Pin the MCP Server plugin and let a boot hook mint the API token MCP
clients present, then take that token over into sys-token-store and
verify it against the controller before the deploy continues.
Wait for the controller to answer before probing. A JCasC change restarts
Jenkins, and the probe carries no retries of its own, so a single 5xx
during startup failed the deploy with a credential that was valid all
along.
Authenticate with HTTP Basic. The plugin offers no bearer, which is why
basic_auth entered the service contract instead of the role working
around it.
Assert the guarded surface, not the handshake: the plugin answers
initialize anonymously because that call is capability negotiation and
carries no data, while an unauthenticated tools/list is refused and
leaks no tool inventory.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5