Skip to main content
Connect Jenkins and CloudThinker agents can list jobs, read build logs and test results, explain why a build failed, and trigger a build through your workspace’s Approvals. CloudThinker talks to the Jenkins MCP Server plugin on your server and signs in with a Jenkins username and API token.

​
Prerequisites

  • A Jenkins server that CloudThinker can reach from the internet, with admin access to install plugins. For a server behind a firewall, allowlist CloudThinker’s egress IPs. These docs don’t publish CloudThinker’s egress IP list: ask your CloudThinker contact, or contact us. See Reaching private services for other options.
  • The MCP Server plugin installed. It adds the endpoint CloudThinker calls, at <your-jenkins-url>/mcp-server/mcp.
  • A Jenkins user for CloudThinker, with the permissions in Required permissions.
  • The Admin role in your CloudThinker workspace, which can add and edit connections. See Roles.

​
Setup

1

Install the MCP Server plugin

In Jenkins, go to Manage Jenkins → Plugins → Available plugins, search for MCP Server, install it, and restart Jenkins if asked.
2

Set the Jenkins URL

Go to Manage Jenkins → System and fill in Jenkins URL under Jenkins Location with the address people use to reach Jenkins, for example https://jenkins.acme.com/. Click Save.The plugin builds job and build links from this value. If it’s empty or set to localhost, agents get broken links.
3

Create an API token

Sign in to Jenkins as the CloudThinker user and open <your-jenkins-url>/user/<username>/security (on older Jenkins versions, /user/<username>/configure). Under API Token, click Add new Token. Name it cloudthinker, click Generate, and copy the token. Jenkins shows it only once.
4

Add the connection in CloudThinker

In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for Jenkins, click Connect, and fill in the fields from Connection details. Click Connect.CloudThinker tests the connection by calling the MCP endpoint with your username and token. A wrong URL, a rejected token, or a missing plugin shows an error instead of Connected.Success state: Jenkins shows Connected on the Builtin Connections tab.
The test doesn’t check the user’s job permissions. Run the verify prompt below to confirm agents can see your jobs.

​
Connection details

The dialog shows the fields under these exact names. If you leave out the scheme, CloudThinker uses https://. On a public address, CloudThinker always connects over HTTPS, even when you enter http://, so your server needs a valid TLS certificate there.

​
Required permissions

Grant the CloudThinker user these permissions in your Jenkins authorization strategy (for example Matrix-based security under Manage Jenkins → Security): The token acts with exactly this user’s permissions. Leave out Job / Build for a read-only connection. The user doesn’t need Overall / Administer, and none of the agent tools read Jenkins credentials or secrets.
Use a dedicated Jenkins user for CloudThinker instead of an admin account. If you use folder-level permissions, grant access only to the folders agents should see.

​
Agent capabilities

Reads run without asking. Triggering a build is a write, so it goes through your Approvals first. Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself.

​
Verify the connection

A working connection returns your real job names and results. An empty list usually means the user lacks Job / Read or Job / Discover.

​
Example prompts

​
Troubleshooting

CloudThinker can’t reach your Jenkins server. Check that the URL opens from outside your network and that your firewall allows inbound HTTPS from CloudThinker’s egress IPs. Don’t use localhost or an address that only resolves inside your network.
The username or token is wrong, or the token was revoked. Confirm that JENKINS_USER is the user who generated the token, and generate a new token if needed. To replace it, select Jenkins in More → Workspace settings → Connections, click the pencil icon, click Replace… under Credentials, and click Save and test.
The MCP Server plugin isn’t installed or enabled, or JENKINS_URL points at the wrong path. Install the plugin and enter only the base URL. If Jenkins runs under a path such as /jenkins, include it: https://ci.acme.com/jenkins.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Limit network exposure. Allow inbound traffic to Jenkins only from the sources that need it, and keep the Jenkins UI behind your normal access controls.
  • Keep builds approval-gated. Grant Job / Build only if agents should start builds, and choose Manual if a person should see every build CloudThinker starts.

Approvals

Decide which agent actions run on their own and which wait for you

Connections Overview

See every tool CloudThinker connects to and how connections work