Drone CI/CD MCP Server

io.github.yusiwen由 GitHub 账号 yusiwen 发布v2.0.0更新于 Oct 24, 2026

MCP server for Drone CI/CD: 45 tools for builds, repos, secrets, users and templates

已验证STDIO仅桌面云端与基础设施开发者工具

概览

AI 生成的概览

面向 Drone CI/CD 的 MCP 服务器，让助手查询仓库、构建、定时任务、密钥、用户和模板，并可选用写入工具。

可以做什么
  • 列出并查看仓库，包括构建未完成的仓库
  • 列出构建、查看构建详情、按分支查看最近一次构建，以及阶段和步骤日志
  • 查看定时任务、密钥、用户和模板
  • 启用写入工具后：启用、禁用、修复、变更归属和同步仓库
  • 启用写入工具后：创建、删除和执行定时任务；创建、更新和删除仓库级与组织级密钥
  • 启用写入工具后：重启、取消、晋升、回滚、批准、拒绝和创建构建；管理用户和模板
适用场景
适合让助手回答 Drone CI 实例上的问题，例如哪些构建失败、构建日志内容、哪些仓库已启用；开启写入工具后，也可在对话中触发和管理构建与配置。
运行要求
以本地进程运行（Go 二进制、预编译版本或 ghcr.io 容器镜像），默认使用 stdio。需要 DRONE_SERVER（Drone 实例的基础地址）和 DRONE_TOKEN（Drone 个人访问令牌）。HTTP 模式还需 MCP_AUTH_TOKEN 或 MCP_AUTH_TOKEN_FILE。需要能访问 Drone 实例的网络。
安装前请注意
DRONE_TOKEN 是随每次 Drone API 调用发送的高权限凭据，应授予最小权限。写入和破坏性工具（删除、取消、晋升、回滚、变更归属、创建密钥等）默认关闭，需用 --enable-write-tools 或 MCP_ENABLE_WRITE_TOOLS 开启，部分需要管理员权限。密钥工具以参数形式接收密钥值。HTTP 模式是特权代理：妥善保管 bearer 令牌、前置 TLS，并避免使用 --insecure-allow-anonymous。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Drone CI/CD MCP Server，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

Drone MCP Server

A Model Context Protocol (MCP) server for interacting with Drone CI/CD. This server provides tools and resources to query build information, repositories, and more from your Drone instance.

Features

  • 45 tools covering repositories, builds, cron jobs, secrets, users and templates
  • Read-only by default: the 27 write and destructive tools are only registered with --enable-write-tools
  • Streamable HTTP transport with mandatory bearer authentication, DNS rebinding protection and cross-origin protection
  • Validated inputs: repository identifiers, names, branches and build numbers are checked before they reach the Drone API
  • Resource access: build details via drone://builds/{owner}/{repo}/{build}

Installation

bash
go mod tidygo build -o drone-mcp-server .

Configuration

Environment variables

VariableRequiredDescription
DRONE_SERVERyesBase URL of the Drone instance, e.g. https://drone.example.com
DRONE_TOKENyesDrone personal access token, sent as Authorization: Bearer <token> on every Drone API call
MCP_AUTH_TOKENHTTP modeBearer token that clients must present. HTTP mode refuses to start without it
MCP_AUTH_TOKEN_FILEnoFile containing the bearer token (Docker/Kubernetes secrets). Takes precedence over MCP_AUTH_TOKEN
MCP_ENABLE_WRITE_TOOLSnotrue registers the write and destructive tools, equivalent to --enable-write-tools
bash
export DRONE_SERVER=https://drone.example.comexport DRONE_TOKEN=your_drone_tokenexport MCP_AUTH_TOKEN="$(openssl rand -base64 32)"   # HTTP mode only

Grant the smallest Drone permission set that covers the tools you expose. The read-only tool set only needs read access to repositories and builds, while write tools such as delete_user, create_org_secret or chown_repo require administrator permissions.

Security

This server is a privileged proxy: whatever it can reach, anyone who can talk to it can reach too. The defaults reflect that.

  • HTTP mode fails closed. Without MCP_AUTH_TOKEN (or MCP_AUTH_TOKEN_FILE) the server refuses to start in HTTP mode. --insecure-allow-anonymous overrides this and logs a warning.
  • Read-only by default. Only the 18 read-only tools are registered unless write access is requested explicitly. Every tool is annotated with the MCP hints readOnlyHint, destructiveHint and idempotentHint so clients can gate writes themselves.
  • Streamable HTTP transport. The legacy SSE transport was removed from the MCP specification and shipped without DNS rebinding or cross-origin protection. This server uses the Go SDK's StreamableHTTPHandler, which rejects requests that arrive on a loopback address with a non-loopback Host header and rejects cross-site browser requests.
  • Optional allowlists. --allowed-hosts and --allowed-origins add explicit Host and Origin allowlists on top of the transport defaults.
  • Bearer token handling. Tokens are compared in constant time over SHA-256 digests, and repeated failures from one address are throttled (10 per minute, then 429).
  • Input validation. Repository identifiers, secret and template names, branches and build numbers are validated before reaching the Drone API client, because drone-go assembles request paths by string formatting.
  • Log hygiene. X-Forwarded-For / X-Real-IP are ignored unless --trust-proxy is set, and control characters are stripped from logged values so request data cannot forge log lines.
  • Bounded requests. Request bodies are capped (1 MiB by default), idle sessions expire, and header read timeouts plus silent-connection timeouts limit slow-client abuse.

Deployment checklist

  1. Terminate TLS in front of the server (the binary speaks plain HTTP) and never send the bearer token over an untrusted network.
  2. Keep the loopback default binding and put a reverse proxy in front, or bind to an interface only your MCP clients can reach.
  3. Generate a high-entropy MCP_AUTH_TOKEN (32+ random bytes) and inject it as a platform secret rather than on the command line.
  4. Leave write tools disabled unless the workflow needs them.
  5. Set --trust-proxy only when a proxy you control rewrites X-Forwarded-For / X-Real-IP; otherwise the logged client address is attacker controlled.
  6. Read SECURITY.md before exposing the server beyond localhost.

Usage

As an MCP server

Add the server to your MCP client configuration (e.g., Claude Desktop):

json
{  "mcpServers": {    "drone": {      "command": "/path/to/drone-mcp-server",      "env": {        "DRONE_SERVER": "https://drone.example.com",        "DRONE_TOKEN": "your_token"      }    }  }}

Direct execution

You can run the server directly for testing:

bash
# Stdio mode (default) - for local MCP clients./drone-mcp-server
# Streamable HTTP mode - requires MCP_AUTH_TOKENexport MCP_AUTH_TOKEN="$(openssl rand -base64 32)"./drone-mcp-server --http --host localhost --port 8080
Transport Modes

  1. Stdio mode (default): Communicates via stdin/stdout using the MCP protocol. Suitable for local integration with MCP clients; no network exposure and no authentication required.

  2. Streamable HTTP mode (--http): A single endpoint that accepts POST (client to server), GET (server to client stream) and DELETE (session teardown).

    Upgrading from earlier releases: the old --sse flag and the SSE transport are gone. Use --http and a client that speaks Streamable HTTP.

    bash
    # Local only, read-only toolsMCP_AUTH_TOKEN=... ./drone-mcp-server --http
# Behind a TLS terminating proxy, write tools enabledMCP_AUTH_TOKEN=... ./drone-mcp-server --http --host 127.0.0.1 --port 8080 \    --enable-write-tools --allowed-hosts mcp.example.com

    Clients connect to http://localhost:8080/ by default and must send the header:

    Authorization: Bearer <MCP_AUTH_TOKEN>

    Behind a reverse proxy: the transport rejects a public Host header on a loopback connection with 403 as part of its DNS rebinding protection. Either keep the loopback Host header (proxy_set_header Host 127.0.0.1:8080;), or hand Host validation to the allowlist with a single flag:

    bash
    ./drone-mcp-server --http --allowed-hosts mcp.example.com

    Setting --allowed-hosts replaces the loopback heuristic, so you do not need --localhost-protection=false. If you pass --localhost-protection=true explicitly, both checks are applied and the public Host is rejected again.

Command line flags
FlagDefaultDescription
--httpfalseUse the Streamable HTTP transport
--host / --portlocalhost / 8080Listen address (HTTP mode only)
--path/Path of the MCP endpoint (HTTP mode only)
--enable-write-toolsfalseRegister the 27 write and destructive tools
--insecure-allow-anonymousfalseAllow HTTP mode without MCP_AUTH_TOKEN
--trust-proxyfalseTrust X-Forwarded-For / X-Real-IP from a reverse proxy
--allowed-hosts(empty)Comma-separated Host allowlist; replaces the loopback heuristic
--allowed-origins(empty)Comma-separated browser Origin allowlist
--localhost-protectiontrueReject loopback connections carrying a non-loopback Host header; set explicitly together with --allowed-hosts to stack both checks
--session-timeout30mIdle MCP session timeout (HTTP mode only)
--max-request-bytes1048576Maximum MCP request body size
--versionPrint version information and exit

Available Tools

The server implements 45 tools. In the default read-only mode only the 18 read-only tools are registered; the remaining 27 are write or destructive tools and require --enable-write-tools (or MCP_ENABLE_WRITE_TOOLS=true).

Write and destructive tools: enable_repo, disable_repo, repair_repo, chown_repo, sync_repos, create_cron, delete_cron, execute_cron, create_secret, update_secret, delete_secret, create_org_secret, update_org_secret, delete_org_secret, create_user, update_user, delete_user, create_template, update_template, delete_template, restart_build, cancel_build, promote_build, rollback_build, approve_build, decline_build, create_build.

The destructive ones (deletions, disables, cancellations, promotions, rollbacks, ownership changes) are advertised with destructiveHint: true; the rest of the write tools with destructiveHint: false. All 18 read-only tools are advertised with readOnlyHint: true.

Repository Management

list_repos

Lists all repositories in your Drone instance.

get_repo

Get repository details.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
enable_repo

Enable a repository.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
disable_repo

Disable a repository.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
repair_repo

Repair a repository.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
chown_repo

Change repository ownership.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
sync_repos

Synchronize repository list.

list_incomplete

List repositories with incomplete builds.

Build Management

list_builds

Lists builds for a specific repository.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
get_build

Get detailed information about a specific build.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • build (number): Build number
get_build_last

Get the last build for a repository (optionally by branch).

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • branch (string, optional): Branch name
get_build_logs

Get logs for a specific build stage and step.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • build (number): Build number
  • stage (number): Stage number
  • step (number): Step number
restart_build

Restart a build (optionally with parameters).

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • build (number): Build number
  • params (object, optional): Build parameters
cancel_build

Cancel a running build.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • build (number): Build number
promote_build

Promote a build to a target environment.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • build (number): Build number
  • target (string): Target environment
  • params (object, optional): Promotion parameters
rollback_build

Rollback a deployment to a previous build.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • build (number): Build number
  • target (string): Target environment
  • params (object, optional): Rollback parameters
approve_build

Approve a build stage (for gated deployments).

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • build (number): Build number
  • stage (number): Stage number
decline_build

Decline a build stage (for gated deployments).

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • build (number): Build number
  • stage (number): Stage number
create_build

Create a new build from a commit or branch.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • commit (string, optional): Commit SHA
  • branch (string, optional): Branch name
  • params (object, optional): Build parameters

Cron Job Management

list_crons

List cron jobs for a repository.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
get_cron

Get cron job details.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • cron (string): Cron job name
create_cron

Create a new cron job.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • name (string): Cron job name
  • expr (string): Cron expression
  • branch (string): Branch name
  • disable (boolean, optional): Disable the cron job
delete_cron

Delete a cron job.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • cron (string): Cron job name
execute_cron

Execute a cron job immediately.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • cron (string): Cron job name

Secret Management

list_secrets

List repository secrets.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
get_secret

Get repository secret details.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • name (string): Secret name
create_secret

Create a repository secret.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • name (string): Secret name
  • value (string): Secret value
  • pull_request (boolean, optional): Allow in pull requests
  • pull_request_push (boolean, optional): Allow in pull request push events
update_secret

Update a repository secret.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • name (string): Secret name
  • value (string): Secret value
  • pull_request (boolean, optional): Allow in pull requests
  • pull_request_push (boolean, optional): Allow in pull request push events
delete_secret

Delete a repository secret.

Arguments:

  • owner (string): Repository owner
  • repo (string): Repository name
  • name (string): Secret name
Organization Secrets
list_org_secrets

List organization secrets.

Arguments:

  • namespace (string): Organization namespace
get_org_secret

Get organization secret details.

Arguments:

  • namespace (string): Organization namespace
  • name (string): Secret name
create_org_secret

Create an organization secret.

Arguments:

  • namespace (string): Organization namespace
  • name (string): Secret name
  • value (string): Secret value
  • pull_request (boolean, optional): Allow in pull requests
  • pull_request_push (boolean, optional): Allow in pull request push events
update_org_secret

Update an organization secret.

Arguments:

  • namespace (string): Organization namespace
  • name (string): Secret name
  • value (string): Secret value
  • pull_request (boolean, optional): Allow in pull requests
  • pull_request_push (boolean, optional): Allow in pull request push events
delete_org_secret

Delete an organization secret.

Arguments:

  • namespace (string): Organization namespace
  • name (string): Secret name

User Management

get_self

Get current authenticated user.

list_users

List all users.

get_user

Get user details.

Arguments:

  • login (string): User login name
create_user

Create a new user.

Arguments:

  • login (string): User login name
  • email (string, optional): User email
  • admin (boolean, optional): Admin privileges
  • active (boolean, optional): Active status
  • token (string, optional): User token
update_user

Update a user.

Arguments:

  • login (string): User login name
  • admin (boolean, optional): Admin privileges
  • active (boolean, optional): Active status
delete_user

Delete a user.

Arguments:

  • login (string): User login name

Template Management

list_templates

List templates (optionally by namespace).

Arguments:

  • namespace (string, optional): Template namespace
get_template

Get template details and data.

Arguments:

  • namespace (string): Template namespace
  • name (string): Template name
create_template

Create a new template.

Arguments:

  • namespace (string): Template namespace
  • name (string): Template name
  • data (string): Template data (YAML)
update_template

Update a template.

Arguments:

  • namespace (string): Template namespace
  • name (string): Template name
  • data (string): Template data (YAML)
delete_template

Delete a template.

Arguments:

  • namespace (string): Template namespace
  • name (string): Template name

Resources

Build details resource

Access build details via resource URI: drone://builds/{owner}/{repo}/{build}

Example:

Read resource: drone://builds/owner1/repo1/123

Docker

A multi-architecture Docker image is available on GitHub Container Registry:

bash
# Pull the latest imagedocker pull ghcr.io/yusiwen/drone-mcp-server:latest
# Run in stdio mode (for local MCP clients)docker run --rm -i \           -e DRONE_SERVER=https://drone.example.com \           -e DRONE_TOKEN=your_token \           ghcr.io/yusiwen/drone-mcp-server
# Run in Streamable HTTP mode: read-only, authenticated, published on loopbackdocker run --rm \           -e DRONE_SERVER=https://drone.example.com \           -e DRONE_TOKEN=your_token \           -e MCP_AUTH_TOKEN=your_mcp_token \           -p 127.0.0.1:8080:8080 \           ghcr.io/yusiwen/drone-mcp-server --http --host 0.0.0.0
# Add --enable-write-tools when the workflow must mutate Dronedocker run --rm \           -e DRONE_SERVER=https://drone.example.com \           -e DRONE_TOKEN=your_token \           -e MCP_AUTH_TOKEN=your_mcp_token \           -p 127.0.0.1:8080:8080 \           ghcr.io/yusiwen/drone-mcp-server --http --host 0.0.0.0 --enable-write-tools

--host 0.0.0.0 is required inside a container so that published ports work, which is exactly why the bearer token is mandatory. Publish the port on 127.0.0.1 unless a TLS terminating proxy sits in front.

Prefer a mounted secret over an environment variable:

bash
docker run --rm \           -v /run/secrets/mcp_token:/run/secrets/mcp_token:ro \           -e MCP_AUTH_TOKEN_FILE=/run/secrets/mcp_token \           -e DRONE_SERVER=https://drone.example.com \           -e DRONE_TOKEN=your_token \           -p 127.0.0.1:8080:8080 \           ghcr.io/yusiwen/drone-mcp-server --http --host 0.0.0.0

Docker Compose Example

yaml
services:  drone-mcp-server:    image: ghcr.io/yusiwen/drone-mcp-server:latest    environment:      DRONE_SERVER: https://drone.example.com      DRONE_TOKEN: ${DRONE_TOKEN:?DRONE_TOKEN is required}      MCP_AUTH_TOKEN: ${MCP_AUTH_TOKEN:?MCP_AUTH_TOKEN is required}      # MCP_ENABLE_WRITE_TOOLS: "true"   # only when the workflow needs writes    ports:      - "127.0.0.1:8080:8080"    command: ["--http", "--host", "0.0.0.0"]    restart: unless-stopped    read_only: true    security_opt:      - no-new-privileges:true

Releases

Pre-built binaries are available for Linux (x64, arm64), macOS (x64, arm64), and Windows (x64) in the GitHub Releases.

Version Information

The binary includes version information:

bash
./drone-mcp-server --version

Output example:

drone-mcp-serverVersion: v1.0.0Commit: abc123Build date: 2024-01-01T00:00:00ZGo version: go1.25.1

Project Structure

.├── main.go              # Entry point: CLI flags, transports, auth, HTTP hardening, tool registration├── main_test.go         # Auth middleware, allowlists, log hygiene and tool registration tests├── tool/                # Tool handlers module│   ├── build.go         # Build-related tools (list_builds, get_build, restart_build, etc.)│   ├── repo.go          # Repository-related tools (list_repos, enable_repo, disable_repo, etc.)│   ├── resource.go      # Resource handling (drone://builds/...)│   ├── cron.go          # Cron job management tools│   ├── secret.go        # Secret management tools│   ├── user.go          # User management tools│   ├── template.go      # Template management tools│   ├── validate.go      # Input validation helpers used by every tool│   ├── validate_args.go # Validate implementation for each tool argument struct│   └── validate_test.go # Validation tests, including injection attempts├── SECURITY.md          # Threat model, deployment guidance and reporting process├── server.json          # MCP registry metadata├── test_env.sh          # Manual smoke test script (uses environment variables)├── test_mcp.go          # In-memory MCP integration test (build tag: test)└── README.md

Development

Dependencies

Building

bash
make build           # build with version info injected through ldflagsgo build -o drone-mcp-server .

Testing

bash
make test                                  # unit testsmake test-race                             # with the race detectormake smoke                                 # end-to-end security smoke testmake vuln                                  # govulncheck (module + standard library)go vet ./...

The unit tests cover the authentication middleware (including constant time comparison and failure throttling), the Host policy, log sanitization, client address handling, input validation and the read-only tool registration. They need no Drone instance.

Verifying the security hardening

scripts/security-smoke-test.sh starts the real binary on a loopback port and asserts the behaviour that matters, without contacting any Drone instance:

bash
./scripts/security-smoke-test.sh          # builds the binary firstBIN=./drone-mcp-server ./scripts/security-smoke-test.sh

It checks that HTTP mode refuses to start without a token, that missing/wrong credentials, wrong Content-Type, oversized bodies, forged Host headers and cross-site Origin are rejected with 401/401/415/413/403/403, that the default tool list is exactly 18 read-only tools and that hidden write tools are not callable, that path traversal in tool arguments is refused, that log injection and X-Forwarded-For spoofing are neutralised, that --allowed-hosts replaces the loopback heuristic, that write tools appear only with --enable-write-tools, that --sse is gone, and that SIGTERM shuts the server down. It exits non-zero on the first failure set and runs in CI, so it doubles as a regression gate.

Manual verification against a real Drone

Use a read-only token first and confirm the tools answer:

bash
export DRONE_SERVER=https://ci.example.comexport DRONE_TOKEN=<read-only token>export MCP_AUTH_TOKEN="$(openssl rand -base64 32)"./drone-mcp-server --http --host 127.0.0.1 --port 8080

Then point an MCP client at it. Stdio mode:

json
{  "mcpServers": {    "drone": {      "command": "/path/to/drone-mcp-server",      "env": { "DRONE_SERVER": "https://ci.example.com", "DRONE_TOKEN": "..." }    }  }}

Streamable HTTP mode (most clients accept a headers block; npx @modelcontextprotocol/inspector works too, pick "Streamable HTTP" and add the same header):

json
{  "mcpServers": {    "drone": {      "url": "http://127.0.0.1:8080/",      "headers": { "Authorization": "Bearer <MCP_AUTH_TOKEN>" }    }  }}

Suggested checks against a real instance: get_self (confirms the token works), list_repos, get_build_last, get_build_logs (exercises untrusted content in the model context), then get_repo with owner: "../users" to confirm validation refuses it. Run write tools against a disposable repository only.

Running locally

bash
export DRONE_SERVER=https://drone.example.comexport DRONE_TOKEN=...
# Read-only stdio server./drone-mcp-server
# HTTP mode with authentication and write toolsMCP_AUTH_TOKEN=dev-token ./drone-mcp-server --http --enable-write-tools

License

MIT

来源：README.md，提交 e67cec7

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

2
  1. v2.0.0最新Sep 18, 2026
  2. v1.0.0Sep 16, 2026

评分

已满足适用检查项的 40%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。