depot-mcp

List the project tokens that exist for one Depot container build project: token id, description, and timestamps when Depot provides them. Never the token secret, which Depot only reveals once, at creation, and this server never creates one. Use this for credential inventory and access reviews: "whi…

Explain why a Depot container build failed: locate the step that broke and return its error and the tail of its logs, alongside cache effectiveness for the build. Use this for "why did my docker build fail". Unlike Depot CI, container builds have no server-side AI diagnosis, so this tool does the l…

Show one Depot container build: its status, when it was created, started and finished, how long it ran, and how much of it the cache served. Use this to check on a specific build by id: "did build X succeed", "is it still running", "how well did the cache do". It is one request and returns quickly,…

List recent container builds for a Depot project, with duration and cache effectiveness for each. Use this to find a build to diagnose, or to answer "are our builds getting slower" — every row carries cachedSteps, totalSteps and secondsSaved, so a run of builds with a low cache hit ratio is visible…

Report the health of one Depot project's layer cache: the retention policy against the current cache size, the cache hit ratio over recent builds, the time the cache saved, and plain-language observations (cache near its size limit, low hit ratio, builds arriving less often than the retention keeps …

Mint a short-lived signed download URL for one Depot CI artifact, by artifact id. Use this when you already know which artifact you want (from depot_list_ci_artifacts) and need to fetch it: a JUnit report to read the failing test names, a screenshot from a browser test, a built binary. Download it …

List the names and scoping of Depot CI secrets. Values are never returned — Depot's API does not expose them at all, by design. Use this to answer "why can't my job see $FOO". Depot models a secret as one name with several variants, each scoped by repository, environment, branch, and workflow attri…

List Depot CI variables, their values, and their scoping. Use this for the same "why can't my job see $FOO" question as depot_list_ci_secrets, and to check that a variable holds what you expect for a given branch or environment. Depot models a variable as one name with several variants, each scoped…

Show one Depot CI job: its status, conclusion, recorded error, runner labels, timing, and every attempt with the attempt and sandbox ids needed to drill in. Use this when you already have a jobId (from depot_get_ci_run or a diagnosis) and want to know what happened to that job across retries: which…

Show one attempt of a Depot CI job: its status, conclusion, recorded error, sandbox and session ids, timing, and whether it is the job's current attempt, with the parent job, workflow, and run for context. Use this when you hold an attemptId (from depot_get_ci_run, depot_get_ci_job, or a diagnosis)…

Read CPU and memory metrics for a Depot CI run, job, or job attempt. Use this when a job died without a useful error, was killed abruptly, hit an exit code like 137, or is simply slow — the shapes to look for are memory sitting at its limit (an OOM kill) or CPU pinned at 100% for the whole job (und…

List recent Depot CI runs, newest first, optionally filtered by status, repository, commit, trigger, or pull request. Use this to find the run someone is talking about — "my last failed build", "did main go green", "what ran for PR 412" — and then pass the returned runId to depot_diagnose_ci_failur…

Show one Depot CI run as its workflow -> job -> attempt tree, with the status of every node and the ids needed to drill in. Use this to see the shape of a run: which jobs exist, which failed, and which attempt ids to pass to depot_get_ci_logs or depot_get_ci_metrics. Set failedOnly=true to cut a la…

Read the step summary a Depot CI job authored for itself — the equivalent of GitHub Actions' $GITHUB_STEP_SUMMARY. This is markdown the job's own steps chose to publish: test result tables, coverage deltas, lint counts, deployment URLs. When a job writes one, it is usually a far better explanation …

Wait, for a bounded time, until a Depot CI run, one workflow in it, or one job reaches a terminal state, then report the outcome and which nodes changed state while waiting. Use this after a push or a rerun when the next step depends on the result: "wait for the run to finish, then diagnose it if i…

List recent Depot CI workflows, newest first, with each one's status and job counts, optionally filtered by workflow name, status, repository, commit, trigger, or pull request. Use this when the question is about a named workflow rather than a whole run: "is the deploy workflow green", "which CI wo…

Show one Depot CI workflow: its status and timing, its parent run, its execution history (every rerun or retry, oldest first), and its job -> attempt tree with the ids needed to drill in. Use this when you have a workflowId (from depot_list_ci_workflows, depot_get_ci_run, or a diagnosis) and want t…

Cancel a queued or running Depot CI run (CancelRun) and every unfinished workflow and job under it, or, when workflowId is given, cancel just that workflow (CancelWorkflow) and its jobs. Use this when a run is known to be wasted: a superseded commit, a job stuck waiting, a workflow started by mista…

Cancel a single queued or running Depot CI job (CancelJob), leaving the rest of its workflow and run untouched. Use this for one stuck or pointless job, for example a matrix entry that is hanging, when the rest of the run should finish. To stop everything, use depot_cancel_ci_run instead. Cancellin…

Rerun every job of a finished Depot CI workflow (RerunWorkflow), successful ones included. Depot resets each terminal job and starts a new execution, so this costs the workflow's full compute again. Prefer depot_retry_ci_failed_jobs, which reruns only what failed; this tool is for cases where the p…

Change a Depot container build project's name, builder hardware, or layer cache policy (ProjectService/UpdateProject). The API form of editing the project in the Depot dashboard. dryRun (the default) reads the project with GetProject and shows each field that would change, from the current value to…

Create a Depot container build project (ProjectService/CreateProject): a name, a region, optional runner hardware, and an optional layer cache policy. The API form of `depot projects create`. dryRun (the default) lists the organization's existing projects, resolves every default (region us-east-1, …

List Depot container build projects with their region, runner hardware, and cache policy. Use this to find a projectId for depot_list_builds, depot_diagnose_build, or depot_list_images, and to check configuration that affects build speed: which region a project builds in, how large its runners are,…

Show one Depot container build project's full configuration together with its OIDC trust policies. Use this to check build capacity and cache retention for a specific project, and to audit which external CI systems are allowed to exchange an OIDC token for Depot credentials — trust policies are the…

List the container images stored in a Depot project's registry, with tag, digest, push time, and size. Use this to check whether a build actually pushed what you expected, to find the digest behind a tag before a deploy, or to see when an image was last refreshed. Requires a projectId; DEPOT_PROJE…

Report Depot usage for a period: container build minutes and minutes saved by caching, GitHub Actions runner minutes by repository and workflow, storage, and agent sandbox minutes. Use this for cost questions — "what is burning our Depot minutes", "which repo dominates our runner bill", "is the cac…

List every Depot container build project's build count, total build time, and layer cache size for a period, in one call. Use this for "which project holds the most cache", "which projects are actually building", and "where is our storage going". Rows are sorted by layer cache size, largest first, …

Verify the configured Depot token and report which organizations and projects it can actually see. Call this first whenever another Depot tool returns an empty list or a permission error. Depot's most common confusing failure is a token that spans several organizations with none selected: requests …