary
  Jenkins string parameters carry sensitive values.
• Existing POSIX audit and rotation-lock files are normalized to mode 0600 on
  open. Forward the JSON log stream or run file readers under the server UID
  instead of relying on group/world-readable audit files.
• A reverse proxy may advertise a different public origin or prefix in a build
  trigger Location; the server now extracts only its canonical
  /queue/item/<id>/ suffix and rebuilds the returned URL from JENKINS_URL.

Jenkins MCP Server v2.9.9

Released 2026-08-13.

Highlights

• Job discovery, job details, and build details now expose only their documented
  response contracts instead of forwarding arbitrary Jenkins/plugin objects.
• Build parameter values identified as passwords, tokens, secrets, or
  credentials are redacted before they cross the MCP boundary.

New Features

• None.

Improvements

• get_job and get_build_info now use narrow Jenkins tree queries, reducing
  controller serialization work and MCP response size.
• Shared projection helpers keep scalar fields, nested build references, health
  reports, and parameter handling consistent across the structured read tools.
• Tool descriptions, the compatibility contract, security guidance,
  troubleshooting, and the Jenkins-through-Minibridge smoke now describe and
  verify the projected response boundary.

Bug Fixes

• list_jobs preserved unexpected top-level response fields even though its
  public contract contains only the filtered jobs collection.
• Individual list_jobs entries were returned verbatim, allowing action/plugin
  objects not requested by the documented contract to cross the boundary.
• Folder listings that had only a child name were policy-checked against a
  reconstructed path but returned no fullName; the response now includes the
  same canonical path that was authorized.
• get_job returned depth-two action/property objects and upstream/downstream
  job references, which could disclose metadata outside the allowed job's
  documented state and build-reference contract.
• get_build_info returned unrelated action, cause, artifact, change-set, and
  plugin payloads rather than its documented result/timing/parameter contract.
• Password/token/credential parameter classes and secret-like parameter names
  could return their values; those values are now replaced with [redacted],
  while non-scalar plugin values receive an explicit unsupported marker.
• Malformed nested job/build response structures could produce raw iteration or
  attribute errors instead of stable JenkinsError diagnostics.
• Boolean, float, or string console offsets could reach Jenkins despite the
  public non-negative integer contract.
• Invalid X-More-Data, a missing cursor while more data remained, or a
  regressive cursor on a completed page could silently stop or corrupt console
  pagination.

Breaking Changes

• None. Documented identity/state/health/build/timing fields and the existing
  Jenkins actions[].parameters[] shape remain available. Undocumented raw
  plugin, relation, cause, artifact, and change-set passthrough is intentionally
  removed.

Known Issues

• Jenkins string parameters can contain sensitive data under an innocuous name.
  Use Jenkins password/credential parameter types and secret-like names so the
  server can identify them; do not place secrets in ordinary string parameters.

Security

• Structured job and build reads now fail closed on malformed nested objects and
  project only explicitly documented fields.
• Allowed-job detail responses no longer carry upstream/downstream job objects,
  closing an indirect metadata path around MCP_ALLOWED_JOBS.
• Sensitive build parameters are redacted by parameter name and Jenkins class;
  arbitrary nested parameter values are never forwarded.

Upgrade Notes

• No configuration changes are required. Reconnect MCP sessions after rollout
  so clients refresh the strengthened tool descriptions and response contract.

Jenkins MCP Server v2.9.8

Released 2026-08-13.

Highlights

• Queue and running-build reads now expose only documented scheduling/build
  identity fields and fail closed when Jenkins returns malformed structures.
• Console pagination rejects invalid upstream offsets instead of throwing raw
  conversion errors or sending clients backwards through the log.

New Features

• None.

Improvements

• get_queue and list_running_builds use narrow Jenkins tree queries,
  reducing controller response work and MCP payload size.
• Read-response validation now returns consistent JenkinsError diagnostics for
  malformed job, queue, running-build, and progressive-log responses.

Bug Fixes

• A malformed list_jobs collection was returned verbatim, bypassing the
  allowlist projection that applies to a valid jobs list.
• A malformed get_queue collection was returned verbatim, bypassing job
  filtering and exposing whatever object Jenkins or a proxy supplied.
• Queue items with invalid/traversing job names raised PolicyError and aborted
  the complete queue read instead of being omitted as untrusted entries.
• get_queue requested depth-two queue data and returned raw action/plugin
  fields, which could include build-parameter values unrelated to its documented
  scheduling contract.
• list_running_builds requested depth-two computer data and returned raw
  currentExecutable plugin fields rather than its documented job/build identity.
• Malformed top-level, computer, executor, or executable structures produced
  AttributeError/iteration failures, or silently appeared as an empty running
  set, instead of a stable Jenkins response error.
• A non-integer X-Text-Size header escaped as a raw ValueError; negative or
  regressive offsets could make progressive-console callers loop or move
  backwards while Jenkins claimed more data.
• The compatibility endpoint inventory incorrectly listed get_queue under a
  job endpoint instead of /queue/api/json.

Breaking Changes

• None. The documented queue fields (id, state, wait reason and task identity)
  and running-build fields (node, build number/name and URL) are preserved.
  Undocumented raw plugin/action passthrough is intentionally removed.

Known Issues

• get_build_info intentionally returns Jenkins build parameters as documented;
  operators remain responsible for Jenkins parameter visibility and should not
  place secrets in ordinary string parameters.

Security

• Queue action/build-parameter payloads and arbitrary executable plugin fields
  no longer cross the MCP boundary through queue or running-build reads.
• Malformed job/queue response shapes fail closed instead of skipping the
  allowlist projection and returning the raw upstream object.

Upgrade Notes

• No configuration changes are required. Clients using documented queue and
  running-build fields continue unchanged; reconnect MCP sessions after rollout
  to refresh the strengthened tool descriptions.