CloudBees Unify MCP Server tool reference

Tools available through the CloudBees Unify MCP Server are organized into toolsets — functional groups that match how you use the CloudBees Unify platform. Clients request only the toolsets they need, reducing context window usage and scoping tools precisely to the task at hand. Your CloudBees Unify roles determine which resources you can access when using those tools. For background on authentication and RBAC enforcement, refer to Understanding the CloudBees Unify MCP Server.

How tools work

When you ask your AI agent a question, it determines which tools to call and with what parameters. You do not need to know the exact tool names. Ask in natural language.

For example:

"List my components": AI agent calls services_list.
"Show workflows for api-gateway": AI agent calls workflow_list with a component filter.
"Who am I?": AI agent calls user_whoami.

Toolsets

The CloudBees Unify MCP Server uses per-request toolset filtering to serve only the tools relevant to a client’s task. Clients pass HTTP headers on each MCP request to select toolsets.

After you reconfigure toolsets, reconnect and re-authenticate.

Available toolsets

Toolset Purpose

Toolset	Purpose
`default`	Read-only discovery and context tools. Served automatically when no `X-MCP-Toolsets` header is provided.
`organization-administration`	Manage organizations, integrations, environments, endpoints, and properties.
`access-management`	Users, teams, invitations, RBAC roles, and access control tools.
`applications-components`	Components, repositories, branches, and SCM integrations.
`workflows`	Workflow definitions, triggers, runs, logs, and CI/CD automation management.
`feature-management`	Feature flags, configurations, environments, target groups, approvals, and custom properties.
`application-security`	Security findings, configurations, SLA policies, scanner management, and remediation.
`reports-analytics`	Organization reports, CI controller data, and report drilldown.
`policy-engine`	Policy creation, discovery, schema retrieval, and management.

default

Read-only discovery and context tools. Served automatically when no X-MCP-Toolsets header is provided.

organization-administration

Manage organizations, integrations, environments, endpoints, and properties.

access-management

Users, teams, invitations, RBAC roles, and access control tools.

applications-components

Components, repositories, branches, and SCM integrations.

workflows

Workflow definitions, triggers, runs, logs, and CI/CD automation management.

feature-management

Feature flags, configurations, environments, target groups, approvals, and custom properties.

application-security

Security findings, configurations, SLA policies, scanner management, and remediation.

reports-analytics

Organization reports, CI controller data, and report drilldown.

policy-engine

Policy creation, discovery, schema retrieval, and management.

X-MCP-Toolsets header

Pass X-MCP-Toolsets on each MCP request to control which toolsets are served.

Header value Tools served

Header value	Tools served
(absent)	`default` toolset only.
`workflows`	The `workflows` toolset plus the `default` toolset.
`application-security,workflows`	The named toolsets plus the `default` toolset.
`all`	Every toolset. Explicit opt-in required.
`all,workflows`	400 Bad Request — `all` cannot be combined with named toolsets.
`nonexistent`	400 Bad Request — unknown toolset name.

(absent)

default toolset only.

workflows

The workflows toolset plus the default toolset.

application-security,workflows

The named toolsets plus the default toolset.

all

Every toolset. Explicit opt-in required.

all,workflows

400 Bad Request — all cannot be combined with named toolsets.

nonexistent

400 Bad Request — unknown toolset name.

X-MCP-Readonly header

Pass X-MCP-Readonly to restrict the response to read-only tools within the selected toolsets.

Header value Effect

Header value	Effect
(absent)	Read and write tools are served.
`true`	Read-only tools only — write tools are stripped.

(absent)

Read and write tools are served.

true

Read-only tools only — write tools are stripped.

Discovering toolsets

Use the list_toolsets tool to discover available toolsets and the tools each one contains. Ask your AI agent in natural language:

List the available toolsets.

The agent calls list_toolsets and returns the current toolset names and their member tools.

Default toolset

The default toolset contains read-only discovery and context tools needed by most agent workflows. It is served automatically when no X-MCP-Toolsets header is provided.

user_whoami: Get current user information.
organizations_list: List accessible organizations.
organizations_get: Get organization details by ID.
organizations_search: Search for organizations by name.
organizations_list_suborganizations: List child organizations.
services_list: List services (components and applications) in an organization, or fetch a single service directly. Provide id to get full details of one service; omit it to list all services (optionally filtered by typeFilter).
resources_list: List resources in an organization.
search_runs: Search for workflow runs by component.
automation_jobs_list: List automation jobs within a run.
workflow_list: List workflows for a component.
logs_list: List logs for a workflow run.
flags_applications_list: List feature flag applications.
flags_environments_list: List feature flag environments.
flags_list: List feature flags in an application, or fetch a single flag directly. Provide id or name to get a single flag; omit both to list all flags. If you provide both, id takes precedence.
flag_configuration_get: Get a feature flag configuration.

Organization administration

Tools for managing organizations, integrations, environments, endpoints, and properties.

organizations_create: Create a new organization.
services_add: Add a service to an organization.
services_delete: Remove a service from an organization.
properties_list: List properties.
properties_get: Get a property.
properties_add: Add a property.
property_delete: Delete a property.
endpoint_list: List endpoints.
endpoint_add: Add an endpoint.
extensions_list: List available extensions.

Access management

Tools for managing users, teams, RBAC roles, and authentication.

users_list: List users.
users_get: Get a user by account.
users_get_by_id: Get a user by ID.
teams_create: Create a team.
teams_delete: Delete a team.
teams_invites_list: List team invitations.
teams_invite_create: Create a team invitation.
teams_invite_delete: Delete a team invitation.
teams_memberships_list: List team memberships.
teams_members_add: Add a member to a team.
teams_members_remove: Remove a member from a team.
teams_list: List teams in an organization. Provide id to get a single team; omit id to list all teams.
rbac_permissions_list: List RBAC permissions.
rbac_roles_list: List roles for an organization, or fetch a single role directly. Provide id to get one role by its ID; omit it to list all roles for the organization.
rbac_role_create: Create an RBAC role.
rbac_role_delete: Delete an RBAC role.
rbac_authorizations_list: List RBAC authorizations.
rbac_authorization_create: Create an RBAC authorization.
rbac_authorization_check_bulk: Bulk-check RBAC authorizations.

Applications and components

Tools for managing components, repositories, and SCM integrations.

repositories_list: List repositories for an organization. Each repository in the response includes an endpointId (SCM connector UUID) and defaultBranch field. Pass an optional query to filter results by name or URL (substring match; use * as wildcard, for example, "my-*"). organizationId defaults to the configured default organization if omitted.
branches_list: List branches.
scm_branches_list: List SCM branches.

Workflows

Tools for managing workflows, automation runs, logs, and CI/CD operations.

workflow_get_content: Get workflow content.
workflow_update_content: Update workflow content.
workflow_validate: Validate a workflow.
workflow_schema_get: Get workflow schema.
runs_list: List workflow runs.
automation_trigger_by_branch: Trigger an automation for a specific branch.
automation_rerun: Rerun an automation.
automation_stop: Stop a running automation.
automation_approve_manual_gate: Approve a manual workflow gate.
automation_reject_manual_gate: Reject a manual workflow gate.
automation_pending_tasks_list: List pending approval tasks across workflow runs.
manage_automation_policy_gate: Approve or reject a policy-gated job in a workflow run.
actions_list: List actions.

Feature management

Tools for managing feature flags, configurations, environments, target groups, and approvals.

flags_add: Add a feature flag.
flags_delete: Delete a feature flag.
flags_update_defaultValue: Update a feature flag default value.
flags_configurations_list: List feature flag configurations.
flags_configuration_state_update: Update feature flag configuration state.
flags_flag_usage_per_environment: Get feature flag usage per environment.
flags_sdk_key_get: Get the SDK key for a specific environment in an application.
flag_configuration_conditions_set: Set feature flag configuration conditions.
flag_serve_to_target_group: Serve a feature flag to a target group.
flag_approval_requests_list: List feature flag approval requests.
flag_target_groups_list: List target groups for an application, or fetch a single target group directly. Provide id or name to get a single target group; omit both to list all target groups. If you provide both, id takes precedence.
flag_target_groups_add: Add a target group.
flag_target_groups_delete: Delete a target group.
flag_target_groups_list_with_flags_usage: List target groups with flag usage.
flag_target_groups_flag_usage_per_environment: Get flag usage per environment for a target group.
flag_target_groups_target_group_usage: Get target group usage statistics.
flag_custom_properties_list: List custom properties for an application, or fetch a single custom property directly. Provide id or name to get a single custom property; omit both to list all custom properties. If you provide both, id takes precedence.
flag_custom_properties_add: Add a custom property.
flag_custom_properties_delete: Delete a custom property.
flag_custom_properties_flag_usage_per_environment: Get flag usage per environment for a custom property.
flag_custom_properties_target_group_usage: Get target group usage for a custom property.

Application security

Tools for managing security findings, configurations, SLA policies, and scanners.

security_findings_summary_get: Get a security findings summary.
security_issues_open_get: Get open security issues.
security_issues_all_get: Get all security issues.
security_filters_list: List security filters.
security_filter_tools_list: List tools for a security filter.
security_configuration_get: Get security configuration.
security_configuration_set: Set security configuration.
security_configuration_hierarchy_get: Get security configuration hierarchy.
security_sla_configuration_get: Get SLA configuration.
security_sla_configuration_set: Set SLA configuration.
security_sla_configuration_remove: Remove SLA configuration.
security_tenant_sla_configuration_remove: Remove tenant SLA configuration.
security_implicit_scans_set: Configure implicit security scans.
security_plugin_config_get: Get security plugin configuration.
security_plugin_config_set: Set security plugin configuration.
security_plugin_activate: Activate a security plugin.
security_plugin_deactivate: Deactivate a security plugin.

Reports and analytics

Tools for retrieving organization reports, CI controller data, and drilldown report data.

organizations_suborg_report: Get a child organization report.
controllers_list: List CI controllers.
controllers_data_get: Get CI controller data.
report_drilldown_get: Get report drilldown data.

Policy engine

Tools for creating, managing, and discovering policies.

policies_list: List policies in an organization. Provide id to get a single policy; omit id to list policies. Supports optional filterName substring filter.
policies_get_schema: Get policy schema.
policies_create: Create a policy.
policies_update: Update a policy.
policies_delete: Delete a policy.
policies_discover: Discover applicable policies.
policies_run_evaluations_list: List policy evaluation results for a workflow run.

Tool access and permissions

The default toolset is always served. Additional toolsets are served for the toolsets you explicitly request. When you use a tool, CloudBees Unify enforces role-based access control:

Your AI agent can only access resources you have permission to access.
Tool calls fail if you lack permission for the requested resource.
All tool calls are logged and attributed to your user account.

If a tool call fails with a permission error, contact your CloudBees Unify administrator to verify your role assignments.