Summary
We recently issued GHSA-8xjg-jpfh-5257 for our standalone MCP server. If you are currently using the standalone server, we recommend that you upgrade to 0.19.0.
Another option, if you are a CircleCI cloud user: you can use a new and improved MCP experience via the CircleCI CLI.
If you are on CircleCI cloud: migrate to the CLI
The fastest way to address MCP server vulnerabilities is to upgrade to version 0.19.0. We will continue to patch security issues on the standalone MCP server until further notice, however, we are no longer investing in new functionality.
In order to get the best possible MCP experience with CircleCI, we recommend that you migrate to the recently released CircleCI CLI that includes a built-in MCP server. The CircleCI CLI with MCP provides OAuth-based auth and native pipeline watching. We have also extended the suite of MCP tools offered and will continue to invest in this codebase as both MCP standards and the CircleCI platform evolve.
Step 1: Remove the old server from your AI tool
-
Cursor / Windsurf / VS Code: Remove the circleci-mcp-server block from your MCP config file
-
Claude Desktop: Go to Claude > Settings > Developer > Edit Config and remove the circleci-mcp-server block from claude_desktop_config.json
-
Claude Code: Run claude mcp remove circleci-mcp-server
Step 2: Install the new CLI
Homebrew:
brew install circleci-public/circleci/circleci@next
WinGet:
winget install --id CircleCI.CLI.Preview
Snap:
sudo snap install circleci --channel=edge
Debian/Ubuntu:
curl -1sLf ‘https://packages.circleci.com/public/setup.deb.sh’ | sudo -E bash
sudo apt install circleci
For other package managers, see the CircleCI CLI repository.
Feedback on the CircleCI CLI with MCP server? Submit issues against the GitHub repo.
Step 3: Authenticate
circleci auth login
Step 4: Configure your agent
circleci mcp claude enable
If you are on CircleCI Server or cannot migrate yet:
Make sure your MCP config is pointing to version 0.19.0. In your MCP config (Cursor, Claude Desktop, VS Code, Windsurf), the args should read:
“args”: [“-y”, “@circleci/mcp-server-circleci@0.19.0”]
We will continue to issue bug and security patches against the standalone package until further notice, however we are not accepting contributions or investing in new features.
Questions or concerns
Post in this thread or contact CircleCI Support if you believe you were affected before updating.