mcp-server-plugin

The plugin leverages Jenkins' robust security model, requiring Jenkins API tokens for authentication and respecting user permissions (ACL). Origin header validation is implemented and configurable, though it's not strictly enforced by default to facilitate AI agent usage. Dynamic method invocation is constrained to annotated methods on registered extensions, which is standard for Jenkins plugins. Parameter deserialization uses reflection for plugin compatibility but operates within the Jenkins parameter framework. No hardcoded secrets or obvious malicious patterns were found. Running safely requires proper Jenkins security configuration and consideration of the origin header validation settings.