Agentic CI/CD MCP Orchestrator

Python MCP server for GitHub Actions failure diagnosis, LLM-driven unified-diff auto-repair PR creation, and governed release orchestration.

What this provides

• MCP tooling to inspect failed workflow runs using commit, logs, and test signals.
• LLM diagnosis flow powered by OpenAI gpt-4o-mini.
• Governance layer to auto-fix low-risk issues and require human review for risky changes.
• Generic model-driven repair loop (up to 3 attempts) using unified diff patches.
• GitHub Actions workflows for CI, repair orchestration, and release policy gating.

Project layout

• mcp_server/main.py - MCP tools and orchestration entrypoints
• mcp_server/run_repair.py - workflow-safe command runner
• mcp_server/config.py - typed environment config
• mcp_server/tools/* - GitHub, diagnosis, risk, and PR automation modules
• .github/workflows/* - CI/CD automation workflows

Setup

1. Create and activate a virtual environment.
2. Install dependencies:
   • pip install -r requirements.txt
3. Copy environment defaults:
   • cp .env.example .env (or create .env manually on Windows)
4. Fill in required values (OPENAI_API_KEY, GITHUB_TOKEN).

Run MCP server locally

• python -m mcp_server.main

Use in Cursor as MCP

• MCP config is included at .cursor/mcp.json.
• Restart Cursor so it loads the MCP server definition.
• Ensure your .env has OPENAI_API_KEY and GITHUB_TOKEN.
• In Cursor chat, call tools from agentic-cicd-orchestrator with:
  • repository: owner/repo
  • run_id: workflow run id (integer)
• Main tools:
  • inspect_pipeline_failure
  • orchestrate_autofix

Run repair orchestration manually

• Set REPOSITORY (for example org/repo).
• Optional:
  • RUN_ID (if omitted, latest failed run is auto-selected)
  • WORKFLOW_NAME (filter latest failed run by workflow name, e.g. ci)
  • BASE_BRANCH (default main)
• Execute: python -m mcp_server.run_repair

LLM auto-repair controls

• MAX_REPAIR_ATTEMPTS - number of patch generation/application retries (default 3).
• PATCH_STRATEGY - patch format expected from model (must be unified_diff).
• LLM_PATCH_MAX_CHARS - upper bound on patch payload size.

Governance model

• risk_score < RISK_AUTO_FIX_THRESHOLD -> autonomous auto-fix PR path.
• RISK_AUTO_FIX_THRESHOLD <= risk_score < RISK_HUMAN_REVIEW_THRESHOLD -> human approval required.
• risk_score >= RISK_HUMAN_REVIEW_THRESHOLD or high-risk file categories -> blocked/review-only path.
• FORCE_AUTOFIX_ALL=true -> bypass thresholds and force auto-fix path (dangerous; use only in controlled testing).

Security notes

• Use least-privilege GitHub credentials.
• Keep production deployment credentials separate from auto-repair identity.
• Review generated PRs and audit artifacts before enabling automerge in production.