build_job

What build_job does on Ncp

AI agents invoke build_job to trigger actions in Ncp. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why build_job is rated High

This tool triggers Jenkins builds, which execute code and external operations whose effects depend on the job configuration and arguments. This is Execute-category (runs code/triggers external operations) rather than Write (would merely create/modify data reversibly). The severity is high because a malicious build trigger could deploy compromised code, modify infrastructure, or disrupt services.

From the tool's definition Tool name 'build_job' with description 'Trigger Jenkins job build' indicates execution of external CI/CD operations. Jenkins jobs can run arbitrary code, deploy applications, or trigger production changes.

The rule that runs build_job safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Ncp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For build_job, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "build_job": {
      "limits": [
        {
          "counter": "build_job_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about build_job