GoCD MCP Server (rushi/gocd-mcp) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 36 tools. No publisher has claimed this listing.
Enables AI assistants to query and manage GoCD pipelines, stages, and jobs through the Model Context Protocol. It allows users to trigger builds, analyze failures, and access build logs or artifacts using the GoCD REST API.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
rushi
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
list_pipelinesList all pipelines in the GoCD server with their groups and pause status. Use this to discover available pipelines, check which pipelines are paused, or browse the pipeline catalog. Good starting point when you don't know the exact pipeline name.
get_pipeline_statusGet the current status of a pipeline including pause state (paused or not), lock status (locked by another run), and schedulability (can it run now). Use this to check if a pipeline is currently running, why it's not running, or if it's paused. Quick status check without full history.
get_pipeline_historyGet the run history of a pipeline with pagination support. Use this to see recent pipeline runs, find the latest run, check historical results, or identify patterns in failures. Shows run numbers (counters), results, and stage information for each run. Essential for finding a specific pipeline run t…
get_pipeline_instanceGet comprehensive details of a specific pipeline run including build cause (what triggered it), materials (git commits, dependencies), and all stages with their status. Use this to understand why a pipeline ran, what code was built, or see the full pipeline execution details. Essential for investiga…
trigger_pipelineSchedule and trigger a new pipeline run immediately, optionally with custom environment variables. Use this to manually start a pipeline, trigger a deployment, or run a pipeline with specific configuration. Can pass environment variables to customize the run behavior. Note: Pipeline must not be paus…
pause_pipelinePause a pipeline to prevent automatic scheduling and triggering. Use this to temporarily disable a pipeline during maintenance, stop automatic deployments, or prevent a problematic pipeline from running. Paused pipelines won't run automatically but can still be manually triggered. Can include a reas…
unpause_pipelineUnpause a previously paused pipeline to resume automatic scheduling and triggering. Use this to re-enable a pipeline after maintenance, restore normal operations, or allow automatic runs to resume. The pipeline will immediately become eligible for automatic triggering based on its material changes.
get_stage_instanceGet details of a specific stage run including all jobs, their states (Scheduled, Building, Completed), results (Passed, Failed), and approval information. Use this to see which jobs failed in a stage, check stage status, or understand the overall stage execution. Essential for identifying which job …
trigger_stageManually trigger or rerun a specific stage in a pipeline. Use this to retry a failed stage, run a manual approval stage, or trigger a stage that requires manual intervention. Common for deployment stages or stages with manual approval gates.
cancel_stageCancel a running stage and all its jobs immediately. Use this to stop a long-running stage, abort a deployment that's going wrong, or cancel jobs that are stuck or no longer needed. All running jobs in the stage will be terminated.
parse_gocd_urlParse a GoCD URL to extract pipeline, stage, and job information. Use this FIRST when the user provides a GoCD URL (e.g., from their browser) before calling other tools. Supports job detail URLs, stage URLs, and pipeline URLs.
analyze_job_failuresComprehensive analysis of all failures and errors for a job. Use this when asked to 'get errors', 'analyze failures', 'what went wrong', 'why did this fail', or 'show me the problems'. Automatically finds JUnit test reports and extracts test failures with error messages and stack traces, plus checks…
get_job_historyGet the execution history of a specific job across multiple pipeline runs. Use this to see historical trends, past runs, or to find a specific job instance.
get_job_instanceGet details of a specific job run including state (Scheduled, Building, Completed), result (Passed, Failed, Cancelled), agent information, and timestamps. Use this to check job status or get basic job information without downloading logs or artifacts.
get_job_consoleGet the complete console log output for a specific job run. Use this to see build logs, compilation errors, runtime errors, stack traces, or any output written to stdout/stderr during job execution. Essential for debugging build failures and understanding what happened during execution.
list_job_artifactsList all artifacts (files and folders) produced by a job, including test reports (JUnit XML), coverage reports, build outputs, and logs. Use this to discover what files are available before downloading specific artifacts. Essential first step when looking for test results or build artifacts.
get_job_artifactDownload and read a specific artifact file from a job. Use this to retrieve specific files like test reports, coverage data, configuration files, or any other build artifact when you know the exact path. For test reports, consider using parse_junit_xml instead for structured output.
parse_junit_xmlParse a JUnit XML test report to extract structured test results, failures, and errors. Use this when analyzing test failures, understanding which tests failed, or getting detailed error messages and stack traces from test runs. Returns comprehensive test data including test names, failure messages,…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
When Vitest UI server is listening, arbitrary file can be read and executed
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
fast-xml-parser has RangeError DoS Numeric Entities Bug
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
GOCD_SERVER_URLThe URL of your GoCD server (e.g., https://gocd.example.com)LOG_LEVELMCP_HOSTHost to bind the MCP server to (default: 0.0.0.0)MCP_PORTPort for the MCP server to listen on (default: 3000)Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
36/36 tools missing one or more hints — list_pipelines (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_pipeline_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_pipeline_history (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +33 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tool test coverage
28/36 tools referenced in tests (78%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
1 critical, 7 high severity in production deps — fast-xml-parser@5.3.3 (critical), @modelcontextprotocol/sdk@1.0.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/rushi/gocd-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check