This server handles a Codemagic API token. That token can read build logs from pipelines that sign and publish mobile apps, and — if you enable it — start new builds. This document is an honest account of what the server does with it, what it protects you from, and what it does not.

What the server can see. Whatever your Codemagic API token can see: your applications, their workflows and branches, your builds, and your build logs. Build logs are the sensitive part — they contain whatever your build scripts printed, which in practice often includes decoded signing material.

What the server can do. By default: nothing but read. With CODEMAGIC_MCP_ALLOW_BUILDS=true it can also start and cancel builds.

Who the adversary is. Three of them, in decreasing order of likelihood:

1. Accidental disclosure. A build log containing a .p8 key ends up in a model's context and then in a chat transcript, a support ticket, or a training corpus. This is the common case and the one this server is built around.
2. A malicious or manipulated prompt. Something in a repository, an issue, or a log tells the agent to exfiltrate the token or trigger a release build. The agent is not trusted to say no.
3. A compromised dependency. A supply-chain attack on something this server imports.

These are enforced in code, not by convention, and each is covered by a test:

• Send your token anywhere but Codemagic. Egress is restricted by an http.RoundTripper to api.codemagic.io and codemagic.io, over HTTPS only. A redirect to any other host is refused. There is no configuration flag, no CLI argument, and no tool parameter that can widen this — the base URLs are compile-time constants.
• Return your token. The token is read only from CODEMAGIC_API_TOKEN. It is never a tool parameter, never written to disk, and never included in an error message. Its literal value is matched and replaced in every string the server returns.
• Skip redaction. Redaction runs as MCP middleware on every result, so no tool can opt out. There is deliberately no disableRedaction flag: an agent under instruction could flip one.
• Read your environment variable values. The server never calls the endpoints that return them. Group and variable names only.
• Start a build you did not enable. Mutating tools refuse unless CODEMAGIC_MCP_ALLOW_BUILDS=true was set in the environment that launched the server — which an agent cannot change at runtime.
• Write to your disk. The server never writes a file. register is a separate subcommand you run yourself, and even it writes only an environment variable reference, never the value.
• Phone home. No telemetry, no analytics, no update check, no error reporting.

Every string the server returns passes through, in this order:

1. The literal value of CODEMAGIC_API_TOKEN, anywhere, in any context.
2. PEM blocks (-----BEGIN … ----- … -----END … -----) → [REDACTED: PEM BLOCK]. This is what catches App Store Connect .p8 keys and service-account RSA keys.
3. JWTs → [REDACTED: JWT].
4. Base64 runs of 120 characters or more → [REDACTED: BASE64 BLOB]. This catches keystores and base64-encoded credentials.
5. key=value and "key": "value" pairs whose key is sensitive → value replaced, key kept.
6. Credentials embedded in URLs (https://user:pass@host) → credential replaced.
7. Query strings on URLs that plausibly carry a signature → replaced.
8. Base64 runs in the URL-safe alphabet (- and _ instead of + and /) → replaced. This is the shape Codemagic uses to sign artifact download URLs, and it puts the signature in the URL path, where there is no query string to strip.

A pre-signed artifact URL grants download access without the API token, so list_artifacts does not return one at all — names, sizes and types only. Redaction rule 8 is the backstop for a signed URL arriving through some other path, such as a build script echoing one into its log.

Sensitive keys are matched per word, not per substring: Authorization, x-auth-token, and APP_STORE_CONNECT_PRIVATE_KEY match, while author_name does not. Matching substrings would redact every commit author in your build history.

Redaction is heuristic defence-in-depth, not a proof. It is a second line of defence behind "do not print secrets in your build scripts", and it will not save you from a determined leak.

Specifically:

• A secret in an unrecognised shape survives. A 40-character hex API key printed on its own, with no key name next to it, looks exactly like a git commit hash. There is no rule that can tell them apart, and this server does not try.
• A deliberately obfuscated secret survives. A key split across lines, reversed, ROT13'd, or printed one character per line is not detected.
• Redaction runs on output, not on the wire. The full log is fetched from Codemagic before it is filtered. Nothing is written to disk, but the unredacted text does exist in this process's memory for the duration of the call.
• False positives happen, by design. The rules err toward over-redaction. A log line reading Build description signature: 1a2b3c4d will have its value replaced even though it is a build hash. Losing a hash costs you a retry; losing a signing key costs you a certificate revocation.
• A step log too large for the fetch cap is clipped from the front. The tool says so, but a secret in the undownloaded portion is neither shown nor redacted — it is simply absent.
• The codemagic.io and api.codemagic.io allowlist assumes DNS and TLS are sound. This server does not pin certificates.

If you need a genuinely unredacted log, download it from Codemagic directly, outside this server. That is the correct answer, and there is no flag to make this server do it for you.

• Store it in your shell or secret manager, exported as CODEMAGIC_API_TOKEN.
• codemagic-mcp register writes "CODEMAGIC_API_TOKEN": "${CODEMAGIC_API_TOKEN}" into the MCP config — a reference the client expands at launch. The value never reaches the file, so the generated config is safe to commit.
• Rotate the token in Codemagic → Account settings → API token if you suspect exposure. Revoking it there is immediate and is the only thing that actually helps.
• Give the token the least access that works. Codemagic returns HTTP 404 for resources a token cannot see, and this server reports that as "not found, or not accessible with this token".

The runtime dependency surface is deliberately small — this is a security-sensitive package:

Everything else in go.sum is a transitive dependency of the MCP SDK.

Please report security issues privately rather than opening a public issue:

• Open a confidential issue on the project's issue tracker, or
• Email the maintainer listed in the repository metadata.

Include what you found, how to reproduce it, and what you think the impact is. You will get an acknowledgement within a few days. If the report is valid you will be credited in the changelog unless you would rather not be.

Please do not test against someone else's Codemagic account.