kevinveenbirkenbachandClaude Opus 5 21888ef9a2 feat(jenkins): authenticate MCP callers through the adapter ...

The controller serves its MCP plugin endpoint to anonymous callers: the
deploy probe measured a 200, and the response carried the base64 of
'anonymous' in its reporting endpoint. The JCasC authorization strategy
grants anonymous nothing, so the plugin does not hang off it.

Front it with the svc-ai-mcp-adapter instance. Clients present mcp_bearer
to compose service jenkinsmcp and get a 401 otherwise; the adapter
presents the controller's own API token upstream over HTTP Basic.

Narrow the allowlist to the 15 read-only tools and record the 19 the
plugin serves as upstream_serves. The four write tools were advertised
while mutating_tools_enabled stayed false, so the adapter would have
refused them at call time: a dead surface a green deploy hides.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-18 11:44:30 +02:00

..

tools.json

…