list_component_versions

// WHEN AI AGENTS USE THIS TOOL

AI agents call list_component_versions to retrieve information from CircleCI MCP Server without modifying any data. This is common in research, monitoring, and reporting workflows where the agent needs context before taking action. Because read operations don't change state, they are generally safe to allow without restrictions -- but you may still want rate limits to control API costs.

// WHY ENFORCE A POLICY ON LIST_COMPONENT_VERSIONS

Even though list_component_versions only reads data, uncontrolled read access can leak sensitive information or rack up API costs. An agent caught in a retry loop could make thousands of calls per minute. A rate limit gives you a safety net without blocking legitimate use.

// RECOMMENDED POLICY

Read-only tools are safe to allow by default. No rate limit needed unless you want to control costs.

circleci-public-mcp-server-circleci.yaml

tools:
  list_component_versions:
    rules:
      - action: allow

See the full CircleCI MCP Server policy for all 16 tools.

// DETAILS

Tool Name list_component_versions

Category Read

MCP Server CircleCI MCP Server MCP Server

Risk Level Low

// MORE CIRCLECI MCP SERVER TOOLS

Execute rerun_workflow Execute run_evaluation_tests Execute run_pipeline Execute run_rollback_pipeline Write create_prompt_template Read analyze_diff Read config_helper Read download_usage_api_data

View all 16 tools →

// WHAT CAN GO WRONG

Agents calling read-class tools like list_component_versions have been implicated in these attack patterns. Read the full case and prevention policy for each:

Browse the full MCP Attack Database →

// OTHER READ TOOLS ACROSS MCP SERVERS

Other tools in the Read risk category across the catalogue. The same policy patterns (rate-limit, allow) apply to each.

Firecrawl Web Scraping Server firecrawl_check_crawl_status Firecrawl Web Scraping Server firecrawl_crawl Firecrawl Web Scraping Server firecrawl_deep_research Firecrawl Web Scraping Server firecrawl_extract Firecrawl Web Scraping Server firecrawl_map Firecrawl Web Scraping Server firecrawl_scrape

// RELATED READING

// FAQ

What does the list_component_versions tool do? +

This tool lists all versions for a CircleCI component. It guides you through a multi-step process to gather the required information and provides lists of available options when parameters are missing. **Initial Requirements:** - You need either a `projectSlug` (from `listFollowedProjects`) or a `projectID`. The tool will automatically resolve the `orgID` from either of these. **Typical Flow:** 1. **Start:** User requests component versions or deployment information. 2. **Project Information:** Provide either `projectSlug` or `projectID`. The tool will automatically resolve the `orgID` and `projectID` as needed. 3. **Environment Selection:** If `environmentID` is not provided, the tool will list all available environments for the organization and prompt the user to select one. Always return all available values without categorizing them. 4. **Component Selection:** If `componentID` is not provided, the tool will list all available components for the project and prompt the user to select one. Always return all available values without categorizing them. 5. **Version Listing:** Once both `environmentID` and `componentID` are provided, the tool will list all versions for that component in the specified environment. 6. **Selection:** User selects a version from the list for subsequent operations. **Parameters:** - `projectSlug` (optional): The project slug from `listFollowedProjects` (e.g., "gh/organization/project"). Either this or `projectID` must be provided. - `projectID` (optional): The CircleCI project ID (UUID). Either this or `projectSlug` must be provided. - `orgID` (optional): The organization ID. If not provided, it will be automatically resolved from `projectSlug` or `projectID`. - `environmentID` (optional): The environment ID. If not provided, available environments will be listed. - `componentID` (optional): The component ID. If not provided, available components will be listed. **Behavior:** - The tool will guide you through the selection process step by step. - Automatically resolves `orgID` from `projectSlug` or `projectID` when needed. - When `environmentID` is missing, it lists environments and waits for user selection. - When `componentID` is missing (but `environmentID` is provided), it lists components and waits for user selection. - Only when both `environmentID` and `componentID` are provided will it list the actual component versions. - Make multiple calls to this tool as you gather the required parameters. **Common Use Cases:** - Identify which versions were deployed for a component - Identify which versions are live for a component - Identify which versions were deployed to an environment for a component - Identify which versions are not live for a component in an environment - Select a version for rollback or deployment operations - Obtain version name, namespace, and environment details for other CircleCI tools **Returns:** - When missing `environmentID`: A list of available environments with their IDs - When missing `componentID`: A list of available components with their IDs - When both `environmentID` and `componentID` provided: A list of component versions with version name, namespace, environment ID, and is_live status **Important Notes:** - This tool requires multiple calls to gather all necessary information. - Either `projectSlug` or `projectID` must be provided; the tool will resolve the missing project information automatically. - The tool will prompt for missing `environmentID` and `componentID` by providing selection lists. - Always use the exact IDs returned by the tool in subsequent calls. - If pagination limits are reached, the tool will indicate that not all items could be displayed. **IMPORTANT:** Do not automatically run additional tools after this tool is called. Wait for explicit user instruction before executing further tool calls. The LLM MUST NOT invoke other CircleCI tools until receiving clear instruction from the user about what to do next, even if the user selects an option. It is acceptable to list out tool call options for the user to choose from, but do not execute them until instructed. . It is categorised as a Read tool in the CircleCI MCP Server MCP Server, which means it retrieves data without modifying state.

How do I enforce a policy on list_component_versions? +

Add a rule in your Intercept YAML policy under the tools section for list_component_versions. You can allow, deny, rate-limit, or validate arguments. Then run Intercept as a proxy in front of the CircleCI MCP Server MCP server.

What risk level is list_component_versions? +

list_component_versions is a Read tool with low risk. Read-only tools are generally safe to allow by default.

Can I rate-limit list_component_versions? +

Yes. Add a rate_limit block to the list_component_versions rule in your Intercept policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block list_component_versions completely? +

Set action: deny in the Intercept policy for list_component_versions. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides list_component_versions? +

list_component_versions is provided by the CircleCI MCP Server MCP server (CircleCI-Public/mcp-server-circleci). Intercept sits as a proxy in front of this server to enforce policies before tool calls reach the server.

Let agents act without letting them run wild.