Bitrise MCP Server for App Management & Builds

Overview

The Bitrise MCP Server is a lightweight Model Context Protocol (MCP) server that exposes Bitrise functionality over an internal HTTP API. It wraps Bitrise Platform APIs to provide common app management, build orchestration, and artifact retrieval operations in a consistent, API-driven way suitable for integrating with developer tools, chatops agents, or other automation layers.

This server is useful when you want a single, controlled gateway to Bitrise operations (list apps, trigger builds, fetch artifacts) driven by tokens and simple endpoints. Because it implements MCP-style routing, it can be plugged into contexts where language models or other services request structured operations against your CI/CD platform without directly embedding Bitrise API calls.

Features

• Comprehensive access to Bitrise resources: apps, builds, artifacts, build triggers
• Token-based authentication against Bitrise API (uses a Bitrise Personal Access Token)
• Simple MCP-style HTTP endpoints designed for integration with automation tools and model-driven clients
• Docker-friendly deployment and configurable via environment variables
• Request/response logging and basic error handling
• Extensible: additional endpoints can be added for organization-level or workflow-specific operations

Installation / Configuration

Prerequisites:

• Go toolchain (if building from source) or Docker
• A Bitrise Personal Access Token with appropriate scopes

Run via Docker (recommended for quick start):

# build and run locally with Docker
docker build -t bitrise-mcp:latest .
docker run -e BITRISE_TOKEN=your_token_here -p 8080:8080 bitrise-mcp:latest

Run from source (Go):

git clone https://github.com/bitrise-io/bitrise-mcp.git
cd bitrise-mcp
# set environment variables and run
export BITRISE_TOKEN="your_token_here"
export PORT="8080"
go run ./cmd/server

Common environment variables:

Example configuration file (optional):

{
  "port": 8080,
  "log_level": "info",
  "bitrise_token_env": "BITRISE_TOKEN"
}

API Overview / Available Resources

The server exposes MCP-style endpoints under a base path (e.g., /mcp). Typical resource routes include:

• GET /mcp/apps — list Bitrise apps visible to the token
• GET /mcp/apps/:app_slug — get app details
• GET /mcp/apps/:app_slug/builds — list builds for an app
• POST /mcp/apps/:app_slug/builds — trigger a new build (payload: workflow, branch, env vars)
• GET /mcp/builds/:build_slug — get build details and status
• GET /mcp/builds/:build_slug/artifacts — list artifacts for a build
• GET /mcp/artifacts/:artifact_slug/download — redirect / return artifact download link

These endpoints translate to the equivalent Bitrise REST API calls and normalize response structures for easier consumption by downstream tools.

Use Cases

1. Automating a release workflow

   • A release bot calls POST /mcp/apps/:app_slug/builds with {“workflow”:“release”,“branch”:“main”,“envs”:[{“key”:“RELEASE_NOTES”,“value”:“…”}]} to trigger a signed release build, then polls GET /mcp/builds/:build_slug until finished. After success, it fetches artifacts via GET /mcp/builds/:build_slug/artifacts and uploads them to a distribution channel.

2. Chatops integration

   • An internal chat assistant uses GET /mcp/apps to display available projects, then invokes a build from a chat command. The MCP server acts as a stable API surface so the assistant code doesn’t need to implement Bitrise authentication logic.

3. Artifact auditing and storage

   • A CI workflow lists recent builds for a given app and downloads artifacts to a long-term storage provider for compliance or archival purposes.

Examples

List apps:

curl -s -H "Authorization: Bearer $BITRISE_TOKEN" http://localhost:8080/mcp/apps

Trigger a build:

curl -X POST http://localhost:8080/mcp/apps/abcd1234/builds \
  -H "Authorization: Bearer $BITRISE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "workflow": "deploy",
    "branch": "main",
    "envs": [{"key":"EXTRA_FLAG","value":"1"}]
  }'

Get artifacts:

curl -H "Authorization: Bearer $BITRISE_TOKEN" http://localhost:8080/mcp/builds/buildslug123/artifacts

Security and Operational Notes

• Keep BITRISE_TOKEN secret; use environment variable injection or secret managers in production.
• The server does not replace Bitrise access controls; token scopes determine what the MCP server can do.
• Implement rate limiting and request auditing at the edge if exposing the server to multiple clients.
• Logs may contain request metadata but avoid logging full tokens or sensitive environment variables.

Resources

• GitHub repository: https://github.com/bitrise-io/bitrise-mcp
• Bitrise API docs: https://api-docs.bitrise.io/ (refer for scopes and resource details)
• Example configs and additional docs are available in the repo under /docs (installation guides for various IDEs and CLIs)