The CircleCI MCP server is designed to run locally as a tool for individual developers. It is not intended to be deployed as a public or shared remote service. Exposing it to untrusted networks creates serious security risks.
The MCP server is local-only by design
When running in its standard configuration, the CircleCI MCP server listens on localhost and is only accessible from the machine it is running on. This is the intended and supported deployment model.
Remote mode (start=remote) is documented for specific local development setups but does not include authentication by default. Running the MCP server in remote mode and exposing it on a network interface accessible to other machines — including a local area network or the internet — means any caller on that network can invoke MCP tools using the server's configured CIRCLECI_TOKEN. This includes tools that can trigger pipelines with caller-supplied configuration.
Risks of exposing the MCP server to untrusted networks
If the MCP server is reachable from an untrusted network without authentication, an unauthenticated attacker could:
Trigger CircleCI pipelines in your organization using the server's CIRCLECI_TOKEN.
Supply attacker-controlled pipeline configuration, potentially gaining access to environment variables, contexts, OIDC-derived credentials, and deploy tokens available to that pipeline.
Use the pipeline execution primitive to affect any artifacts, containers, or deployments your pipelines produce.
How to deploy the MCP server safely
Follow these guidelines to keep your MCP server secure:
Run the MCP server in local mode only (the default). Do not bind it to 0.0.0.0 or expose it beyond localhost unless you have explicitly secured it.
If you must use remote mode, place the server behind a network boundary that restricts access to trusted clients only — do not expose it directly to the internet or a shared LAN.
Treat your CIRCLECI_TOKEN as a high-value secret. Rotate it immediately if you believe the MCP server was accessible to untrusted parties.
Audit your organization's recent pipeline activity if you suspect the server was exposed, and contact [email protected] if you identify unexpected pipeline runs.
Additional resources
How do I report a security vulnerability?
What to do if you suspect you have a secret leaked from CircleCI
Fixing Repeated Google Authentication Prompts with the CircleCI Docs MCP Server