# io.usefulapi/depot (remote · depot.usefulapi.io)

Inspect Depot builds, CI runs, job logs and Actions runners; retry or cancel CI runs.

- Trust score: 77/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-04

## Components

- remote · `depot.usefulapi.io`: 77/100 (this document), [markdown](https://verifymcp.io/servers/io-usefulapi-depot/depot.md), [page](https://verifymcp.io/servers/io-usefulapi-depot/depot)

## Channel facts

- Endpoint: `https://depot.usefulapi.io/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-04.

- **Endpoint Security**: 89/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 74/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3166 tokens (~143/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 10/100
  - Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 22 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the io.usefulapi/depot MCP server?

io.usefulapi/depot is a hosted endpoint at https://depot.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http io-usefulapi-depot 'https://depot.usefulapi.io/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "io-usefulapi-depot": {
      "url": "https://depot.usefulapi.io/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-usefulapi-depot": {
      "type": "http",
      "url": "https://depot.usefulapi.io/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.io-usefulapi-depot]
url = "https://depot.usefulapi.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-usefulapi-depot": {
      "type": "remote",
      "url": "https://depot.usefulapi.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-usefulapi-depot --url 'https://depot.usefulapi.io/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-usefulapi-depot:
    url: "https://depot.usefulapi.io/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "io-usefulapi-depot": {
      "Transport": "http",
      "Url": "https://depot.usefulapi.io/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-usefulapi-depot -t streamable-http -u 'https://depot.usefulapi.io/mcp'
```

### Other

```json
{
  "mcpServers": {
    "io-usefulapi-depot": {
      "type": "http",
      "url": "https://depot.usefulapi.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-04 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-02 (score 76, +1)

- [functional improvement] Stability: unverified → 0.03
- [functional] Server version: 1.3.0 → 1.5.1

### 2026-10-01 (score 75, +47)

- [security improvement] Authorization: unverified → pass
- [security improvement] HTTPS: unverified → pass
- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] First check of Authorization: partial
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Destructive annotations: pass
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 100

### 2026-09-30 (score 28, +10)

- [security improvement] Transport: fail → pass
- [security] Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the whole tool list to see what that exposes.

### 2026-09-29 (score 18)

First indexed and scored.

## MCP tools (22)

### `depot_list_projects` (~113 tokens)

List projects

List the organization's Depot projects. A project is an isolated container-build cache (region, hardware, cache policy). Use the returned projectId with the build and registry tools. Depot: ProjectService/ListProjects.

Input parameters:

- `page_size` (integer): Page size, 1-250.
- `page_token` (string): Cursor from the previous response's nextPageToken. Omit for the first page.
- `region_id` (string): Only projects in this region or cloud connection, e.g. us-east-1.

### `depot_get_project` (~52 tokens)

Get a project

Get one Depot project — name, region, hardware size, cache policy, build timeout and autoscaling. Depot: ProjectService/GetProject.

Input parameters:

- `project_id` (string, required): Project id, from depot_list_projects.

### `depot_list_builds` (~114 tokens)

List builds for a project

List container builds in a project, newest first: status (STATUS_RUNNING / FAILED / SUCCESS / ERROR / CANCELED), timestamps, build duration, time saved by cache, and cached vs total steps. Depot: core BuildService/ListBuilds.

Input parameters:

- `page_size` (integer): Page size, 1-100.
- `page_token` (string): Cursor from the previous response's nextPageToken. Omit for the first page.
- `project_id` (string, required): Project id, from depot_list_projects.

### `depot_get_build` (~53 tokens)

Get a build

Get one container build's status, timestamps, duration, time saved and cached/total step counts. Depot: core BuildService/GetBuild.

Input parameters:

- `build_id` (string, required): Build id, from depot_list_builds.

### `depot_get_build_steps` (~144 tokens)

List a build's steps

List the BuildKit steps of a container build: name, digest, start/end time, cache state (CACHED / UNCACHED), any error, and whether it has logs. Find the failing step here, then pass its digest to depot_get_build_step_logs. Depot: build.v1 BuildService/GetBuildSteps.

Input parameters:

- `build_id` (string, required): Build id, from depot_list_builds.
- `page_size` (integer): Page size, 1-1000.
- `page_token` (string): Cursor from the previous response's nextPageToken. Omit for the first page.
- `project_id` (string, required): Project id the build belongs to.

### `depot_get_build_step_logs` (~130 tokens)

Get a build step's logs

Get the log lines (message + timestamp) of one container-build step, identified by its digest from depot_get_build_steps. Depot: build.v1 BuildService/GetBuildStepLogs.

Input parameters:

- `build_id` (string, required): Build id.
- `page_size` (integer): Page size, 1-1000.
- `page_token` (string): Cursor from the previous response's nextPageToken. Omit for the first page.
- `project_id` (string, required): Project id the build belongs to.
- `step_digest` (string, required): The step's digest, from depot_get_build_steps.

### `depot_list_registry_images` (~94 tokens)

List registry images

List the images stored in a project's Depot Registry: tag, digest, pushedAt and sizeBytes. Depot: build.v1 RegistryService/ListImages.

Input parameters:

- `page_size` (integer): Page size, 1-100.
- `page_token` (string): Cursor from the previous response's nextPageToken. Omit for the first page.
- `project_id` (string, required): Project id, from depot_list_projects.

### `depot_get_usage` (~128 tokens)

Get organization usage

Get the organization's Depot usage over a window: container builds per project (build count, minutes saved, minutes billed), GitHub Actions jobs per repo/workflow/runner (minutes elapsed and billed), storage, and agent sandboxes. Depot: UsageService/GetUsage.

Input parameters:

- `end_at` (string, required): Window end, RFC 3339 (e.g. 2026-09-30T00:00:00Z).
- `start_at` (string, required): Window start, RFC 3339 (e.g. 2026-09-01T00:00:00Z).

### `depot_ci_list_runs` (~193 tokens)

List Depot CI runs

List Depot CI runs, newest first. Filter by status (default: running + queued — pass ["failed"] to find failures), repo, commit SHA prefix, trigger event, or pull request number (requires repo). Depot: CIService/ListRuns.

Input parameters:

- `page_size` (integer): Page size, 1-100.
- `page_token` (string): Cursor from the previous response's nextPageToken. Omit for the first page.
- `pr` (string): Pull request number. Requires repo.
- `repo` (string): Repository in owner/name format, e.g. depot/cli.
- `sha` (string): Commit SHA prefix (1-40 hex chars).
- `status` (array): Run statuses to include (ORed). Default on Depot's side: running and queued.
- `trigger` (string): Trigger event, e.g. push, pull_request, schedule, workflow_dispatch.

### `depot_ci_get_run_status` (~84 tokens)

Get a CI run's status tree

Get a Depot CI run's status with its nested workflows, jobs and attempts (ids, keys, statuses, error messages). This is how to find the workflowId / jobId / attemptId for the log, diagnosis and retry tools. Depot: CIService/GetRunStatus.

Input parameters:

- `run_id` (string, required): CI run id, from depot_ci_list_runs.

### `depot_ci_list_workflows` (~154 tokens)

List Depot CI workflows

List Depot CI workflows across runs, newest first, with per-status job counts. Filter by name/path text, repo, status, trigger, SHA prefix or PR number. Depot: CIService/ListWorkflows.

Input parameters:

- `name` (string): Text to match in the workflow name or file path.
- `page_size` (integer): Page size, 1-200.
- `pr` (string): Pull request number.
- `repo` (string): Repository in owner/name format.
- `sha` (string): Commit SHA prefix (1-40 hex chars).
- `status` (array): Workflow statuses to include (ORed).
- `trigger` (string): Trigger event, e.g. push or pull_request.

### `depot_ci_get_job` (~75 tokens)

Get a CI job

Get one Depot CI job: status, conclusion, error message, timestamps, runner config (labels, image, CPUs, memory), matrix values, parent run/workflow context, dependencies and attempt history. Depot: CIService/GetJob.

Input parameters:

- `job_id` (string, required): CI job id, from depot_ci_get_run_status.

### `depot_ci_get_job_logs` (~132 tokens)

Get a CI job's logs

Get persisted log lines for a Depot CI job attempt, oldest first (step key/name, timestamp, line number, body). Pass job_id to read the job's latest attempt, or attempt_id for a specific one — exactly one. Pass nextPageToken back as page_token for more lines. Depot: CIService/GetJobAttemptLogs.

Input parameters:

- `attempt_id` (string): A specific attempt id.
- `job_id` (string): CI job id — resolves to its latest attempt.
- `page_token` (string): Cursor from the previous response's nextPageToken. Omit for the first page.

### `depot_ci_get_failure_diagnosis` (~109 tokens)

Diagnose a CI failure

Get Depot's failure diagnosis for a CI run, workflow, job or attempt. For runs and workflows, identical failures are grouped by error fingerprint; for a job or attempt it is a focused diagnosis with evidence. Empty when no failure evidence is found. The best first call when a run failed. Depot: CIService/GetFailureDiagnosis.

Input parameters:

- `target_id` (string, required): The run, workflow, job or attempt id.
- `target_type` (string, required): What target_id identifies.

### `depot_gha_list_jobs` (~271 tokens)

List GitHub Actions jobs on Depot runners

List GitHub Actions jobs that ran on Depot-managed runners, newest first: status, conclusion, runner label, requested CPU/memory, duration, billable time and GitHub URL. Defaults to the last 30 days (max window 90 days). Depot: GithubActionsService/ListGithubActionsJobs.

Input parameters:

- `conclusions` (array): Job conclusions to include, e.g. ["failure"].
- `end_at` (string): Window end, RFC 3339 (e.g. 2026-09-18T00:00:00Z).
- `page_size` (integer): Page size, 1-250.
- `page_token` (string): Cursor from the previous response's nextPageToken. Omit for the first page.
- `query` (string): Case-insensitive text matched against job and workflow names; numeric values also match exact GitHub job/run ids.
- `repositories` (array): Connected repositories in owner/name format, e.g. ["acme/widgets"]. Empty = all.
- `runner_labels` (array): Runner labels to include.
- `start_at` (string): Window start, RFC 3339 (e.g. 2026-09-17T00:00:00Z).
- `statuses` (array): Job states to include.

### `depot_gha_search_logs` (~283 tokens)

Search GitHub Actions logs

Search GitHub Actions log lines from Depot runners, newest match first (job, workflow, step, timestamp, body, lineId). Defaults to the last hour (max window 30 days). Filter by repository, workflow, runner label, action or compute id. Depot: GithubActionsService/SearchGithubActionsLogs.

Input parameters:

- `actions` (array): Actions to include, e.g. actions/checkout.
- `compute_id` (string): A single Depot compute id.
- `end_at` (string): Window end, RFC 3339 (e.g. 2026-09-18T00:00:00Z).
- `page_size` (integer): Page size, 1-1000.
- `page_token` (string): Cursor from the previous response's nextPageToken. Omit for the first page.
- `query` (string): Text to match in log bodies, e.g. "timeout". Empty returns unfiltered lines.
- `repositories` (array): Connected repositories in owner/name format, e.g. ["acme/widgets"]. Empty = all.
- `runner_labels` (array): Runner labels to include.
- `start_at` (string): Window start, RFC 3339 (e.g. 2026-09-17T00:00:00Z).
- `workflows` (array): Workflow names to include.

### `depot_gha_get_analytics` (~254 tokens)

Get GitHub Actions analytics

Get time-bucketed GitHub Actions analytics for Depot runners: job counts (successful/failed/cancelled), failure rate, elapsed and billable seconds, average duration — as totals plus hourly or daily buckets. Defaults to the last 30 days (max 90). Depot: GithubActionsService/GetGithubActionsAnalytics.

Input parameters:

- `aggregation_unit` (string): Bucket size. Default: day.
- `end_at` (string): Window end, RFC 3339 (e.g. 2026-09-18T00:00:00Z).
- `jobs` (array): Job display names to include.
- `repositories` (array): Connected repositories in owner/name format, e.g. ["acme/widgets"]. Empty = all.
- `runner_labels` (array): Runner labels to include, e.g. depot-ubuntu-24.04-8.
- `start_at` (string): Window start, RFC 3339 (e.g. 2026-09-17T00:00:00Z).
- `workflow_paths` (array): Workflow file paths to include, e.g. .github/workflows/ci.yml.
- `workflows` (array): Workflow names to include.

### `depot_gha_list_recommendations` (~281 tokens)

List runner-size recommendations

List Depot's runner-size recommendations from job CPU and memory metrics: SIZE_UP when average CPU or memory reaches 90%, SIZE_DOWN when both averages stay ≤30% and peaks ≤70%, with current vs suggested size and per-minute price. Defaults to the last 30 days. Depot: GithubActionsService/ListGithubActionsRecommendations.

Input parameters:

- `end_at` (string): Window end, RFC 3339 (e.g. 2026-09-18T00:00:00Z).
- `jobs` (array): Job display names to include.
- `page_size` (integer): Page size, 1-250.
- `page_token` (string): Cursor from the previous response's nextPageToken. Omit for the first page.
- `repositories` (array): Connected repositories in owner/name format, e.g. ["acme/widgets"]. Empty = all.
- `runner_labels` (array): Runner labels to include, e.g. depot-ubuntu-24.04-8.
- `start_at` (string): Window start, RFC 3339 (e.g. 2026-09-17T00:00:00Z).
- `workflow_paths` (array): Workflow file paths to include, e.g. .github/workflows/ci.yml.
- `workflows` (array): Workflow names to include.

### `depot_create_project` (~260 tokens)

Create a project

WRITE. Create a Depot container-build project (an isolated build cache). Idempotent by name: if an active project with the same name exists, that project is returned. Defaults: cache 50 GB / 14 days, hardware HARDWARE_16X32 on AWS builders. Depot: ProjectService/CreateProject.

Input parameters:

- `build_timeout_minutes` (integer): Max duration of each build, minutes. Omit for no timeout.
- `cache_keep_days` (integer): Days to keep cache entries since last use (1-30). Default 14.
- `cache_keep_gb` (integer): Max cache size per architecture, GB (25-1000). Default 50.
- `hardware` (string): Builder size, e.g. HARDWARE_16X32 (16 CPU / 32 GB).
- `max_concurrent_builds` (integer): Builds per builder before autoscaling adds one. Omit to disable autoscaling.
- `name` (string, required): Display name for the project.
- `organization_id` (string): Owning organization. Only needed for user tokens that belong to more than one org.
- `region_id` (string, required): Depot region or cloud connection, e.g. us-east-1 or eu-central-1.

### `depot_ci_retry_job` (~90 tokens)

Retry a CI job

WRITE — starts compute. Retry one failed or cancelled Depot CI job, plus any skipped jobs that depend on it. Fails if a dependent job already started; use depot_ci_retry_failed_jobs then. Depot: CIService/RetryJob.

Input parameters:

- `job_id` (string, required): Job id to retry.
- `workflow_id` (string, required): Workflow id containing the job, from depot_ci_get_run_status.

### `depot_ci_retry_failed_jobs` (~76 tokens)

Retry a workflow's failed jobs

WRITE — starts compute. Retry only the failed and cancelled jobs in a Depot CI workflow, plus skipped jobs that depend on them. Jobs that succeeded are left alone. Depot: CIService/RetryFailedJobs.

Input parameters:

- `workflow_id` (string, required): Workflow id, from depot_ci_get_run_status or depot_ci_list_workflows.

### `depot_ci_cancel_run` (~76 tokens)

Cancel a CI run

WRITE — stops work in progress. Cancel a queued or running Depot CI run and all of its unfinished workflows, jobs and attempts. Cancelled jobs can be retried afterwards with depot_ci_retry_failed_jobs. Depot: CIService/CancelRun.

Input parameters:

- `run_id` (string, required): CI run id, from depot_ci_list_runs.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-usefulapi-depot/depot#diagnostics

## Score history

- 2026-10-04: 77
- 2026-10-03: 76
- 2026-10-02: 76
- 2026-10-01: 75
- 2026-09-30: 28
- 2026-09-29: 18

## Common questions

### What is the io.usefulapi/depot MCP server?

io.usefulapi/depot is an MCP server listed in the public MCP registry as io.usefulapi/depot. Inspect Depot builds, CI runs, job logs and Actions runners; retry or cancel CI runs. This page covers its hosted endpoint (https://depot.usefulapi.io/mcp).

### Is the io.usefulapi/depot MCP server safe to use?

io.usefulapi/depot scores 77 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.usefulapi/depot MCP server expose?

io.usefulapi/depot exposes 22 tools: depot_list_projects, depot_get_project, depot_list_builds, depot_get_build, depot_get_build_steps, and 17 more. Their descriptions and schemas cost roughly 3,166 tokens of context every time the server is loaded.

### Does the io.usefulapi/depot MCP server require authentication?

Yes. io.usefulapi/depot asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the io.usefulapi/depot MCP server still maintained?

io.usefulapi/depot is still listed as active in the MCP registry. We last reached this channel on 4 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://depot.usefulapi.io/mcp
- Repository: https://github.com/m190/usefulapi-mcp
- Changelog RSS feed: https://verifymcp.io/servers/io-usefulapi-depot/depot.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-usefulapi-depot/depot.json
- HTML version of this page: https://verifymcp.io/servers/io-usefulapi-depot/depot