Semaphore CI MCP

Live

OAUTH 2.1

CI PIPELINES

Developer Tools

Semaphore CI MCP gives agents authenticated access to your CI pipelines: search workflows, trigger and rerun builds, and read job logs and test results.

  • Per-user credentials: each call uses the actual user's token, never a shared bot.
  • Encrypted per-tenant vault: AES-256, resolved at request time, never in LLM context.
  • Scoped before every call: pre-call scope check, 90-day SIEM-exportable audit chain.
Semaphore CI MCP
agent · Acme Q3
Run
Why did the main branch build fail this morning?
S
semaphorecimcp_workflows_search
88ms
Semaphore CI agent
The 09:14 UTC run on main failed at the test job. 3 of 412 tests failed in checkout_spec.rb, all timeouts against the payments stub. The 2 runs before it passed.
Sources: 5 workflows, project api-core
semaphorecimcp
5 workflows
18:29
Message Claude...

Tools your build agent reaches for on Semaphore CI, scoped per user.

CALL ANY TOOL
Operate CI pipelines end to end: search workflows, trigger and rerun builds, list pipeline jobs, and pull logs and test results.
semaphorecimcp_workflows_search
Search workflows
Search recent Semaphore CI workflows for a project, most recent first. Filter by branch or requester, or return only workflows the authenticated user triggered.
Parameters
Name
Type
Required
Description
organization_id
string
Required
UUID of the organization that owns the project.
project_id
string
Required
UUID of the project to search workflows for.
branch
string
Optional
Filter workflows by git branch name.
my_workflows_only
boolean
Optional
If true, return only workflows triggered by the authenticated user.
semaphorecimcp_workflows_run
Run a workflow
semaphorecimcp_workflows_rerun
Rerun a workflow
semaphorecimcp_pipelines_list
List pipelines
semaphorecimcp_pipeline_jobs
List pipeline jobs
semaphorecimcp_jobs_logs
Get job logs
semaphorecimcp_get_test_results
Get test results
semaphorecimcp_projects_list
List projects
Build your Agent
Same auth pattern across LangChain, OpenAI, Anthropic, and Google ADK.
Python · LlamaIndex
import { ScalekitClient } from "@scalekit-sdk/node";
import { createReactAgent } from "@langchain/langgraph/prebuilt";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// Semaphore CI tools scoped to this user
const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["semaphorecimcp"], toolNames: [
    "semaphorecimcp_workflows_search",
    "semaphorecimcp_jobs_logs",
    "semaphorecimcp_workflows_rerun"] },
  pageSize: 100,
});

const agent = createReactAgent({ llm, tools });
await agent.invoke({ messages: [{ role: "user", content: "Why did the main branch build fail?" }] });
import OpenAI from "openai";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["semaphorecimcp"] }, pageSize: 100,
});

const res = await openai.chat.completions.create({
  model: "gpt-5",
  messages: [{ role: "user", content: "Which workflows failed on main today?" }],
  tools,
});

// Execute the tool call with the user's vaulted Semaphore CI credential
await sk.tools.executeTool(res.choices[0].message.tool_calls[0], "user_123");
import Anthropic from "@anthropic-ai/sdk";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["semaphorecimcp"] }, pageSize: 100,
});

const msg = await anthropic.messages.create({
  model: "claude-sonnet-5",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Pull the logs for the failed deploy job." }],
  tools,
});

// Tool call runs with the user's vaulted Semaphore CI credential
await sk.tools.executeTool(msg.content, "user_123");
import { Agent } from "@google/adk/agents";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["semaphorecimcp"] }, pageSize: 100,
});

const agent = new Agent({
  name: "semaphore_ci_agent",
  model: "gemini-2.5-pro",
  instruction: "Manage Semaphore CI pipelines for the signed-in user.",
  tools,
});

await agent.run("Summarize test results for the latest pipeline.");
Try these prompts
Copy any prompt into your agent. Each maps directly to a Semaphore CI tool. Click to copy, paste into your agent, done.
Build health
Copy the prompt
Copied
Which workflows ran on main today, and did any fail?
Copy the prompt
Copied
List the jobs in the latest pipeline for api-core and flag failures.
Copy the prompt
Copied
Pull the logs for the job that failed this morning.
Trigger and rerun
Copy the prompt
Copied
Rerun the last failed workflow on main.
Copy the prompt
Copied
Schedule a workflow run for refs/heads/release/2.4 on the deploy project.
Copy the prompt
Copied
Run the billing pipeline against commit 9f3c2a1 with STAGE=staging.
Tests and diagnostics
Copy the prompt
Copied
Summarize test results for the latest pipeline on main.
Copy the prompt
Copied
Which specs failed in the last nightly run, and how long did they take?
Copy the prompt
Copied
List projects in the acme org and their most recent workflow status.
SEE HOW AUTH WORKS
Your users connect once. Their Semaphore CI credentials stay vaulted, every call is scope-checked, and every action is logged.
1
Authorize
Your user connects
Semaphore CI MCP
once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access
Who:
user ‘A’
when:
Once per user
access:
Limited to user
2
Store
Their
Semaphore CI MCP
token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection
vault:
encrypted
scope:
per-user
tokens:
auto-refreshed
3
Resolve
When your agent calls a
Semaphore CI MCP
tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs
speed:
~40ms
check:
before every call
seen by:
nobody
4
Audit
Every
Semaphore CI MCP
tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it
history:
90 days
export:
SIEM-ready
logged:
every call
Test other agents
See the same per-user auth pattern across other developer tool connectors.
ENGINEERING
Auto-release notes agent
Group merged GitHub PRs by feature, fix, or chore and publish release notes per tag. No manual changelog grooming.
ENGINEERING
DevOps assistant agent
Triage GitHub incidents, open Linear tickets, and notify the on-call channel in Slack with context already attached.
ENGINEERING
Engineering standup agent
Aggregate GitHub and GitLab activity, link to Jira, and post a daily standup digest to Slack. No async updates.
Why Scalekit
Secure your agent's access. Connectors ship in minutes
Other connector libraries treat auth as a demo afterthought. Scalekit starts with identity, scope enforcement, and audit. Connectors follow.
01.
Shared tokens break per-user analytics
A shared Semaphore CI token looks fine in a demo. In production every triggered build and rerun looks like one service account, and you cannot tell who shipped what. Scalekit resolves the credential of the actual user who triggered the agent, never a shared bot.
// shared token
audit → bot_service_account

// scalekit
audit → user_abc ✓
02.
Authentication is not authorization
03.
Multi-tenancy is architectural
04.
Semaphore CI today. Others tomorrow.
“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”
Venu Madhav Kattagoni
Head of Engineering / Von
FAQs
Frequently Asked Questions
Does the agent access Semaphore CI as the user or through a shared key?
As the user. Scalekit resolves the credential of the person who triggered the agent at request time, so every workflow run, rerun, and log read in your audit trail is attributed to a real user, not a shared service account.
Where is the Semaphore CI token stored?
In an AES-256 encrypted vault with per-tenant namespacing. Tokens are resolved at request time, never enter LLM context, refresh automatically, and can be revoked from one dashboard.
Can I limit what the agent does in Semaphore CI?
Yes. Filter by tool name in listScopedTools to expose only what you want, for example read-only build inspection without workflows_run or workflows_rerun. Scalekit also enforces scope checks before every API call.
What happens when a user revokes access?
The credential is invalidated at the next tool call. The call fails closed, other users' connections are unaffected, and the revocation is logged in the audit chain.
My users belong to multiple Semaphore organizations. Which one does the agent act in?
Every tool call carries an organization_id, and the user's own credential decides which organizations it can reach. An agent can only search projects or trigger builds in orgs that user already belongs to, and each call is logged with both the user and the organization.
Start in your coding agent
Up and running in one command
Install the Scalekit skill in your editor of choice. Connector, auth, tools, prompt, all wired up
Claude Code REPL
/plugin marketplace add scalekit-inc/claude-code-authstack
/plugin install agentkit@scalekit-auth-stack
Cursor Code REPL
# ~/.cursor/mcp.json
{
""mcpServers"": {
""semaphorecimcp"": {
""url"": ""https://mcp.scalekit.com/semaphorecimcp"",
""headers"": { ""Authorization"": ""Bearer $SCALEKIT_TOKEN"" }
}
}
}
Codex Code REPL
# ~/.codex/config.toml
[mcp_servers.semaphorecimcp]
url = ""https://mcp.scalekit.com/semaphorecimcp""
auth_env = ""SCALEKIT_TOKEN""
Copilot Code REPL
# .vscode/mcp.json
{
""servers"": {
""semaphorecimcp"": {
""url"": ""https://mcp.scalekit.com/semaphorecimcp"",
""type"": ""http""
}
}
}