Introduction
Understanding organizationsUnderstanding componentsManage organizationsManage componentsManage component Jira integrations
Set up your first organizationUnderstanding users and teamsUnderstanding role-based access controlManage usersManage teamsConfigure role-based access controlRBAC permissions reference
Understanding authentication in CloudBees UnifySet up multifactor authenticationConfigure SAML single sign-onConfigure OIDC authenticationConfigure network security policiesNetwork security reference
Understanding platform configurationUnderstanding environmentsManage properties and secretsManage environmentsTrack environment inventoryConfigure containersSet up preconfigured actionsConfigure notifications
Accessibility policy referenceShared responsibility model referenceSubscription and services agreementSupport policiesSupported browsers and external tools
Introduction
Understanding feature managementUnderstanding Configuration as CodeGet started with feature managementCreate and manage feature flagsConfigure feature flag targetingOrganize feature flagsImplement feature flag governanceConfiguration as Code reference
Understanding flag impressions and activity statusUnderstanding flag healthUnderstanding code referencesReview and clean up feature flagsSet up code references
Understanding Jira integration for feature flagsSet up the Jira integrationLink Jira tickets to feature flags
Understanding multiple SDK keysBuild your first mobile app with feature flagsBuild your first feature-flagged web applicationBuild your first feature-flagged backend serviceInstall client-side SDKsInstall server-side SDKsConfigure multiple SDK keysMobile SDK referenceWeb SDK referenceBackend SDK referenceClient SDK referenceFlag implementation reference
Introduction
Understanding CI workflowsCreate a build workflowCreate and manage workflowsCreate reusable workflowsTest and validate containers in workflowsCheck out source codeTrigger workflows remotelyWorkflow syntax referenceJobs syntax referenceSteps syntax referenceServices syntax reference
Monitor workflow runsView test results in runsView evidence in runsView deployments in runsManage workflow artifactsPublish test resultsPublish evidence itemsGenerate a software bill of materialsManage ServiceNow change requests
Configure workflow credentialsConfigure AWS credentialsConfigure container registry credentialsConfigure Git credentialsIntegrate external secret providers
Understanding GitHub Actions integrationSet up GitHub Actions integrationDisplay GitHub Actions workflows and runsRegister GHA build artifactsPublish GHA deployed artifactsPublish GHA test resultsPublish GHA evidence itemsTrigger CloudBees workflows from GitHub ActionsScan with GitHub Actions
Understanding CloudBees CI and Jenkins® integrationConnect CI and Jenkins controllersMonitor CI and Jenkins buildsRegister CI build artifactsRegister CI deployed artifactsPublish CI test resultsConfigure CI security scanningCI and Jenkins integration reference
Build and publish container imagesUnderstanding external CI/CD integrationsRun external CI/CD jobsExternal CI/CD action reference
Introduction
Understanding release orchestrationManage applicationsCreate deployer workflowsCreate staged workflowsCreate and manage releasesOrchestrate multi-workflow releasesRelease management reference
Understanding artifact managementRegister and track artifactsStore and retrieve artifactsPromote artifactsGenerate a software bill of materialsArtifact management reference
Deploy with HelmDeploy to KubernetesContainer deployment reference
Deploy to AWSAWS deployment reference
Deploy with enterprise platformsExecute remote deployment commandsEnterprise deployment reference
Verify deployments with New RelicDeployment verification reference

Secure your MCP connection

2 minute read

Apply these security best practices when connecting an AI agent to CloudBees Unify through MCP. For background on how authentication and RBAC work, refer to Understanding the CloudBees Unify MCP Server.

Follow security best practices

These practices reduce exposure if an account or machine is compromised.

Use least-privilege accounts

Connect your AI agent with an account that has only the access it needs:

  • Developers typically need read access to components, workflows, and builds, plus permission to trigger workflows.

  • Platform engineers may require broader access for configuration and management tasks.

  • Security engineers may need read-only access to security findings and reports.

Avoid using highly privileged accounts for routine use.

Create a dedicated service account for your AI agent with appropriately scoped roles, rather than using a personal account with broad access.

Authenticate each machine separately

Authenticate each developer machine independently:

  • Don’t share authentication between machines or users.

  • If a machine is lost or compromised, reauthenticate your other machines to ensure they continue working.

Reauthenticate when prompted

Your authentication expires after a period of time. When prompted, reauthenticate to continue using MCP. If you suspect your authentication is compromised, reauthenticate immediately.

Monitor activity

All MCP activity is logged and attributed to your user account. Contact CloudBees Support for audit inquiries or security investigations.

Control access with roles

CloudBees Unify enforces role-based access control (RBAC) when you use MCP. All tools are visible to authenticated users, but your roles determine which resources you can access:

  • A user with only the Developer role cannot access user management resources.

  • A user with only read permissions cannot trigger workflows or modify feature flags.

  • A user not in a team cannot access that team’s components.

To restrict what an AI agent can do:

  1. Create or identify the user account for your AI agent to use.

  2. Assign only the necessary roles to that account.

  3. Test the connection to verify required operations work.

Security checklist

Use this checklist to verify your MCP connection follows security best practices:

AI agents authenticate with least-privilege user accounts.

Each machine has its own authentication. No shared credentials.

Administrator accounts are not used for day-to-day AI agent operations.

Corporate proxy settings are correctly configured if needed.

Team members have reviewed Understanding MCP privacy and data handling.

Respond to a security incident

If you suspect a security incident:

  1. Immediate action: Reauthenticate your AI client to obtain new credentials.

  2. Notify your security team: Follow your organization’s incident response procedures.

  3. Contact support: Contact CloudBees Support. CloudBees can review activity logs and assist with security concerns.

Migrate to the remote CloudBees Unify MCP Server
Troubleshoot CloudBees Unify MCP Server issues