Drone CI/CD MCP Server

Drone MCP Server

A Model Context Protocol (MCP) server for interacting with Drone CI/CD. This server provides tools and resources to query build information, repositories, and more from your Drone instance.

Features

• 45 tools covering repositories, builds, cron jobs, secrets, users and templates
• Read-only by default: the 27 write and destructive tools are only registered with --enable-write-tools
• Streamable HTTP transport with mandatory bearer authentication, DNS rebinding protection and cross-origin protection
• Validated inputs: repository identifiers, names, branches and build numbers are checked before they reach the Drone API
• Resource access: build details via drone://builds/{owner}/{repo}/{build}

Installation

go mod tidy

go build -o drone-mcp-server .

Configuration

Environment variables

export DRONE_SERVER=https://drone.example.com

export DRONE_TOKEN=your_drone_token export MCP_AUTH_TOKEN="$(openssl rand -base64 32)" # HTTP mode only

Grant the smallest Drone permission set that covers the tools you expose. The read-only tool set only needs read access to repositories and builds, while write tools such as delete_user, create_org_secret or chown_repo require administrator permissions.

Security

This server is a privileged proxy: whatever it can reach, anyone who can talk to it can reach too. The defaults reflect that.

• HTTP mode fails closed. Without MCP_AUTH_TOKEN (or MCP_AUTH_TOKEN_FILE) the server refuses to start in HTTP mode. --insecure-allow-anonymous overrides this and logs a warning.
• Read-only by default. Only the 18 read-only tools are registered unless write access is requested explicitly. Every tool is annotated with the MCP hints readOnlyHint, destructiveHint and idempotentHint so clients can gate writes themselves.
• Streamable HTTP transport. The legacy SSE transport was removed from the MCP specification and shipped without DNS rebinding or cross-origin protection. This server uses the Go SDK's StreamableHTTPHandler, which rejects requests that arrive on a loopback address with a non-loopback Host header and rejects cross-site browser requests.
• Optional allowlists. --allowed-hosts and --allowed-origins add explicit Host and Origin allowlists on top of the transport defaults.
• Bearer token handling. Tokens are compared in constant time over SHA-256 digests, and repeated failures from one address are throttled (10 per minute, then 429).
• Input validation. Repository identifiers, secret and template names, branches and build numbers are validated before reaching the Drone API client, because drone-go assembles request paths by string formatting.
• Log hygiene. X-Forwarded-For / X-Real-IP are ignored unless --trust-proxy is set, and control characters are stripped from logged values so request data cannot forge log lines.
• Bounded requests. Request bodies are capped (1 MiB by default), idle sessions expire, and header read timeouts plus silent-connection timeouts limit slow-client abuse.

Deployment checklist

1. Terminate TLS in front of the server (the binary speaks plain HTTP) and never send the bearer token over an untrusted network.
2. Keep the loopback default binding and put a reverse proxy in front, or bind to an interface only your MCP clients can reach.
3. Generate a high-entropy MCP_AUTH_TOKEN (32+ random bytes) and inject it as a platform secret rather than on the command line.
4. Leave write tools disabled unless the workflow needs them.
5. Set --trust-proxy only when a proxy you control rewrites X-Forwarded-For / X-Real-IP; otherwise the logged client address is attacker controlled.
6. Read SECURITY.md before exposing the server beyond localhost.

Usage

As an MCP server

Add the server to your MCP client configuration (e.g., Claude Desktop):

{

"mcpServers": { "drone": { "command": "/path/to/drone-mcp-server", "env": { "DRONE_SERVER": "https://drone.example.com", "DRONE_TOKEN": "your_token" } } } }

Direct execution

You can run the server directly for testing:

# Stdio mode (default) - for local MCP clients

./drone-mcp-server

Streamable HTTP mode - requires MCP_AUTH_TOKEN

export MCP_AUTH_TOKEN="$(openssl rand -base64 32)" ./drone-mcp-server --http --host localhost --port 8080

Transport Modes

1. Stdio mode (default): Communicates via stdin/stdout using the MCP protocol. Suitable for local integration with MCP clients; no network exposure and no authentication required.

1. Streamable HTTP mode (--http): A single endpoint that accepts POST (client to server), GET (server to client stream) and DELETE (session teardown).

Upgrading from earlier releases: the old --sse flag and the SSE transport are gone. Use --http and a client that speaks Streamable HTTP.

   # Local only, read-only tools

MCP_AUTH_TOKEN=... ./drone-mcp-server --http

Behind a TLS terminating proxy, write tools enabled

MCP_AUTH_TOKEN=... ./drone-mcp-server --http --host 127.0.0.1 --port 8080 \ --enable-write-tools --allowed-hosts mcp.example.com

Clients connect to http://localhost:8080/ by default and must send the header:

   Authorization: Bearer <MCP_AUTH_TOKEN>

Behind a reverse proxy: the transport rejects a public Host header on a loopback connection with 403 as part of its DNS rebinding protection. Either keep the loopback Host header (proxy_set_header Host 127.0.0.1:8080;), or hand Host validation to the allowlist with a single flag:

   ./drone-mcp-server --http --allowed-hosts mcp.example.com

Setting --allowed-hosts replaces the loopback heuristic, so you do not need --localhost-protection=false. If you pass --localhost-protection=true explicitly, both checks are applied and the public Host is rejected again.

Command line flags

Available Tools

The server implements 45 tools. In the default read-only mode only the 18 read-only tools are registered; the remaining 27 are write or destructive tools and require --enable-write-tools (or MCP_ENABLE_WRITE_TOOLS=true).

Write and destructive tools: enable_repo, disable_repo, repair_repo, chown_repo, sync_repos, create_cron, delete_cron, execute_cron, create_secret, update_secret, delete_secret, create_org_secret, update_org_secret, delete_org_secret, create_user, update_user, delete_user, create_template, update_template, delete_template, restart_build, cancel_build, promote_build, rollback_build, approve_build, decline_build, create_build.

The destructive ones (deletions, disables, cancellations, promotions, rollbacks, ownership changes) are advertised with destructiveHint: true; the rest of the write tools with destructiveHint: false. All 18 read-only tools are advertised with readOnlyHint: true.

Repository Management

list_repos

Lists all repositories in your Drone instance.

get_repo

Get repository details.

Arguments:

• owner (string): Repository owner
• repo (string): Repository name

enable_repo

Enable a repository.

Arguments:

• owner (string): Repository owner
• repo (string): Repository name

disable_repo

Disable a repository.

Arguments:

• owner (string): Repository owner
• repo (string): Repository name

repair_repo

Repair a repository.

Arguments:

• owner (string): Repository owner
• repo (string): Repository name

chown_repo

Change repository ownership.

Arguments:

• owner (string): Repository owner
• repo (string): Repository name

sync_repos

Synchronize repository list.

list_incomplete

List repositories with incomplete builds.

Build Management

list_builds

Lists builds for a specific repository.

Arguments:

• owner (string): Repository owner
• repo (string): Repository name

get_build

Get detailed information about a specific build.

Arguments:

• owner (string): Repository owner
• repo (string): Repository name
• build (number): Build number

get_build_last

Get the last build for a repository (optionally by branch).

Arguments:

• owner (string): Repository owner
• repo (string): Repository name
• branch (string, optional): Branch name

get_build_logs

Get logs for a specific build stage and step.

Arguments:

• owner (string): Repository owner
• repo (string): Repository name
• build (number): Build number
• stage (number): Stage number
• step (number): Step number

restart_build

Restart a build (optionally with parameters).

Arguments:

• owner (string): Repository owner
• repo (string): Repository name
• build (number): Build number
• params (object, optional): Build parameters

cancel_build

Cancel a running build.

Arguments:

• owner (string): Repository owner
• repo (string): Repository name
• build (number): Build number

promote_build

Promote a build to a target environment.

Arguments:

• owner (string): Repository owner
• repo (string): Repository name
• build (number): Build number
• target (string): Target environment
• params (object, optional): Promotion parameters

rollback_build

Rollback a deployment to a previous build.

Arguments:

• owner (string): Repository owner
• repo (string): Repository name
• build (number): Build number
• target (string): Target environment
• params (object, optional): Rollback parameters

approve_build

Approve a build stage (for gated deployments).

Arguments:

• owner (string): Repository owner
• repo (string): Repository name
• build (number): Build number
• stage (number): Stage number

decline_build

Decline a build stage (for gated deployments).

Arguments:

• owner (string): Repository owner
• repo (string): Repository name
• build (number): Build number
• stage (number): Stage number

create_build

Create a new build from a commit or branch.

Arguments:

• owner (string): Repository owner
• repo (s