Semaphore CI MCP connector for AI agents

Tools your build agent reaches for on Semaphore CI, scoped per user.

CALL ANY TOOL

Operate CI pipelines end to end: search workflows, trigger and rerun builds, list pipeline jobs, and pull logs and test results.

semaphorecimcp_artifact_job_logs

Artifact job logs

Fetch a signed URL for full artifact-backed job logs in Semaphore CI.

Parameters

Name

Type

Required

Description

job_id

string

Required

The UUID of the job whose artifact logs to fetch.

organization_id

string

Required

The UUID of the Semaphore CI organization.

semaphorecimcp_artifacts_list

List artifacts

semaphorecimcp_artifacts_signed_url

Artifacts signed url

semaphorecimcp_docs_search

Search docs

semaphorecimcp_get_test_results

Get test results

semaphorecimcp_jobs_describe

Jobs describe

semaphorecimcp_jobs_logs

Jobs logs

semaphorecimcp_organizations_list

List organizations

semaphorecimcp_pipeline_jobs

Pipeline jobs

semaphorecimcp_pipelines_list

List pipelines

semaphorecimcp_projects_list

List projects

semaphorecimcp_projects_search

Search projects

semaphorecimcp_tasks_describe

Tasks describe

semaphorecimcp_tasks_list

List tasks

semaphorecimcp_tasks_run

Run tasks

semaphorecimcp_workflows_rerun

Workflows rerun

semaphorecimcp_workflows_run

Run workflows

semaphorecimcp_workflows_search

Search workflows

Build your Agent

Same auth pattern across LangChain, OpenAI, Anthropic, and Google ADK.

import { ScalekitClient } from "@scalekit-sdk/node";
import { createReactAgent } from "@langchain/langgraph/prebuilt";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// Semaphore CI tools scoped to this user
const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["semaphorecimcp"], toolNames: [
    "semaphorecimcp_workflows_search",
    "semaphorecimcp_jobs_logs",
    "semaphorecimcp_workflows_rerun"] },
  pageSize: 100,
});

const agent = createReactAgent({ llm, tools });
await agent.invoke({ messages: [{ role: "user", content: "Why did the main branch build fail?" }] });

import OpenAI from "openai";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["semaphorecimcp"] }, pageSize: 100,
});

const res = await openai.chat.completions.create({
  model: "gpt-5",
  messages: [{ role: "user", content: "Which workflows failed on main today?" }],
  tools,
});

// Execute the tool call with the user's vaulted Semaphore CI credential
await sk.tools.executeTool(res.choices[0].message.tool_calls[0], "user_123");

import Anthropic from "@anthropic-ai/sdk";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["semaphorecimcp"] }, pageSize: 100,
});

const msg = await anthropic.messages.create({
  model: "claude-sonnet-5",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Pull the logs for the failed deploy job." }],
  tools,
});

// Tool call runs with the user's vaulted Semaphore CI credential
await sk.tools.executeTool(msg.content, "user_123");

import { Agent } from "@google/adk/agents";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["semaphorecimcp"] }, pageSize: 100,
});

const agent = new Agent({
  name: "semaphore_ci_agent",
  model: "gemini-2.5-pro",
  instruction: "Manage Semaphore CI pipelines for the signed-in user.",
  tools,
});

await agent.run("Summarize test results for the latest pipeline.");

Try these prompts

Copy any prompt into your agent. Each maps directly to a Semaphore CI tool. Click to copy, paste into your agent, done.

Build health

Copy the prompt

Copied

Which workflows ran on main today, and did any fail?

Copy the prompt

Copied

List the jobs in the latest pipeline for api-core and flag failures.

Copy the prompt

Copied

Pull the logs for the job that failed this morning.

Trigger and rerun

Copy the prompt

Copied

Rerun the last failed workflow on main.

Copy the prompt

Copied

Schedule a workflow run for refs/heads/release/2.4 on the deploy project.

Copy the prompt

Copied

Run the billing pipeline against commit 9f3c2a1 with STAGE=staging.

Tests and diagnostics

Copy the prompt

Copied

Summarize test results for the latest pipeline on main.

Copy the prompt

Copied

Which specs failed in the last nightly run, and how long did they take?

Copy the prompt

Copied

List projects in the acme org and their most recent workflow status.

SEE HOW AUTH WORKS

Your users connect once. Their Semaphore CI credentials stay vaulted, every call is scope-checked, and every action is logged.

Authorize

Your user connects

Semaphore CI MCP

once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access

Who:

user ‘A’

when:

Once per user

access:

Limited to user

Store

Their

Semaphore CI MCP

token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection

vault:

encrypted

scope:

per-user

tokens:

auto-refreshed

Resolve

When your agent calls a

Semaphore CI MCP

tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs

speed:

~40ms

check:

before every call

seen by:

nobody

Audit

Every

Semaphore CI MCP

tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it

history:

90 days

export:

SIEM-ready

logged:

every call

Test other agents

See the same per-user auth pattern across other developer tool connectors.

Engineering Teams

DevOps assistant agent

Polls GitHub for failing checks and stale PRs, opens Linear issues for the ones that need work, and posts a daily digest to Slack. It acts as the engineer, not a shared service account.

Engineering Teams

Slack triage

Polls Slack for new messages, classifies bugs and support requests with a LangGraph router, files GitHub issues or Zendesk tickets, and confirms in the thread.

Engineering Teams

Engineering standup agent

Pulls commits from GitHub and GitLab, tracks issue movement in Jira, and posts a per-engineer standup brief to Slack. Each engineer's activity is read on their own delegated OAuth.

Engineering Teams

Auto release notes agent

Reads merged GitHub PRs, groups them into structured release notes, publishes the page to Notion, and announces the release in Slack. Every call runs on the engineer's own delegated OAuth.

Why Scalekit

Secure your agent's access. Connectors ship in minutes

01.

Shared tokens break per-user analytics

A shared Semaphore CI token looks fine in a demo. In production every triggered build and rerun looks like one service account, and you cannot tell who shipped what. Scalekit resolves the credential of the actual user who triggered the agent, never a shared bot.

// shared token
audit → bot_service_account

// scalekit
audit → user_abc ✓

02.

Authentication is not authorization

03.

Multi-tenancy is architectural

04.

Semaphore CI today. Others tomorrow.

“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”

Venu Madhav Kattagoni

Head of Engineering / Von

FAQs

Frequently Asked Questions

Does the agent access Semaphore CI as the user or through a shared key?

As the user. Scalekit resolves the credential of the person who triggered the agent at request time, so every workflow run, rerun, and log read in your audit trail is attributed to a real user, not a shared service account.

Where is the Semaphore CI token stored?

In an AES-256 encrypted vault with per-tenant namespacing. Tokens are resolved at request time, never enter LLM context, refresh automatically, and can be revoked from one dashboard.

Can I limit what the agent does in Semaphore CI?

Yes. Filter by tool name in listScopedTools to expose only what you want, for example read-only build inspection without workflows_run or workflows_rerun. Scalekit also enforces scope checks before every API call.

What happens when a user revokes access?

The credential is invalidated at the next tool call. The call fails closed, other users' connections are unaffected, and the revocation is logged in the audit chain.

My users belong to multiple Semaphore organizations. Which one does the agent act in?

Every tool call carries an organization_id, and the user's own credential decides which organizations it can reach. An agent can only search projects or trigger builds in orgs that user already belongs to, and each call is logged with both the user and the organization.

On this page

Tool and actions Framework Compatibility Starter Prompt Auth Lifecycle Try Other Agents Why Scalekit