MCP, MCP server
Teamcity Mcp
A Model Control Protocol (MCP) server that bridges AI coding assistants with JetBrains TeamCity CI/CD server, exposing TeamCity operations as MCP tools.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit cb6ad7713dde.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
scripts/build.cjs, line 28
fs.rmSync(distPath, { recursive: true, force: true }); - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
docs/investigations/teamcity-artifact-streaming.md, line 33
- `axios.get(url, { responseType: 'stream' })` against the same endpoint returns a Node `Readable` stream. Sample run: - SECRETS_PATH_DOTENV Low
Mentions a .env file.
jest.config.js, line 9
// Load .env before any other setup so tests see env vars - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
scripts/codecov-bundle.cjs, line 14
const uploadToken = process.env.CODECOV_TOKEN; - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
package-lock.json, line 1
{ - OBFUSCATION_FILE_CAP_REACHED Note
The 400 file cap was reached before every file was read.
package-lock.json, line 1
{
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/build.cjs, line 28
fs.rmSync(distPath, { recursive: true, force: true });
src/swagger/swagger-cache.ts, line 115
await fs.unlink(filePath);
src/swagger/swagger-cache.ts, line 125
await fs.unlink(path.join(this.cacheDir, file));
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
docs/investigations/teamcity-artifact-streaming.md, line 33
- `axios.get(url, { responseType: 'stream' })` against the same endpoint returns a Node `Readable` stream. Sample run:
docs/teamcity-unified-client.md, line 72
const response = await axios.get(url, { responseType: 'arraybuffer' });
src/tools.ts, line 367
const response = await axios.get(request.downloadUrl, { responseType });
Show more
src/tools.ts, line 917
maxPages: { type: 'number', description: 'Max pages to fetch (when all=true)' },
src/tools.ts, line 1038
maxPages: { type: 'number', description: 'Max pages to fetch (when all=true)' },
src/tools.ts, line 1984
maxPages: { type: 'number', description: 'Max pages to fetch (when all=true)' },
src/tools.ts, line 2097
maxPages: { type: 'number', description: 'Max pages to fetch (when all=true)' },
src/tools.ts, line 2169
maxPages: { type: 'number', description: 'Max pages to fetch (when all=true)' },
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
scripts/codecov-bundle.cjs, line 14
const uploadToken = process.env.CODECOV_TOKEN;
scripts/fetch-swagger-spec.ts, line 48
const token = process.env['TEAMCITY_TOKEN'];
jest.config.js, line 9
// Load .env before any other setup so tests see env vars
Show more
scripts/verify-integration-env.cjs, line 13
const token = process.env.TEAMCITY_TOKEN || process.env.TEAMCITY_API_TOKEN;
src/index.ts, line 57
process.env['TEAMCITY_TOKEN'] = cliArgs.token;
src/config/index.ts, line 92
const tcToken = env.TEAMCITY_TOKEN ?? process.env['TEAMCITY_API_TOKEN'];
scripts/verify-integration-env.cjs, line 3
// Loads .env and ensures required TeamCity variables are present.
scripts/verify-integration-env.cjs, line 19
'Please set TEAMCITY_URL and TEAMCITY_TOKEN (or TEAMCITY_SERVER_URL and TEAMCITY_API_TOKEN) in your environment or .env file.',
src/index.ts, line 48
// Load .env file (lowest priority - only fills gaps)
src/index.ts, line 110
' - .env file\n' +
src/utils/cli-args.ts, line 20
/** Path to .env format config file */
src/utils/cli-args.ts, line 160
--config <path> Path to .env format configuration file
src/utils/cli-args.ts, line 169
4. .env file in current directory
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read. the file cap was reached before every file was read.
OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
package-lock.json, line 1
{
src/tools.ts, line 1
/**
src/teamcity-client/api/build-api.ts, line 1
/* tslint:disable */
Show more
src/teamcity-client/api/build-type-api.ts, line 1
/* tslint:disable */
src/teamcity-client/api/project-api.ts, line 1
/* tslint:disable */
src/utils/lru-cache.ts, line 1
interface CacheEntry<T> {
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit cb6ad7713dde. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: cb6ad7713dde3ffce568e9fbe1f3e5464b3e3455
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.