feat: add Jenkins plugin with Kerberos/SAML SSO authentication

[rjeffman]

What's New

Jenkins Plugin

• Browse jobs, folders, and views with health scores
• Get build details, logs, and test results (JUnit)
• Analyze pipeline stages with per-stage logs
• Download and inspect artifacts
• Smart caching (5min TTL, permanent for completed builds)
• Automatic secret redaction (AWS keys, JWTs, passwords, connection strings)

Kerberos/SAML Authentication

• Dynamic SPN derivation from request hostname
• Automatic SAML POST binding detection and replay
• Per-request domain allowlisting for SSO redirects
• Enhanced config variable resolver: |hostname modifier, nested defaults

Tools: 15 tools total (4 primary, 11 deferred)

• jenkins_list_jobs, jenkins_get_build, jenkins_get_build_log, jenkins_whoami
• jenkins_get_pipeline_stages, jenkins_get_test_results, jenkins_list_artifacts, etc.

Changes

• Add internal/proxy/saml.go - SAML SSO redirect handler
• Add internal/auth/kerberos_provider.go - dynamic SPN support
• Add plugins/jenkins/ - complete plugin with tests
• Update golang.org/x/net to fix HTTP/2 vulnerability (GO-2026-4918)

[decko]

I think you need to rebase your work with current changes on wtmcp core @rjeffman. Let me know so we can help with the review of Jenkins plugin again

[sergio-correia]

Looks good overall. I pointed out a few issues that should be addressed.

[sergio-correia]

Cache keys don't include the Jenkins URL, but the plugin accepts jenkins_url per-request. If someone queries two different Jenkins instances in the same session, the second call returns cached data from the first.

For example, jenkins:whoami is a static key shared across all instances. Same for jenkins:jobs:{folder_hash} when two servers have identically named folders (extremely common in enterprise).

Please add a URL-derived hash to every cache key. Something like:

url_hash = _cache_key_hash(handler._jenkins_url)
cache_key = f"jenkins:{url_hash}:whoami"

A _make_cache_key(*parts) helper that auto-includes the URL hash would prevent regressions across all 15 tools.

[sergio-correia]

The JENKINS_URL env var fallback in _setup_url() reads from handler.config.get("JENKINS_URL"), but there is no config: section in this file. The core only populates handler.config from manifest.Config plus internal fields (_session_dir, _output_dir).

Without this, every user who sets JENKINS_URL in env.d/jenkins.env and calls a tool without passing jenkins_url explicitly will get an invalid jenkins_url: '' error. The fallback advertised in the tool descriptions never works.

Please add after the env: block:

config:
  jenkins_url: "${JENKINS_URL}"

Then update tools_read.py:31 to handler.config.get("jenkins_url", "") (lowercase, matching the config key).

[sergio-correia]

The wfapi/log endpoint returns JSON like {"text": "<log content>", "length": N, "hasMore": false}. The proxy parses this into a dict, so body here is a dict, not a string. scrub_log_content() returns "" for non-string input, so this will always produce an empty log against a real Jenkins instance.

The tests mask this because they mock body as a plain string.

Please extract the text field before scrubbing:

if isinstance(body, dict):
    log_text = body.get("text", "")
elif isinstance(body, str):
    log_text = body
else:
    log_text = ""
scrubbed_log = helpers.scrub_log_content(log_text)

[sergio-correia]

The core returns {"ok": true, "count": N} for cache_flush, not {"status": "ok"}. This means cache_flush() always returns False, so jenkins_flush_cache always reports failure even though the cache was actually flushed.

Also, the namespace parameter is ignored by the core (it always uses the plugin's own namespace). The jira plugin's simpler pattern is the right reference here:

def cache_flush():
    _send({"id": _gen_id("cache"), "type": "cache_flush"})
    resp = _recv()
    return resp.get("ok", False)

[sergio-correia]

This caches permanently with no checks, but every other tool guards against two things before caching: (1) whether the build is still running, and (2) whether build_number is an alias like lastBuild.

Without the running-build check, partially written artifacts get permanently cached. Without the alias check, lastBuild artifacts get frozen to whatever build was current at first fetch.

Please add the same pattern used in jenkins_get_build and jenkins_get_build_log:

build_path = f"/{helpers.job_path(job_name)}/{build_number}/api/json"
build_status, build_body, _ = handler.http("GET", build_path, query={"tree": "building"})
building = build_body.get("building", False) if build_status in (200, 201) else False
if not building:
    try:
        int(build_number)
        handler.cache_set(cache_key, result, ttl=0)
    except (ValueError, TypeError):
        pass

[sergio-correia]

The JUnit XML spec defines errors alongside failures on <testsuite>. Errors represent unexpected exceptions (distinct from assertion failures). This line computes passed = total - failed - skipped without accounting for errors.

A testsuite with tests="10" failures="1" errors="3" skipped="0" would report 9 passed when only 6 actually passed. The <error> child elements on testcases are also not scanned, so those test cases silently disappear from the results.

Please add suite_errors = int(testsuite.get("errors", 0)) and include it: passed = total - failed - errors - skipped. Also scan for <error> elements alongside <failure>.