CloudBees Unify MCP Server tool reference

Tools available through the CloudBees Unify MCP Server are organized into toolsets — functional groups that match how you use the CloudBees Unify platform. Clients request only the toolsets they need, reducing context window usage and scoping tools precisely to the task at hand. Your CloudBees Unify roles determine which resources you can access when using those tools. For background on authentication and RBAC enforcement, refer to Understanding the CloudBees Unify MCP Server.

How tools work

When you ask your AI agent a question, it determines which tools to call and with what parameters. You do not need to know the exact tool names. Ask in natural language.

For example:

"List my components": AI agent calls services_list.
"Show workflows for api-gateway": AI agent calls workflow_list with a component filter.
"Who am I?": AI agent calls user_whoami.

Toolsets

The CloudBees Unify MCP Server uses per-request toolset filtering to serve only the tools relevant to a client’s task. Clients pass HTTP headers on each MCP request to select toolsets. No server restart is required.

Available toolsets

Toolset Purpose

Toolset	Purpose
`default`	Read-only discovery and context tools. Served automatically when no `X-MCP-Toolsets` header is provided.
`organization-administration`	Manage organizations, integrations, environments, endpoints, and properties.
`access-management`	Users, teams, invitations, RBAC roles, SAML connections, and authentication tools.
`applications-components`	Components, repositories, branches, and SCM integrations.
`workflows`	Workflow definitions, triggers, runs, logs, and CI/CD automation management.
`feature-management`	Feature flags, configurations, environments, target groups, approvals, and custom properties.
`application-security`	Security findings, configurations, SLA policies, scanner management, and remediation.
`reports-analytics`	Organization reports, CI controller data, and report drilldown.
`policy-engine`	Policy creation, discovery, schema retrieval, and management.

default

Read-only discovery and context tools. Served automatically when no X-MCP-Toolsets header is provided.

organization-administration

Manage organizations, integrations, environments, endpoints, and properties.

access-management

Users, teams, invitations, RBAC roles, SAML connections, and authentication tools.

applications-components

Components, repositories, branches, and SCM integrations.

workflows

Workflow definitions, triggers, runs, logs, and CI/CD automation management.

feature-management

Feature flags, configurations, environments, target groups, approvals, and custom properties.

application-security

Security findings, configurations, SLA policies, scanner management, and remediation.

reports-analytics

Organization reports, CI controller data, and report drilldown.

policy-engine

Policy creation, discovery, schema retrieval, and management.

X-MCP-Toolsets header

Pass X-MCP-Toolsets on each MCP request to control which toolsets are served.

Header value Tools served

Header value	Tools served
(absent)	`default` toolset only.
`workflows`	The `workflows` toolset plus the `default` toolset.
`application-security,workflows`	The named toolsets plus the `default` toolset.
`all`	Every toolset. Explicit opt-in required.
`all,workflows`	400 Bad Request — `all` cannot be combined with named toolsets.
`nonexistent`	400 Bad Request — unknown toolset name.

(absent)

default toolset only.

workflows

The workflows toolset plus the default toolset.

application-security,workflows

The named toolsets plus the default toolset.

all

Every toolset. Explicit opt-in required.

all,workflows

400 Bad Request — all cannot be combined with named toolsets.

nonexistent

400 Bad Request — unknown toolset name.

X-MCP-Readonly header

Pass X-MCP-Readonly to restrict the response to read-only tools within the selected toolsets.

Header value Effect

Header value	Effect
(absent)	Read and write tools are served.
`true`	Read-only tools only — write tools are stripped.

(absent)

Read and write tools are served.

true

Read-only tools only — write tools are stripped.

Discovering toolsets

Use the list_toolsets tool to discover available toolsets and the tools each one contains. Ask your AI agent in natural language:

List the available toolsets.

The agent calls list_toolsets and returns the current toolset names and their member tools.

Default toolset

The default toolset contains read-only discovery and context tools needed by most agent workflows. It is served automatically when no X-MCP-Toolsets header is provided.

user_whoami: Get current user information.
organizations_list: List accessible organizations.
organizations_get: Get organization details by ID.
organizations_search: Search for organizations by name.
organizations_list_suborganizations: List child organizations.
services_list: List components and applications.
services_get: Get component or application details by ID.
resources_list: List resources in an organization.
resources_get: Get a resource and its optional hierarchy.
search_resources: Search for resources by name or type.
search_runs: Search for workflow runs by component.
automation_jobs_list: List automation jobs within a run.
workflow_list: List workflows for a component.
logs_list: List logs for a workflow run.
flags_applications_list: List feature flag applications.
flags_environments_list: List feature flag environments.
flags_get_by_name: Get a feature flag by name.
flag_configuration_get: Get a feature flag configuration.

Organization administration

Tools for managing organizations, integrations, environments, endpoints, and properties.

organizations_create: Create a new organization.
services_add: Add a service to an organization.
services_delete: Remove a service from an organization.
properties_list: List properties.
properties_get: Get a property.
properties_add: Add a property.
property_delete: Delete a property.
endpoint_list: List endpoints.
endpoint_add: Add an endpoint.
endpoint_scm_connector_prepare: Prepare an SCM connector endpoint.
ticketing_webhook_url_get: Get a ticketing webhook URL.
extensions_list: List available extensions.

Access management

Tools for managing users, teams, RBAC roles, and authentication.

users_list: List users.
users_get: Get a user by account.
users_get_by_id: Get a user by ID.
user_preferences_get: Get user preferences.
user_set_timezone: Set user timezone.
teams_get: Get a team.
teams_get_by_id: Get a team by ID.
teams_create: Create a team.
teams_delete: Delete a team.
teams_invites_list: List team invitations.
teams_invite_create: Create a team invitation.
teams_invite_delete: Delete a team invitation.
teams_memberships_list: List team memberships.
teams_members_add: Add a member to a team.
teams_members_remove: Remove a member from a team.
rbac_permissions_list: List RBAC permissions.
rbac_roles_list: List RBAC roles.
rbac_role_get: Get an RBAC role.
rbac_role_create: Create an RBAC role.
rbac_role_delete: Delete an RBAC role.
rbac_authorizations_list: List RBAC authorizations.
rbac_authorization_create: Create an RBAC authorization.
rbac_authorization_check_bulk: Bulk-check RBAC authorizations.
api_tokens_list: List API tokens for the current user.
saml_connections_list: List SAML connections.
saml_email_domains_list: List SAML email domains.

Applications and components

Tools for managing components, repositories, and SCM integrations.

repositories_list: List repositories.
repositories_search: Search for repositories.
branches_list: List branches.
scm_branches_list: List SCM branches.
scm_gh_app_registrations_list: List GitHub App registrations.
scm_repositories_sync: Request a sync of repositories from the SCM provider.

Workflows

Tools for managing workflows, automation runs, logs, and CI/CD operations.

workflow_get_content: Get workflow content.
workflow_update_content: Update workflow content.
workflow_validate: Validate a workflow.
workflow_trigger: Trigger a workflow.
workflow_schema_get: Get workflow schema.
runs_list: List workflow runs.
automation_trigger: Trigger an automation.
automation_trigger_by_branch: Trigger an automation for a specific branch.
automation_rerun: Rerun an automation.
automation_stop: Stop a running automation.
automation_approve_manual_gate: Approve a manual workflow gate.
automation_reject_manual_gate: Reject a manual workflow gate.
automation_pending_tasks_list: List pending approval tasks across workflow runs.
actions_list: List actions.

Feature management

Tools for managing feature flags, configurations, environments, target groups, and approvals.

flags_list: List feature flags.
flags_get: Get a feature flag by ID.
flags_add: Add a feature flag.
flags_delete: Delete a feature flag.
flags_update_defaultValue: Update a feature flag default value.
flags_configurations_list: List feature flag configurations.
flags_configuration_state_update: Update feature flag configuration state.
flags_flag_usage_per_environment: Get feature flag usage per environment.
flag_configuration_conditions_set: Set feature flag configuration conditions.
flag_serve_to_target_group: Serve a feature flag to a target group.
flag_approval_requests_list: List feature flag approval requests.
flag_target_groups_list: List target groups.
flag_target_groups_get: Get a target group.
flag_target_groups_get_by_name: Get a target group by name.
flag_target_groups_add: Add a target group.
flag_target_groups_delete: Delete a target group.
flag_target_groups_list_with_flags_usage: List target groups with flag usage.
flag_target_groups_flag_usage_per_environment: Get flag usage per environment for a target group.
flag_target_groups_target_group_usage: Get target group usage statistics.
flag_custom_properties_list: List custom properties.
flag_custom_properties_get: Get a custom property.
flag_custom_properties_get_by_name: Get a custom property by name.
flag_custom_properties_add: Add a custom property.
flag_custom_properties_delete: Delete a custom property.
flag_custom_properties_flag_usage_per_environment: Get flag usage per environment for a custom property.
flag_custom_properties_target_group_usage: Get target group usage for a custom property.

Application security

Tools for managing security findings, configurations, SLA policies, and scanners.

security_findings_summary_get: Get a security findings summary.
security_issues_open_get: Get open security issues.
security_issues_all_get: Get all security issues.
security_filters_list: List security filters.
security_filter_tools_list: List tools for a security filter.
security_configuration_get: Get security configuration.
security_configuration_set: Set security configuration.
security_configuration_hierarchy_get: Get security configuration hierarchy.
security_sla_configuration_get: Get SLA configuration.
security_sla_configuration_set: Set SLA configuration.
security_sla_configuration_remove: Remove SLA configuration.
security_tenant_sla_configuration_remove: Remove tenant SLA configuration.
security_implicit_scans_set: Configure implicit security scans.
security_plugin_config_get: Get security plugin configuration.
security_plugin_config_set: Set security plugin configuration.
security_plugin_activate: Activate a security plugin.
security_plugin_deactivate: Deactivate a security plugin.

Reports and analytics

Tools for retrieving organization reports, CI controller data, and drilldown report data.

organizations_suborg_report: Get a child organization report.
controllers_list: List CI controllers.
controllers_data_get: Get CI controller data.
report_drilldown_get: Get report drilldown data.

Policy engine

Tools for creating, managing, and discovering policies.

policies_list: List policies.
policies_get: Get a policy.
policies_get_schema: Get policy schema.
policies_create: Create a policy.
policies_update: Update a policy.
policies_delete: Delete a policy.
policies_discover: Discover applicable policies.
policies_run_evaluations_list: List policy evaluation results for a workflow run.

Tool access and permissions

The default toolset is always served. Additional toolsets are served for the toolsets you explicitly request. When you use a tool, CloudBees Unify enforces role-based access control:

Your AI agent can only access resources you have permission to access.
Tool calls fail if you lack permission for the requested resource.
All tool calls are logged and attributed to your user account.

If a tool call fails with a permission error, contact your CloudBees Unify administrator to verify your role assignments.