com.mcparmory/circleci
PYPI · MCPARMORY-CIRCLECI · 2 COMPONENTS · SCANNED SEP 20
Manage CI/CD pipelines, workflows, and job metrics across projects
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security37
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Install-script risk not yet assessed.Unverified
- 2 of 41 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (MIT License) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 131 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability76
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 14706 tokens (~136/item across 108 items; 108 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 16 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 108 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the com.mcparmory/circleci MCP server?
com.mcparmory/circleci runs locally as a PyPI package, launched with uvx mcparmory-circleci. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · mcparmory-circleci
claude mcp add com-mcparmory-circleci -- uvx mcparmory-circleci
{
"mcpServers": {
"com-mcparmory-circleci": {
"command": "uvx",
"args": [
"mcparmory-circleci"
]
}
}
} {
"servers": {
"com-mcparmory-circleci": {
"command": "uvx",
"args": [
"mcparmory-circleci"
]
}
}
} codex mcp add com-mcparmory-circleci -- uvx mcparmory-circleci
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-mcparmory-circleci": {
"type": "local",
"command": [
"uvx",
"mcparmory-circleci"
],
"enabled": true
}
}
} openclaw mcp add com-mcparmory-circleci --command uvx --arg mcparmory-circleci
mcp_servers:
com-mcparmory-circleci:
command: "uvx"
args: ["mcparmory-circleci"] {
"McpServers": {
"com-mcparmory-circleci": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"mcparmory-circleci"
]
}
}
} assistant mcp add com-mcparmory-circleci -t stdio -c uvx -a mcparmory-circleci
{
"mcpServers": {
"com-mcparmory-circleci": {
"command": "uvx",
"args": [
"mcparmory-circleci"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 −3
- Stability: pass → 0.80 functional
- 17 Sept 26 0
- Stability: 0.97 → pass security
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- 12 Sept 26 +13
- Malware scan: unverified → pass ▲ security
- Stability: pass → 0.83 functional
- 11 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- Stability: 0.97 → pass security
- 10 Sept 26 +16
- Malware scan: unverified → pass ▲ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/mcparmory-circleci@1.0.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Dependencies 41 packages
| Packages resolved | 41 |
|---|---|
| Stale | 1 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
trigger_pipeline_run Trigger Pipeline Run ~402
Trigger a new pipeline run for a project using a specific pipeline definition. Supports GitHub, Bitbucket, and CircleCI integrations (GitLab not supported).
| Name | Type | Req | Description |
|---|---|---|---|
| checkoutBranch | string | – | The branch to check out source code from during a checkout step. Mutually exclusive with the checkout tag field. For GitHub PRs, use pull/<number>/head or pull/<number>/merge. |
| checkoutTag | string | – | The tag used to check out source code during a checkout step; the pipeline runs against the commit the tag points to. Mutually exclusive with the checkout branch field. |
| configBranch | string | – | The branch from which the pipeline config file should be fetched. Mutually exclusive with the config tag field. For GitHub PRs, use pull/<number>/head or pull/<number>/merge. |
| configTag | string | – | The tag used to fetch the pipeline config file; the pipeline runs against the commit the tag points to. Mutually exclusive with the config branch field. |
| definition_id | string | – | The UUID of the pipeline definition to run, found in Project Settings > Pipelines. If omitted, the default pipeline definition is used. |
| organization | string | yes | The second segment of the slash-separated project slug, representing either a human-readable organization name or an opaque organization ID, as shown in Project Settings > Overview. |
| parameters | object | – | A key-value map of pipeline parameter names to their values. Limited to 100 entries, with keys up to 128 characters and values up to 512 characters. Values may be strings, booleans, or integers. |
| project | string | yes | The third segment of the slash-separated project slug, representing either a human-readable project name or an opaque project ID, as shown in Project Settings > Overview. |
| provider | string | yes | The VCS or platform provider, corresponding to the first segment of the slash-separated project slug found in Project Settings > Overview. |
No output schema declared.
No examples provided.
update_org_oidc_claims Update Organization OIDC Claims ~154
Creates or updates org-level custom claims on OIDC identity tokens for the specified organization. Use this to configure audience restrictions and token time-to-live settings.
| Name | Type | Req | Description |
|---|---|---|---|
| audience | array | – | List of intended recipients (audiences) for the OIDC token; order is not significant and each item should be a valid audience identifier string. |
| orgID | string | yes | The unique identifier of the organization whose OIDC custom claims will be updated. |
| ttl | string | – | Token time-to-live duration specifying how long the OIDC token remains valid; composed of one to seven time unit segments using milliseconds (ms), seconds (s), minutes (m), hours (h), days (d), or we… |
No output schema declared.
No examples provided.
update_pipeline_definition Update Pipeline Definition ~216
Updates an existing pipeline definition for a project, allowing changes to its name, description, config file path, or version control source settings. Currently supported only for pipeline definitions using GitHub App or Bitbucket Data Center as the config source provider.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | A brief explanation of the pipeline definition's purpose or behavior. |
| external_id | string | – | The repository identifier as defined by the version control provider, used to associate the pipeline definition with a specific external repository. |
| file_path | string | – | The relative path within the repository to the CircleCI YAML configuration file that this pipeline definition should use. |
| name | string | – | A human-readable display name for the pipeline definition. |
| pipeline_definition_id | string | yes | The unique opaque identifier of the pipeline definition to update. |
| project_id | string | yes | The unique opaque identifier of the project containing the pipeline definition to update. |
| provider | string | – | The version control integration provider for the pipeline definition's config source. Currently only 'github_app' is supported. |
No output schema declared.
No examples provided.
update_project_oidc_claims Update Project OIDC Claims ~192
Creates or updates project-level custom claims on OIDC identity tokens for the specified project. Use this to configure audience restrictions and token time-to-live at the project scope.
| Name | Type | Req | Description |
|---|---|---|---|
| audience | array | – | List of intended audiences for the OIDC token. Order is not significant; each item should be a valid audience string identifying a recipient that the token is intended for. |
| orgID | string | yes | Unique identifier of the organization that owns the project. |
| projectID | string | yes | Unique identifier of the project whose OIDC custom claims are being created or updated. |
| ttl | string | – | Time-to-live duration for the OIDC token, specifying how long it remains valid. Accepts a compound duration string composed of up to seven unit segments in descending order, using units: weeks (w), d… |
No output schema declared.
No examples provided.
update_project_settings Update Project Settings ~492
Updates one or more advanced settings for a CircleCI project, such as build behavior, fork policies, SSH access, and GitHub status reporting. Only the settings fields provided in the request body will be modified.
| Name | Type | Req | Description |
|---|---|---|---|
| autocancel_builds | boolean | – | When enabled, any running pipelines on a non-default branch are automatically cancelled when a new pipeline starts on that same branch. |
| build_fork_prs | boolean | – | When enabled, CircleCI will run builds triggered by pull requests that originate from forked repositories. |
| build_prs_only | boolean | – | When enabled, CircleCI will only build branches that have at least one associated open pull request. |
| disable_ssh | boolean | – | When set to true, disables the ability to re-run jobs with SSH debugging access for this project. |
| forks_receive_secret_env_vars | boolean | – | When enabled, builds triggered by forked pull requests will have access to this project's environment variables and secrets. |
| organization | string | yes | The organization identifier, corresponding to the second segment of the project slug visible in Project Settings > Overview. May be an org name or an org ID depending on the organization type. |
| oss | boolean | – | When enabled, marks the project as Free and Open Source, granting additional build credits and making builds publicly visible via the web UI and API. |
| pr_only_branch_overrides | array | – | A list of branch names that will always trigger a build regardless of the `build_prs_only` setting. The provided list completely overwrites the existing value; order is not significant. |
| project | string | yes | The project identifier, corresponding to the third segment of the project slug visible in Project Settings > Overview. May be a project name or a project ID depending on the organization type. |
| provider | string | yes | The version control provider for the project, corresponding to the first segment of the project slug visible in Project Settings > Overview. |
| set_github_status | boolean | – | When enabled, CircleCI reports the build status of every pushed commit to GitHub's status API, with updates provided per job. |
| setup_workflows | boolean | – | When enabled, allows pipeline configurations to be conditionally triggered from directories outside the primary `.circleci` parent directory using setup workflows. |
| write_settings_requires_admin | boolean | – | When enabled, only organization administrators can update project settings; when disabled, any project member may update settings. |
No output schema declared.
No examples provided.
update_schedule Update Schedule ~328
Updates an existing pipeline schedule by ID and returns the updated schedule. Only available for schedules associated with GitHub OAuth or Bitbucket Cloud pipeline definitions; use the Update Trigger endpoint for GitHub App pipeline definitions.
| Name | Type | Req | Description |
|---|---|---|---|
| attribution-actor | string | – | Determines whose permissions are used when the scheduled pipeline runs: 'current' uses the token owner's permissions, 'system' uses a neutral system actor. |
| days-of-month | array | – | List of calendar days of the month (1–31) on which the schedule triggers; mutually exclusive with days-of-week. |
| days-of-week | array | – | List of days of the week on which the schedule triggers (e.g., MON, TUE); mutually exclusive with days-of-month. |
| description | string | – | A human-readable description of the schedule's purpose or behavior. |
| hours-of-day | array | – | List of hours within a day (0–23) during which the schedule triggers; order is not significant. |
| months | array | – | List of months in which the schedule triggers (e.g., JAN, FEB); order is not significant. |
| name | string | – | The display name of the schedule. |
| parameters | object | – | Key-value pairs of pipeline parameters to pass when the schedule triggers; must include either a branch or tag key to specify the target ref. |
| per-hour | string | – | How many times the schedule triggers per hour; must be a whole number between 1 and 60. Mutually exclusive with hour-based scheduling fields. |
| schedule-id | string | yes | The unique UUID identifying the schedule to update. |
No output schema declared.
No examples provided.
update_trigger Update Trigger ~280
Update configuration for an existing pipeline trigger on a project. Currently supported for triggers with a provider of `github_oauth`, `github_app`, `bitbucket_dc`, or `webhook`.
| Name | Type | Req | Description |
|---|---|---|---|
| checkout_ref | string | – | The Git ref (branch, tag, or commit SHA) used to check out source code when pipeline runs are created from this trigger. |
| config_ref | string | – | The Git ref used to fetch the pipeline configuration file when pipeline runs are created from this trigger. |
| disabled | boolean | – | Whether the trigger is disabled and should not create pipeline runs when events occur. Only settable for triggers where the provider is `github_oauth`, `github_app`, or `webhook`. |
| event_name | string | – | The name of the event that activates this trigger. Only settable for triggers where the provider is `webhook`. |
| event_preset | string | – | A predefined event filtering preset that determines which GitHub events activate this trigger. Only applicable when the trigger's provider is `github_app`. |
| project_id | string | yes | The unique opaque identifier of the project that owns the trigger. |
| sender | string | – | The identity of the entity sending the webhook payload. Only settable for triggers where the provider is `webhook`. |
| trigger_id | string | yes | The unique opaque identifier of the trigger to update. |
No output schema declared.
No examples provided.
update_webhook Update Webhook ~232
Updates the configuration of an existing outbound webhook, allowing changes to its name, target URL, triggered events, signing secret, and TLS verification behavior. Only fields provided in the request will be updated.
| Name | Type | Req | Description |
|---|---|---|---|
| events | array | – | List of event types that will trigger this webhook; order is not significant and each item should be a valid event type string supported by the platform. |
| name | string | – | A human-readable label for the webhook, used to identify it in listings and logs. |
| signing-secret | string | – | A secret string used to generate an HMAC signature of the payload, which is passed as a request header so the receiver can verify the webhook's authenticity. |
| url | string | – | The destination URL where webhook payloads will be delivered; must use the HTTPS protocol (HTTP is not supported). |
| verify-tls | boolean | – | When set to true, enforces strict TLS certificate validation on the destination URL; set to false only if delivering to an endpoint with a self-signed or otherwise unverifiable certificate. |
| webhook-id | string | yes | The unique identifier of the webhook to update. |
No output schema declared.
No examples provided.
What is the com.mcparmory/circleci MCP server?
com.mcparmory/circleci is an MCP server listed in the public MCP registry as com.mcparmory/circleci. Manage CI/CD pipelines, workflows, and job metrics across projects. This page covers its PyPI package (mcparmory-circleci).
Is the com.mcparmory/circleci MCP server safe to use?
com.mcparmory/circleci scores 61 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.mcparmory/circleci MCP server expose?
com.mcparmory/circleci exposes 108 tools: get_project_workflow_summary, list_job_timeseries, get_org_summary, list_project_branches, list_flaky_tests, and 103 more. Their descriptions and schemas cost roughly 14,706 tokens of context every time the server is loaded.
Is the com.mcparmory/circleci MCP server still maintained?
com.mcparmory/circleci is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.