When you connect an AI agent to CloudBees Unify using MCP, follow these security best practices.
Authentication
You authenticate using the same OAuth flow as the CloudBees Unify web interface:
-
Your AI client opens your web browser.
-
You sign in using Google, GitHub, or SSO.
-
You select your Root Organization.
-
Your AI client stores your credentials securely.
Your AI agent acts with the same permissions as your user account.
Best practices
Follow these practices to maintain secure access.
Use least-privilege accounts
Connect your AI agent with an account that has only the access it needs:
-
Developers typically need read access to components, workflows, and builds, plus permission to trigger workflows.
-
Platform engineers may require broader access for configuration and management tasks.
-
Security engineers may need read-only access to security findings and reports.
Avoid using highly privileged accounts for routine use.
| Create a dedicated service account for your AI agent to use with appropriately scoped roles, rather than using a personal account with broad access. |
Authenticate each machine separately
Authenticate each developer machine independently:
-
Don’t share authentication between machines or users.
-
If a machine is lost or compromised, reauthenticate your other machines to ensure they continue working.
Reauthenticate when prompted
Your authentication expires after a period of time. When prompted, reauthenticate to continue using MCP.
If you suspect your authentication is compromised, reauthenticate immediately.
Monitor activity
All MCP activity is logged and attributed to your user account.
Contact CloudBees Support for audit inquiries or security investigations.
Control access with roles
CloudBees Unify enforces role-based access control (RBAC) when you use MCP.
All tools are visible to authenticated users, but your roles determine which resources you can access:
-
A user with only the
Developerrole cannot access user management resources. -
A user with only read permissions cannot trigger workflows or modify feature flags.
-
A user not in a team cannot access that team’s components.
To restrict what an AI agent can do:
-
Create or identify the user account for your AI agent to use.
-
Assign only the necessary roles to that account.
-
Test the connection to verify required operations work.
Network configuration
Your AI client connects outbound to mcp.cloudbees.io over HTTPS (port 443).
No inbound connections are required. No firewall rules need to be opened on developer machines.
Corporate proxies
If your organization uses a corporate proxy:
-
Configure your AI client to use the proxy for HTTPS connections.
-
Ensure the proxy allows connections to
mcp.cloudbees.io. -
Configure proxy credentials in your AI client if needed.
For Claude Code, proxy settings are typically inherited from system environment variables (HTTP_PROXY, HTTPS_PROXY).
Security checklist
Use this checklist to verify your MCP connection follows security best practices:
AI agents authenticate with least-privilege user accounts.
Each machine has its own authentication (no shared credentials).
Administrator accounts are not used for day-to-day AI agent operations.
Corporate proxy settings are correctly configured if needed.
Team members have reviewed Privacy and data handling.
Incident response
If you suspect a security incident:
-
Immediate action: Reauthenticate your AI client to obtain new credentials.
-
Notify your security team: Follow your organization’s incident response procedures.
-
Contact support: Contact CloudBees Support. CloudBees can review activity logs and assist with security concerns.
Data privacy
For information about what data is shared with CloudBees Unify and how it’s protected, refer to Privacy and data handling.
CloudBees Unify follows industry-standard security practices covered by the CloudBees SOC2 certification.