# CloudBees CI

> Enterprise Jenkins-based CI platform from CloudBees with an MCP Router using OAuth for AI agents and a Mask Secrets plugin for build logs.

CloudBees CI is the enterprise continuous integration product from CloudBees, built on Jenkins. A product update post describes two capabilities in its September 30, 2026 release: OAuth authentication for the CloudBees CI MCP Router, and CloudBees Mask Secrets, now generally available.

## What It Is

CloudBees CI runs Jenkins-based pipelines across many controllers and adds enterprise management on top. The MCP Router gives AI agents a single Model Context Protocol endpoint covering all controllers in a CloudBees CI cluster, routing each request to the controllers the signed-in user can access. Mask Secrets is a plugin that hides credentials that pipelines generate at runtime.

## How Agent Access Works

With OAuth, a developer points an AI agent at the Router, signs in through a browser with their existing CloudBees CI identity, and approves access for the client. The agent receives a short-lived access token and a refresh token, so no long-lived API token is written to a configuration file. Sign-in uses the security realm already configured (LDAP, SAML, OIDC or the built-in user database). Users can view and revoke authorized AI clients from their user profile. The Router obtains a separate short-lived token per controller, so the agent's token never leaves the Router.

Administrators choose a Router mode: legacy passthrough (API tokens only), coexistence (OAuth and API tokens side by side), or OAuth-only. The documentation lists connection guides for Claude Code, GitHub Copilot, Goose and Kiro.

## Masking Runtime Secrets

Mask Secrets matches patterns instead of known values, so it catches tokens minted during a build. Stock patterns cover AWS STS access key IDs, AWS secret access keys, session tokens, ECR login tokens, GCP OAuth tokens and JWTs. Custom patterns are Java regular expressions, and a Fail build on match option fails any build that prints a matching secret. Administrators configure patterns once on the controller, with no pipeline changes. CloudBees describes masking as a best-effort safety net: transformed values such as Base64-encoded secrets are not matched, and a malicious pipeline author can bypass it. The plugin requires CloudBees CI 2.528.1.29783 or later.

## Features
- MCP Router with a single endpoint for all CloudBees CI controllers
- OAuth sign-in for AI agents using the existing security realm
- Short-lived, revocable agent access with per-controller tokens
- Router modes: legacy passthrough, coexistence, OAuth-only
- Mask Secrets plugin with pattern-based log masking
- Stock patterns for AWS, GCP, ECR and JWT credentials
- Custom Java regex masking patterns
- Fail build on match option for secret exposure
- Central configuration via Configuration as Code

## Integrations
Jenkins, Claude Code, GitHub Copilot, Goose, Kiro, AWS, GCP, LDAP, SAML, OIDC, Model Context Protocol

## Platforms
WINDOWS, WEB, API

## Pricing
Paid

## Links
- Website: https://www.cloudbees.com/blog/build-at-ai-speed-on-cloudbees-ci-without-leaking-secrets
- Documentation: https://docs.cloudbees.com/
- EveryDev.ai: https://www.everydev.ai/tools/cloudbees-ci