CloudBees CI

CloudBees CI is the enterprise continuous integration product from CloudBees, built on Jenkins. A product update post describes two capabilities in its September 30, 2026 release: OAuth authentication for the CloudBees CI MCP Router, and CloudBees Mask Secrets, now generally available.

What It Is

CloudBees CI runs Jenkins-based pipelines across many controllers and adds enterprise management on top. The MCP Router gives AI agents a single Model Context Protocol endpoint covering all controllers in a CloudBees CI cluster, routing each request to the controllers the signed-in user can access. Mask Secrets is a plugin that hides credentials that pipelines generate at runtime.

How Agent Access Works

With OAuth, a developer points an AI agent at the Router, signs in through a browser with their existing CloudBees CI identity, and approves access for the client. The agent receives a short-lived access token and a refresh token, so no long-lived API token is written to a configuration file. Sign-in uses the security realm already configured (LDAP, SAML, OIDC or the built-in user database). Users can view and revoke authorized AI clients from their user profile. The Router obtains a separate short-lived token per controller, so the agent's token never leaves the Router.

Administrators choose a Router mode: legacy passthrough (API tokens only), coexistence (OAuth and API tokens side by side), or OAuth-only. The documentation lists connection guides for Claude Code, GitHub Copilot, Goose and Kiro.

Masking Runtime Secrets

Mask Secrets matches patterns instead of known values, so it catches tokens minted during a build. Stock patterns cover AWS STS access key IDs, AWS secret access keys, session tokens, ECR login tokens, GCP OAuth tokens and JWTs. Custom patterns are Java regular expressions, and a Fail build on match option fails any build that prints a matching secret. Administrators configure patterns once on the controller, with no pipeline changes. CloudBees describes masking as a best-effort safety net: transformed values such as Base64-encoded secrets are not matched, and a malicious pipeline author can bypass it. The plugin requires CloudBees CI 2.528.1.29783 or later.