GoCD MCP Server (rushi/gocd-mcp) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 36 tools. No publisher has claimed this listing.

D
Caution
52/100

GoCD MCP Server

Enables AI assistants to query and manage GoCD pipelines, stages, and jobs through the Model Context Protocol. It allows users to trigger builds, analyze failures, and access build logs or artifacts using the GoCD REST API.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

rushi

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 2 critical, 7 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
// tools this server exposes18 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_pipelines

List all pipelines in the GoCD server with their groups and pause status. Use this to discover available pipelines, check which pipelines are paused, or browse the pipeline catalog. Good starting point when you don't know the exact pipeline name.

get_pipeline_status

Get the current status of a pipeline including pause state (paused or not), lock status (locked by another run), and schedulability (can it run now). Use this to check if a pipeline is currently running, why it's not running, or if it's paused. Quick status check without full history.

get_pipeline_history

Get the run history of a pipeline with pagination support. Use this to see recent pipeline runs, find the latest run, check historical results, or identify patterns in failures. Shows run numbers (counters), results, and stage information for each run. Essential for finding a specific pipeline run t

get_pipeline_instance

Get comprehensive details of a specific pipeline run including build cause (what triggered it), materials (git commits, dependencies), and all stages with their status. Use this to understand why a pipeline ran, what code was built, or see the full pipeline execution details. Essential for investiga

trigger_pipeline

Schedule and trigger a new pipeline run immediately, optionally with custom environment variables. Use this to manually start a pipeline, trigger a deployment, or run a pipeline with specific configuration. Can pass environment variables to customize the run behavior. Note: Pipeline must not be paus

pause_pipeline

Pause a pipeline to prevent automatic scheduling and triggering. Use this to temporarily disable a pipeline during maintenance, stop automatic deployments, or prevent a problematic pipeline from running. Paused pipelines won't run automatically but can still be manually triggered. Can include a reas

unpause_pipeline

Unpause a previously paused pipeline to resume automatic scheduling and triggering. Use this to re-enable a pipeline after maintenance, restore normal operations, or allow automatic runs to resume. The pipeline will immediately become eligible for automatic triggering based on its material changes.

get_stage_instance

Get details of a specific stage run including all jobs, their states (Scheduled, Building, Completed), results (Passed, Failed), and approval information. Use this to see which jobs failed in a stage, check stage status, or understand the overall stage execution. Essential for identifying which job

trigger_stage

Manually trigger or rerun a specific stage in a pipeline. Use this to retry a failed stage, run a manual approval stage, or trigger a stage that requires manual intervention. Common for deployment stages or stages with manual approval gates.

cancel_stage

Cancel a running stage and all its jobs immediately. Use this to stop a long-running stage, abort a deployment that's going wrong, or cancel jobs that are stuck or no longer needed. All running jobs in the stage will be terminated.

parse_gocd_url

Parse a GoCD URL to extract pipeline, stage, and job information. Use this FIRST when the user provides a GoCD URL (e.g., from their browser) before calling other tools. Supports job detail URLs, stage URLs, and pipeline URLs.

analyze_job_failures

Comprehensive analysis of all failures and errors for a job. Use this when asked to 'get errors', 'analyze failures', 'what went wrong', 'why did this fail', or 'show me the problems'. Automatically finds JUnit test reports and extracts test failures with error messages and stack traces, plus checks

get_job_history

Get the execution history of a specific job across multiple pipeline runs. Use this to see historical trends, past runs, or to find a specific job instance.

get_job_instance

Get details of a specific job run including state (Scheduled, Building, Completed), result (Passed, Failed, Cancelled), agent information, and timestamps. Use this to check job status or get basic job information without downloading logs or artifacts.

get_job_console

Get the complete console log output for a specific job run. Use this to see build logs, compilation errors, runtime errors, stack traces, or any output written to stdout/stderr during job execution. Essential for debugging build failures and understanding what happened during execution.

list_job_artifacts

List all artifacts (files and folders) produced by a job, including test reports (JUnit XML), coverage reports, build outputs, and logs. Use this to discover what files are available before downloading specific artifacts. Essential first step when looking for test results or build artifacts.

get_job_artifact

Download and read a specific artifact file from a job. Use this to retrieve specific files like test reports, coverage data, configuration files, or any other build artifact when you know the exact path. For test reports, consider using parse_junit_xml instead for structured output.

parse_junit_xml

Parse a JUnit XML test report to extract structured test results, failures, and errors. Use this when analyzing test failures, understanding which tests failed, or getting detailed error messages and stack traces from test runs. Returns comprehensive test data including test names, failure messages,

// known CVEs in dependencies2 critical7 high10 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalfast-xml-parser@5.3.3GHSA-m7jm-9gc2-mpf2

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

criticalvitest@2.1.9GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highfast-xml-parser@5.3.3GHSA-37qj-frw5-hhjh

fast-xml-parser has RangeError DoS Numeric Entities Bug

highfast-xml-parser@5.3.3GHSA-8gc5-j5rx-235r

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configGOCD_SERVER_URLThe URL of your GoCD server (e.g., https://gocd.example.com)
configLOG_LEVEL
configMCP_HOSTHost to bind the MCP server to (default: 0.0.0.0)
configMCP_PORTPort for the MCP server to listen on (default: 3000)
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

36/36 tools missing one or more hints — list_pipelines (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_pipeline_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_pipeline_history (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +33 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tool test coverage

28/36 tools referenced in tests (78%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

1 critical, 7 high severity in production deps — fast-xml-parser@5.3.3 (critical), @modelcontextprotocol/sdk@1.0.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/rushi/gocd-mcp?variant=verified)](https://m8ven.ai/mcp/rushi/gocd-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: a9b568116d9056f7fd02390ca150b59a0d7b1e5e
code hash: e668df3b946b442e82ca5dd3b9466ea0427dfa4859259454ead5d20d97aabf0e
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client