# Circleci

> We build CI/CD tooling to keep the world’s best engineers shipping great code.

---

# Source: https://circleci.com/about.md

  

 

 

# About CircleCI

We build CI/CD tooling to keep the world’s best engineers shipping great code.

## CircleCI is built for builders.

Software delivery is complex and getting more complex every year. Our mission is to keep you on top of it all, so you can deliver great products and enjoy the process.

### Speed

We help developer teams ship quality products faster and more safely

* * *

### Focus

We enable dev experience teams to deliver efficiency for the engineers they support

* * *

### Control

We help great businesses innovate and create happier customers, while keeping the business safe

The CircleCI platform was created by a team of DevOps experts who understand how critical CI/CD is to your entire development process and your entire business. The best software teams know that speed, focus, and consistency of delivery make the difference between good and great.

     

Founded in 2011 in San Francisco with a globally distributed workforce, we build CircleCI to deliver on these promises so you can deliver on yours — to reliably bring only the highest quality products to your customers.

## Meet the CircleCI leadership team

  

### Jim Rose

Chief Executive Officer

  

### Rob Zuber

Chief Technology Officer

  

### Chitra Balasubramanian

Chief Financial Officer

  

### Judson Griffin

Chief Revenue Officer

  

### June Ko

Chief Legal Officer

  

### Blake Buisson

Chief Marketing Officer

  

### JP Leblanc

SVP, Engineering

  

### Tom Trahan

SVP, Business Development

## Trusted by

Nextdoor

Adobe

Okta

Hugging Face

Hinge

---

# Source: https://circleci.com/compare/bitrise-vs-circleci.md

# Bitrise vs CircleCI

Evaluate which CI/CD platform best fits your development workflow with this side-by-side comparison of Bitrise and CircleCI.

## Why choose CircleCI?

Modern apps depend on more than mobile code. CircleCI helps you ship everything behind the app, too. From frontends to backend services, APIs, and infrastructure, CircleCI supports the full software stack in one CI/CD platform, giving you the flexibility to move fast without outgrowing your tooling.

### Feature comparison

| Mobile build infrastructure | CircleCI | Bitrise |
| :-- | --- | --- |
| Hosted macOS machines | Yes | Yes |
| Xcode version management | Yes | Yes |
| Android build support | Yes | Yes |
| Custom resource classes (macOS) | Yes | No |
| iOS simulator support | Yes | Yes |
| Test on real devices | Yes | Yes |

| Workflow configuration and flexibility | CircleCI | Bitrise |
| :-- | --- | --- |
| YAML-based configuration | Yes | Yes |
| Conditional job logic | Yes | Yes |
| Dynamic configuration | Yes | No |
| Reusable components | Yes (Orbs) | No |
| Matrix builds | Yes | No |
| Parameterized workflows | Yes | No |
| Environment variable groups | Yes | Yes |

| Performance and reliability | CircleCI | Bitrise |
| :-- | --- | --- |
| Parallel test execution | Yes | Yes |
| Advanced test splitting | Yes | No |
| Docker layer caching | Yes | No |
| Build caching (non-Docker) | Yes | Yes |
| Flaky test detection | Yes | Yes |
| SSH into failed builds | Yes | Yes |
| Automatic job retries | Yes | Yes |
| Build insights and metrics | Yes (included) | No (paid add-on) |

| Scalability and platform coverage | CircleCI | Bitrise |
| :-- | --- | --- |
| Full-stack CI/CD (mobile, backend, infra) | Yes | No |
| Docker-native execution | Yes | No |
| Windows support | Yes | No |
| Linux support | Yes | Yes |
| Self-hosted runners (macOS, Linux & Windows) | Yes | No |
| Arm support | Yes | No |

| Enterprise readiness | CircleCI | Bitrise |
| :-- | --- | --- |
| SOC 2 Type II certification | Yes | Yes |
| Enterprise SSO (SAML) | Yes | Yes |
| Role-based access controls | Yes | Yes |
| OIDC for cloud auth | Yes | No |
| Audit logs | Yes (included) | No (paid add-on) |
| Org-level policy enforcement | Yes | No |
| Dedicated customer success team | Yes | Yes |

Last updated: June 20, 2025.  Because companies update their features and pricing regularly, some details might have changed since we last checked. We do our best to keep things accurate, but encourage you to do your own research.

## Why teams choose CircleCI

### Ship fast, stay flexible

From Xcode builds to Android emulators, CircleCI gives mobile teams the performance they need. Cut your build times dramatically with test splitting, advanced caching, and the most comprehensive fleet of executors and resource classes available anywhere.

### Run everything in one pipeline

Mobile apps don’t exist in isolation. CircleCI supports backend services, APIs, and infrastructure alongside mobile builds so you can deploy your full stack without juggling multiple CI tools.

### Built-in control and confidence

CircleCI provides the governance and visibility needed to scale CI/CD securely. Teams get audit logs, fine-grained access controls, and org-wide security and compliance policies that keep workflows secure without slowing development down.

### Optimized for developers

CircleCI is built for iteration. Developers can trigger workflows with parameters, debug jobs over SSH, and automate repetitive tasks through APIs, CLI tools, and AI integrations, all from their editor.

Moshi

> “Without CircleCI, we’d be pushed back to the Stone Age; today, there’s no wasted time.”
> 
>   Enzo Belli | Senior Android Developer at Moshi
> 
> [Read more](/case-studies/moshi/)

---

# Source: https://circleci.com/compare/buildkite-vs-circleci.md

# Buildkite vs CircleCI

Explore the differences between CircleCI and Buildkite Pipelines to choose the right CI/CD platform for speed, scale, and long-term success.

## Why choose CircleCI?

CircleCI is a fully managed CI/CD platform that runs at scale in the cloud, with minimal ops overhead. While Buildkite Pipelines now offers both self-hosted and hosted agent options, their hosted solution still requires customers to manage queue configurations and scaling parameters. CircleCI has been cloud-native from day one with more mature tooling and enterprise features in the managed space.

### Feature comparison

| Platform & infrastructure | CircleCI | Buildkite |
| :-- | --- | --- |
| Cloud-hosted platform | Yes | Yes |
| Self-managed option | Yes | Yes |
| Fully managed agents | Yes | Yes |
| Auto-scaling compute without queue configuration | Yes | No |
| Container-native workflows | Yes | No |
| VCS integrations (GitHub, GitLab, Bitbucket) | Yes | Yes |

| Execution environments | CircleCI | Buildkite |
| :-- | --- | --- |
| Hosted macOS & Linux envs | Yes | Yes |
| The most hosted envs (Windows incl) | Yes | No |
| Docker and Kubernetes support | Yes | Yes |
| Arm and GPU (hosted) | Yes | No |
| Custom build environments | Yes | Yes |
| Self-hosted runners | Yes | Yes |

| Performance and workflow | CircleCI | Buildkite |
| :-- | --- | --- |
| Advanced caching | Yes | Yes |
| Test splitting and parallelism | Yes | No |
| Dynamic configuration | Yes | No |
| Built-in release management | Yes | No |
| Manual and scheduled triggers | Yes | Yes |

| Enterprise features | CircleCI | Buildkite |
| :-- | --- | --- |
| SOC 2 Type II compliance | Yes | Yes |
| Usage controls | Yes | No |
| Org-wide config policy enforcement | Yes | No |

| Developer experience | CircleCI | Buildkite |
| :-- | --- | --- |
| CLI tool | Yes | Yes |
| VS Code extension | Yes | No |
| Detailed build insights dashboard | Yes | No |
| Usage and cost analytics | Yes | No |

Last updated: October 14, 2025.  Because companies update their features and pricing regularly, some details might have changed since we last checked. We do our best to keep things accurate, but encourage you to do your own research.

## Why teams choose CircleCI

### Zero infrastructure burden

With CircleCI, there’s no need to provision or manage build agents or configure queue scaling. Everything runs on CircleCI-managed infrastructure with true auto-scaling, so your team can focus on delivering software.

### Fast, intelligent pipelines

CircleCI offers advanced caching, parallelism, test splitting, and job orchestration—speeding up every commit and reducing flakiness.

### Cloud-native scale

Whether you’re running 10 builds or 10,000, CircleCI automatically scales to meet your needs, without you touching a single VM.

### Designed for developer productivity

From our CLI and VS Code extension to our automated insights and performance metrics, CircleCI is built to empower engineering teams.

gtlogic

> “CircleCI significantly increased the productivity of the team to be able to ship more features, more confidently, and in less time.”
> 
>   Rawan Moukalled | Senior Front End Engineer at gtlogic
> 
> [Read more](/case-studies/gtlogic/)

---

# Source: https://circleci.com/compare/github-actions-vs-circleci.md

# GitHub Actions vs CircleCI

Make an informed choice for your continuous integration and delivery needs with this detailed comparison of GitHub Actions and CircleCI.

## Why choose CircleCI?

CircleCI is a dedicated CI/CD platform built for teams who need advanced pipeline orchestration, superior performance, and enterprise-grade support. Our platform delivers industry-leading build times, advanced security features, and the scalability to handle any workload.

### Feature comparison

| Pipeline configuration and management | CircleCI | GitHub Actions |
| :-- | --- | --- |
| YAML-based configuration | Yes | Yes |
| Centralized configuration management | Yes | No |
| Pipeline parameters | Yes | Yes |
| Conditional workflows | Yes | Yes |
| Dynamic pipelines | Yes | No |
| Reusable components | Yes (Orbs) | Yes (Actions) |
| Matrix builds | Yes | Yes |

| Performance and optimization | CircleCI | GitHub Actions |
| :-- | --- | --- |
| Docker layer caching | Yes | No |
| Parallel execution | Yes | Yes |
| Flexible resource allocation | Yes | No |
| Automatic retry of failed jobs | Yes | No |
| Flaky test detection | Yes | No |
| Test splitting & parallelization | Yes | No |
| Custom resource classes | Yes | No |
| Usage API | Yes | No |

| Environment support | CircleCI | GitHub Actions |
| :-- | --- | --- |
| Cloud-hosted runners | Yes | Yes |
| On-premises installation | Yes (Server) | No |
| Linux environment | Yes | Yes |
| Windows environment | Yes | Yes |
| macOS environment | Yes | Yes |
| Docker environment | Yes | No |
| Arm support | Yes | Yes |
| GPU support | Yes | Yes |

| Enterprise features | CircleCI | GitHub Actions |
| :-- | --- | --- |
| Multi-VCS support | Yes | No |
| SOC 2 Type II certification | Yes | Yes |
| Detailed audit logs | Yes | Yes |
| Enterprise SSO | Yes | Yes |
| OIDC support | Yes | Yes |
| Org-wide policy enforcement | Yes | No |
| Priority support | Yes | No |
| Technical account managers | Yes | No |

| Developer tools | CircleCI | GitHub Actions |
| :-- | --- | --- |
| CLI tool | Yes | Yes |
| VS Code extension | Yes | Yes |
| REST API | Yes | Yes |
| Webhooks | Yes | Yes |
| SSH debugging | Yes | No |
| Advanced analytics | Yes | No |
| Secrets management | Yes | Yes |

Last updated: April 15, 2025.  Because companies update their features and pricing regularly, some details might have changed since we last checked. We do our best to keep things accurate, but encourage you to do your own research.

## Why teams choose CircleCI

### Superior performance

Teams consistently report faster build times with CircleCI’s advanced caching and optimized infrastructure.

### Enterprise-grade support

Our dedicated support team and technical account managers ensure your success with 24/7 availability.

### Advanced features

From sophisticated caching to custom resource classes, CircleCI provides the tools needed for complex CI/CD pipelines.

### Platform independence

Unlike GitHub Actions, CircleCI works seamlessly with any Git provider, offering greater flexibility and avoiding vendor lock-in.

Voiceflow

     

> “CircleCI was super-easy to set up; the maturity and the robustness of the tool was perfect and fits well with our needs.”
> 
>   Xavier Portilla Edo | Infrastructure Team Lead at Voiceflow
> 
> [Read more](/case-studies/voiceflow/)

---

# Source: https://circleci.com/compare/harness-vs-circleci.md

# Harness vs CircleCI

Choose the right CI/CD platform for your team with this in-depth comparison of CircleCI and Harness CI, focused on speed, flexibility, and enterprise control.

## Why choose CircleCI?

CircleCI is a performance-driven CI/CD platform built for engineering teams who prioritize speed, reliability, and flexibility. Unlike Harness, which leans heavily on CD features and abstraction layers, CircleCI empowers developers with precise control over pipelines, unmatched speed, and deep customization.

### Feature comparison

| Pipeline configuration and management | CircleCI | Harness |
| :-- | --- | --- |
| YAML-based configuration | Yes | Yes |
| Parameterized workflows | Yes | Yes |
| Dynamic pipelines (GA) | Yes | No |
| Conditional logic | Yes | No |

| Performance and optimization | CircleCI | Harness |
| :-- | --- | --- |
| Test splitting & parallelism | Yes | No |
| Most current resource classes | Yes | No |
| Optimized build startup | Yes | No |

| Environment support | CircleCI | Harness |
| :-- | --- | --- |
| Cloud-hosted runners | Yes | Yes |
| On-premises installation | Yes (Server) | Yes |
| Linux environment | Yes | Yes |
| Windows environment | Yes | Yes |
| GA macOS environment | Yes | No |
| Docker environment | Yes | Yes |
| ARM environment | Yes | Yes |
| GPU environment | Yes | No |

| Enterprise features | CircleCI | Harness |
| :-- | --- | --- |
| Multi-VCS support | Yes | No |
| Org-wide policy enforcement | Yes | Yes |
| Fine-grained RBAC | Yes | Yes |
| Detailed audit logs | Yes | Yes |
| API extensibility | Yes | No |
| Dedicated customer engineers | Yes | No |

| Developer tools | CircleCI | Harness |
| :-- | --- | --- |
| CLI tool | Yes | No |
| VS Code extension | Yes | No |
| in-app SSH debugging | Yes | No |
| Pipeline analytics | Yes | No |
| Shared infrastructure components | Yes | No |

Last updated: April 10, 2025.  Because companies update their features and pricing regularly, some details might have changed since we last checked. We do our best to keep things accurate, but encourage you to do your own research.

## Why teams choose CircleCI

### Built for speed

CircleCI offers lightning-fast build performance thanks to advanced caching, parallelism, and resource optimization.

### Unmatched flexibility

CircleCI gives teams granular control over CI/CD pipelines, making it ideal for complex workflows and multi-cloud environments.

### Open and extensible

Harness offers opinionated CD pipelines, while CircleCI gives developers the freedom to integrate with any stack, service, or Git provider.

### End-to-end delivery

CircleCI supports full CI/CD pipelines with native deployment jobs and environment promotion workflows.

Klara

> “CircleCI connects our processes and pipelines and brings visibility into our coding environment, offering efficiency and rapid, high performance.”
> 
>   Valentin Ranshakov | QA Lead at Klara
> 
> [Read more](/case-studies/klara/)

---

# Source: https://circleci.com/compare/jenkins-vs-circleci.md

# Jenkins vs CircleCI

Choosing the right CI/CD platform is critical to the success of your business. This detailed comparison of CircleCI and Jenkins will help you make an informed decision.

## Why choose CircleCI?

CircleCI is designed to meet the demands of modern development teams, offering a fast, reliable, and low-maintenance platform for continuous integration and delivery. With managed infrastructure, straightforward configuration, and advanced developer tools, CircleCI helps teams reduce setup time, improve collaboration, and focus on delivering quality software.

### Feature comparison

| Pipeline configuration | CircleCI | Jenkins |
| :-- | --- | --- |
| YAML-based configuration | Yes | No |
| Pipeline parameters | Yes | Yes |
| Reusable components | Yes (Orbs) | No |
| Centralized configuration management | Yes | No |
| Dynamic pipelines | Yes | No |
| Conditional workflows | Yes | Yes |
| Matrix builds | Yes | Yes |

| Performance & optimization | CircleCI | Jenkins |
| :-- | --- | --- |
| Docker layer caching | Yes | Yes (plugin required) |
| Parallel execution | Yes | Yes |
| Automatic test splitting | Yes | No |
| Flaky test detection | Yes | No |
| Automatic retry of failed jobs | Yes | No |
| Custom resource classes | Yes | No |
| Prebuilt executor images | Yes | No |

| Infrastructure | CircleCI | Jenkins |
| :-- | --- | --- |
| Fully managed infrastructure | Yes | No |
| Cloud-hosted runners | Yes (Server) | No |
| On-premises installation | Yes | Yes |

| Environment support | CircleCI | Jenkins |
| :-- | --- | --- |
| Linux, Windows, macOS environments | Yes | Yes |
| Docker environment | Yes | Yes |
| GPU support | Yes | Yes (plugin required) |
| Arm support | Yes | Yes |

| Enterprise features | CircleCI | Jenkins |
| :-- | --- | --- |
| Multi-VCS support | Yes | Yes |
| SOC 2 Type II certification | Yes | No |
| Detailed audit logs | Yes | Yes (plugin required) |
| Enterprise SSO | Yes | Yes (plugin required) |
| OIDC support | Yes | Yes (plugin required) |
| Org-wide policy enforcement | Yes | No |
| 24/7 priority support | Yes | No |
| Technical account managers | Yes | No |

| Developer tools | CircleCI | Jenkins |
| :-- | --- | --- |
| CLI tool | Yes | Yes |
| REST API | Yes | Yes |
| Webhooks | Yes | Yes |
| SSH debugging | Yes | No |
| Advanced analytics | Yes | No |
| Secrets management | Yes | Yes |
| Native mobile testing support | Yes | No |

Last updated: April 15, 2025.  Because companies update their features and pricing regularly, some details might have changed since we last checked. We do our best to keep things accurate, but encourage you to do your own research.

## Why teams choose CircleCI

### Minimal maintenance

CircleCI’s managed infrastructure eliminates the need to maintain servers or install plugins.

### Faster development cycles

Industry-leading speed with unlimited parallelism and built-in caching accelerates builds and delivers faster feedback.

### Developer-friendly tools

Features like SSH debugging and reusable configurations reduce friction and make CI/CD pipelines easier to manage.

### Enterprise-ready platform

CircleCI delivers SOC 2 compliance, advanced audit logs, and 24/7 support for secure, scalable operations.

RepairPal

> “The time we spent on Jenkins was a lot of work and frustration; CircleCI is leaps and bounds ahead of everyone else.”
> 
>   Nick Roosevelt | Senior Software Engineer at RepairPal
> 
> [Read more](/case-studies/repairpal/)

---

# Source: https://circleci.com/product/mcp.md

# CircleCI MCP Server

Connect your AI assistant to your CircleCI data to debug failures, analyze test results, and improve pipelines using natural language.

   

## CI/CD context for AI tools

The CircleCI MCP server makes your build system understandable by AI tools like Cursor, Claude Code, Windsurf, and more. It’s built on the Model Context Protocol (MCP), a lightweight standard that allows LLM-powered agents to fetch structured data from external systems.

By connecting to the CircleCI MCP Server, agents gain real-time visibility into:

*   Build logs and test outputs
*   Pipeline statuses
*   Recent configuration changes
*   Workflow performance metrics

That means instead of digging through job logs or dashboard UIs, you can ask:

```plaintext
why did my last build fail?
```

and get all the context you need to fix the issue and keep moving without breaking stride.

## Turn build data into action

Once installed, the MCP server makes your CI/CD data accessible through natural language. LLM-based tools can:

*   **Diagnose failing builds**  
    Get structured error summaries and logs.
  
*   **Trace failures to recent changes**  
    Connect regressions to commits, diffs, or workflows.
  
*   **Spot flaky tests**  
    Surface instability patterns from test history.
  
*   **Recommend improvements**  
    Suggest config or timing optimizations in context.
  
*   **Bring CI data into your editor**  
    Use LLM tools to reason through builds without switching tabs.

With access to both code and build context, these tools can help you fix bugs faster, ship changes with confidence, and stay focused on the work that matters.

## Get started with MCP

The CircleCI MCP Server runs locally and integrates with a variety of editors and LLM development tools.

Below are ready-to-use configuration examples to help you install the MCP server in your preferred environment.

### Prerequisites

Before setting up your IDE, make sure you have the following:

*   **[CircleCI Personal API Token (PAT)](https://circleci.com/docs/guides/toolkit/managing-api-tokens/#creating-a-personal-api-token):**
    *   Go to **[User Settings > Personal API Tokens](https://app.circleci.com/settings/user/tokens)**
    *   Click **Create New Token**
    *   Copy and store it securely — you’ll use it as `CIRCLECI_TOKEN` during setup
*   **For NPX installation:**
    *   [pnpm package manager](https://pnpm.io/installation)
    *   Node.js version ≥ 18.0.0
*   **For Docker installation:**
    *   [Docker](https://docs.docker.com/get-docker/)

### Configuration instructions

Cursor

**Using NPX:**

```

{
  "mcpServers": {
    "circleci-mcp-server": {
      "command": "npx",
      "args": ["-y", "@circleci/mcp-server-circleci@latest"],
      "env": {
        "CIRCLECI_TOKEN": "your-circleci-token",
        "CIRCLECI_BASE_URL": "https://circleci.com"
      }
    }
  }
}
    
```

**Using Docker:**

```

{
  "mcpServers": {
    "circleci-mcp-server": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-e", "CIRCLECI_TOKEN",
        "-e", "CIRCLECI_BASE_URL",
        "circleci/mcp-server-circleci"
      ],
      "env": {
        "CIRCLECI_TOKEN": "your-circleci-token",
        "CIRCLECI_BASE_URL": "https://circleci.com"
      }
    }
  }
}
    
```

[Cursor setup docs](https://docs.cursor.com/context/model-context-protocol#configuring-mcp-servers)

VS Code

**Using NPX:**

```

{
  "inputs": [
    {
      "type": "promptString",
      "id": "circleci-token",
      "description": "CircleCI API Token",
      "password": true
    },
    {
      "type": "promptString",
      "id": "circleci-base-url",
      "description": "CircleCI Base URL",
      "default": "https://circleci.com"
    }
  ],
  "servers": {
    "circleci-mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@circleci/mcp-server-circleci@latest"],
      "env": {
        "CIRCLECI_TOKEN": "${input:circleci-token}",
        "CIRCLECI_BASE_URL": "${input:circleci-base-url}"
      }
    }
  }
}
    
```

**Using Docker:**

```

{
  "inputs": [
    {
      "type": "promptString",
      "id": "circleci-token",
      "description": "CircleCI API Token",
      "password": true
    },
    {
      "type": "promptString",
      "id": "circleci-base-url",
      "description": "CircleCI Base URL",
      "default": "https://circleci.com"
    }
  ],
  "servers": {
    "circleci-mcp-server": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-e", "CIRCLECI_TOKEN",
        "-e", "CIRCLECI_BASE_URL",
        "circleci/mcp-server-circleci"
      ],
      "env": {
        "CIRCLECI_TOKEN": "${input:circleci-token}",
        "CIRCLECI_BASE_URL": "${input:circleci-base-url}"
      }
    }
  }
}
    
```

[VS Code setup docs](https://code.visualstudio.com/docs/copilot/chat/mcp-servers)

Claude Desktop

**Using NPX:**

```

{
  "mcpServers": {
    "circleci-mcp-server": {
      "command": "npx",
      "args": ["-y", "@circleci/mcp-server-circleci@latest"],
      "env": {
        "CIRCLECI_TOKEN": "your-circleci-token",
        "CIRCLECI_BASE_URL": "https://circleci.com"
      }
    }
  }
}
    
```

**Using Docker:**

```

{
  "mcpServers": {
    "circleci-mcp-server": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-e", "CIRCLECI_TOKEN",
        "-e", "CIRCLECI_BASE_URL",
        "circleci/mcp-server-circleci"
      ],
      "env": {
        "CIRCLECI_TOKEN": "your-circleci-token",
        "CIRCLECI_BASE_URL": "https://circleci.com"
      }
    }
  }
}
    
```

Config file location:  
macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`  
Windows: `%APPDATA%\Claude\claude_desktop_config.json`

[Claude Desktop setup docs](https://modelcontextprotocol.io/quickstart/user)

Claude Code

**Using NPX:**

```

claude mcp add circleci-mcp-server -e CIRCLECI_TOKEN=your-circleci-token -- npx -y @circleci/mcp-server-circleci@latest
    
```

**Using Docker:**

```

claude mcp add circleci-mcp-server \
  -e CIRCLECI_TOKEN=your-circleci-token \
  -e CIRCLECI_BASE_URL=https://circleci.com \
  -- docker run --rm -i \
  -e CIRCLECI_TOKEN \
  -e CIRCLECI_BASE_URL \
  circleci/mcp-server-circleci
    
```

[Claude Code setup docs](https://docs.anthropic.com/en/docs/agents-and-tools/claude-code/tutorials#set-up-model-context-protocol-mcp)

Windsurf

**Using NPX:**

```

{
  "mcpServers": {
    "circleci-mcp-server": {
      "command": "npx",
      "args": ["-y", "@circleci/mcp-server-circleci@latest"],
      "env": {
        "CIRCLECI_TOKEN": "your-circleci-token",
        "CIRCLECI_BASE_URL": "https://circleci.com"
      }
    }
  }
}
    
```

**Using Docker:**

```

{
  "mcpServers": {
    "circleci-mcp-server": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-e", "CIRCLECI_TOKEN",
        "-e", "CIRCLECI_BASE_URL",
        "circleci/mcp-server-circleci"
      ],
      "env": {
        "CIRCLECI_TOKEN": "your-circleci-token",
        "CIRCLECI_BASE_URL": "https://circleci.com"
      }
    }
  }
}
    
```

[Windsurf setup docs](https://docs.windsurf.com/windsurf/mcp)

Amazon Q Developer

**Configuration files:**  
Amazon Q Developer stores MCP client configuration in JSON format in `mcp.json` files.  
  
\- Global configuration: `~/.aws/amazonq/mcp.json` (applies to all workspaces)  
\- Workspace configuration: `.amazonq/mcp.json` (specific to the current project)  
  
Both are optional; if both exist, Amazon Q merges them. If a server is defined in both, the workspace config overrides and a warning is shown.

**Using NPX (local MCP server):**

```
{
  "mcpServers": {
    "circleci-local": {
      "command": "npx",
      "args": ["-y", "@circleci/mcp-server-circleci@latest"],
      "env": {
        "CIRCLECI_TOKEN": "your-circleci-token",
        "CIRCLECI_BASE_URL": "https://circleci.com" // optional, required for on-prem only
      },
      "timeout": 60000
    }
  }
}
```

**Using a Self-Managed Remote MCP Server:**

Create a wrapper script (e.g. `circleci-remote-mcp.sh`):

```
#!/bin/bash
export CIRCLECI_TOKEN="your-circleci-token"
npx mcp-remote http://your-circleci-remote-mcp-server-endpoint:8000/mcp --allow-http
```

Make it executable:

```
chmod +x circleci-remote-mcp.sh
```

Then add it to Amazon Q Developer:

```
q mcp add --name circleci --command "/full/path/to/circleci-remote-mcp.sh"
```

**IDE Integration:**  
You can also add servers through the [Amazon Q MCP configuration UI](https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/mcp-ide.html#mcp-ide-configuration-access-ui):

*   Choose global or workspace scope (`~/.aws/amazonq/mcp.json` vs `.amazonq/mcp.json`)
*   Enter a server name (e.g. `circleci-remote-mcp`)
*   Set transport protocol: `stdio`
*   Set command: the wrapper script path (e.g. `/full/path/to/circleci-remote-mcp.sh`)
*   Save configuration

Install with Smithery

```

npx -y @smithery/cli install @CircleCI-Public/mcp-server-circleci@latest --client claude
    
```
    

## Available tools

From accelerating AI-driven development to orchestrating agentic workflows, each tool exposed by the MCP server equips AI developers with structured CI/CD context for faster, more reliable release cycles.

| Tool | Uses |
| --- | --- |
| `config_helper` | Fix config issues before they break your pipeline |
| `create_prompt_template` | Generate prompts that support consistent AI behavior |
| `find_flaky_tests` | [Identify and troubleshoot unstable tests](https://circleci.com/blog/fix-flaky-tests-with-ai/) |
| `get_build_failure_logs` | [Debug and resolve failed builds faster](https://circleci.com/blog/fix-ci-build-errors-with-ai/) |
| `get_job_test_results` | [Understand and fix test failures and performance issues](https://circleci.com/blog/resolve-ci-test-failures-with-ai/) |
| `get_latest_pipeline_status` | Monitor and act on pipeline health |
| `list_followed_projects` | [Find projects you follow and their `projectSlug`](https://circleci.com/blog/explore-projects-with-ai/) |
| `recommend_prompt_template_tests` | Test and improve prompt reliability |
| `rerun_workflow` | Rerun workflows from the beginning or from a failed job |
| `run_pipeline` | [Trigger builds while staying in your editor](https://circleci.com/blog/trigger-pipelines-with-natural-language/) |
| `run_rollback_pipeline` | Roll back faulty deployments with a single command |

## Learn more

Get started with the CircleCI MCP Server, dive into examples, or keep up with platform updates:

*   [Project repository](https://github.com/CircleCI-Public/mcp-server-circleci) – Source code, issues, and contribution guide.
*   [MCP cookbook](https://github.com/CircleCI-Public/circleci-mcp-cookbook) – Prompt examples and tool usage patterns.
*   [Blog post: Introducing the CircleCI MCP Server](https://circleci.com/blog/circleci-mcp-server/) – Design background and use cases.
*   [CircleCI changelog](https://circleci.com/changelog) – See the latest platform updates and feature releases.

---

# Source: https://circleci.com/pricing.md

# The most flexible usage-based CI/CD anywhere

### Free

All our premium features. For free.        

No credit card required.

$0 /month

*   Up to 6,000 build minutes (
    
    Number of build minutes when using a small Docker resource class
    
    
    
    ) 
*   Up to 5 active users/month
*   Docker, Windows, Linux, Arm, macOS, self hosted runners
*   30x concurrency

### Performance

Our most flexible plan. Pay only for what you use.

Starting at

$15 /month (

Option to purchase bulk credits at a discount.



) 

*   30,000 credits included free
*    5 active users (
    
    Add additional users for $15/month.
    
    
    
    ) included
*   Larger resources
*   80x concurrency
*   Optional 8x5 support add-on

### Scale

Enterprise-level power. Built for unlimited scale.

Billed annually.

Get in touch

*   Customizable plans
*   Enterprise controls
*   Largest resource classes
*   All environments, even GPU
*   Optional 24/7 support add-on

Prices do not include applicable taxes.

## CircleCI runs on credits

### Buy

Choose the credit plan that’s right for your team.

### Build

Spend credits on seats, resources, and more.

### Repeat

Automatic refills keep your team building.

### Plan overview

|  | Free | Performance | Scale |
| --- | --- | --- | --- |
| Credits ? (
Credits are used to pay for your team’s usage based on number of active users, machine type and size, and premium features.



)  | 30,000 free credits/month |  30,000 credits (

30,000 free credits/month + $15 for every additional 25,000 credits.



) /month included | Custom |
| Users ? (

Any user who commits code changes on a project building on CircleCI.



)  | 5 active users included |  5 active users (

25,000 credits per month for each additional user.



) included | Custom |
| Network ? (

The network transfer limit applies to self-hosted runners only, when restoring caches and workspaces.



)  | 1 GB included | 5 GB included | 50 GB included |
| Storage | 2 GB included | 2 GB included | 200 GB included |

### Resource classes

| **(x86) Docker** | Free | Performance | Scale |
| --- | --- | --- | --- |
| 
###### Small

 | Yes | Yes | Yes |
| 

###### Medium

 | Yes | Yes | Yes |
| 

###### Medium+

 | Yes | Yes | Yes |
| 

###### Large

 | Yes | Yes | Yes |
| 

###### X-large

 | No | Yes | Yes |
| 

###### 2 X-large

 | No | No | Yes |
| 

###### 2 X-large+

 | No | No | Yes |

| **(Arm) Docker / Remote Docker** | Free | Performance | Scale |
| --- | --- | --- | --- |
| 
###### Medium

 | Yes | Yes | Yes |
| 

###### Large

 | Yes | Yes | Yes |
| 

###### X-large

 | No | Yes | Yes |
| 

###### 2 X-large

 | No | No | Yes |

| **Linux VM / (x86) Remote Docker** | Free | Performance | Scale |
| --- | --- | --- | --- |
| 
###### Medium

 | Yes | Yes | Yes |
| 

###### Large

 | Yes | Yes | Yes |
| 

###### X-large

 | No | Yes | Yes |
| 

###### 2 X-large

 | No | No | Yes |
| 

###### 2 X-large+

 | No | No | Yes |

| **Arm VM (Linux)** | Free | Performance | Scale |
| --- | --- | --- | --- |
| 
###### Medium

 | Yes | Yes | Yes |
| 

###### Large

 | Yes | Yes | Yes |
| 

###### X-large

 | No | Yes | Yes |
| 

###### 2 X-large

 | No | No | Yes |

| **Windows VM** | Free | Performance | Scale |
| --- | --- | --- | --- |
| 
###### Medium

 | Yes | Yes | Yes |
| 

###### Large

 | Yes | Yes | Yes |
| 

###### X-large

 | No | Yes | Yes |
| 

###### 2 X-large

 | No | No | Yes |

| **macOS VM** | Free | Performance | Scale |
| --- | --- | --- | --- |
|  ? (
[EOL](https://circleci.com/changelog/deprecation-of-mac-m1-and-m2-resource-classes/): February 16, 2026



) 

###### M1 Medium

 | Yes | Yes | Yes |
|  ? (

[EOL](https://circleci.com/changelog/deprecation-of-mac-m1-and-m2-resource-classes/): February 16, 2026



) 

###### M2 Pro Medium

 | No | Yes | Yes |
| 

###### M4 Pro Medium

 | No | Yes | Yes |
|  ? (

[EOL](https://circleci.com/changelog/deprecation-of-mac-m1-and-m2-resource-classes/): February 16, 2026



) 

###### M1 Large

 | No | Yes | Yes |
|  ? (

[EOL](https://circleci.com/changelog/deprecation-of-mac-m1-and-m2-resource-classes/): February 16, 2026



) 

###### M2 Pro Large

 | No | Yes | Yes |
| 

###### M4 Pro Large

 | No | Yes | Yes |

| **GPU** | Free | Performance | Scale |
| --- | --- | --- | --- |
| 
###### Small Nvidia Tesla P4 GPU

 | No | No | Yes |
| 

###### Small Multi 2 Nvidia Tesla T4 GPUs

 | No | No | Yes |
| 

###### Small Gen2 Nvidia Tesla A10G GPU

 | No | No | Yes |
| 

###### Medium Nvidia Tesla T4 GPU

 | No | No | Yes |
| 

###### Medium Multi 4 Nvidia Tesla T4 GPUs

 | No | No | Yes |
| 

###### Windows Medium Nvidia Tesla T4 GPU

 | No | No | Yes |
| 

###### Large Nvidia Tesla V100 GPU

 | No | No | Yes |

[See full pricing list](https://circleci.com/pricing/price-list/) 

### Key features

| **Concurrent job runs** | Free | Performance | Scale |
| --- | --- | --- | --- |
| Docker | 30 | 80 | Custom |
| Linux VM | 30 | 80 | Custom |
| Arm VM (Linux) | 30 | 80 | Custom |
| Windows VM | 30 | 80 | Custom |
| macOS VM | 1 | 15 | Custom |

| **Insights** | Free | Performance | Scale |
| --- | --- | --- | --- |
| Flaky test detection | 5 tests | Unlimited | Unlimited |

|  | Free | Performance | Scale |
| --- | --- | --- | --- |
| Self-hosted runner ? (
The amount of concurrent tasks per self-hosted runner is restricted by plan.



)  | 5 | 20 | Unlimited |
| Docker layer caching ? (

Cache the individual layers of any Docker images built during your jobs.



)  | Yes | Yes | Yes |
| IP ranges ? (

Usage for IP ranges is billed at 450 credits/GB per job.



)  | No | Yes | Yes |
| Private orbs ? (

Create reusable packages of YAML config, called orbs, to be used exclusively by your organization.



)  | Yes | Yes | Yes |
| Deploys | Yes | Yes | Yes |
| Single sign-on (SSO) | No | No | Yes |
| Config policies | No | No | Yes |

### Included support

|  | Free | Performance | Scale |
| --- | --- | --- | --- |
| Community support ? (
Access to our 24/7 community support forum.



)  | Yes | Yes | Yes |
| Ticket-based global support ? (

Our team of expert support engineers, based around the world.



)  | No | Yes | Yes |

### Support packages

[Learn more](https://circleci.com/support/plans/) 

|  | Free | Performance | Scale |
| --- | --- | --- | --- |
| Support SLA | No | 8x5 and 12x5 SLAs available | 24x5 and 24x7 SLAs available |

[See full pricing list](https://circleci.com/pricing/price-list/) 

## Frequently asked questions

### What are credits?

Credits are the currency of CircleCI. Credits are purchased up-front and are used to pay for CircleCI platform usage in real time. Platform usage consists of:

**Monthly active users** - By using credits to pay for monthly active users, your organization is never restricted to a static number of active users each month.

**Compute time** - Each resource type on CircleCI has an associated credits-per-minute price. Your credits are used in real time whenever your organization is actively using a compute resource on CircleCI.

**Add-on features** - Some features of CircleCI have additional credit costs associated with them. These costs may be represented in credits per use or in credits per minute.

**Additional network & storage use** - network and storage utilization beyond the plan-specified thresholds is charged at 420 credits per GB.

### Do credits expire?

Credits on the Free plan expire after a month and do not roll over.

The Performance plan includes the 30,000 credits available to the Free plan; these expire and do not roll over month-to-month.

Performance plan users may purchase additional credits at $15 for every 25,000 credits. Any paid credits roll over month to month, and expire after a year.

Unused credits will be forfeited if the account subscription is canceled.

### How do CircleCI credits translate to build minutes?

Example: 30,000 credits at a rate of 10 credits per min (using Linux Medium) is 3,000 minutes.

It’s important to note that a minute on CircleCI is different than a minute on other CI platforms. Access to more powerful resources, Docker Layer Caching, as well as concurrency and parallelism mean you can do more in a minute on CircleCI than anywhere else.

### How do I manage billing with the Performance Plan?

An admin for your CircleCI account can sign up for a paid plan using using a credit card, log into the CircleCI application, and go to Settings → Plan Overview.

The Performance plan provides two purchase options for your convenience.

1.  In the M2M (or default) option, credits are purchased on a monthly cycle. You can set up a monthly amount to be billed at the start of your billing cycle.
    
    *   Credits are purchased in blocks of 25,000. At the beginning of each billing month (based on your purchase date), you are charged for your credits and those credits are added to your account.
        
    *   When you use up all your credits, then credits automatically refill to a level of 25% of your monthly amount, with a minimum refill amount of 25,000 credits.
        
    
    For example:  
    If your monthly credit purchase is 200,000 credits, you will automatically be refilled 50,000 credits when you run out of credits.
    
2.  In the Prepaid Billing option, credits can be purchased at a discount based on credit volume. When credits run out, the account is reloaded based on your usage.
    
    *   Bulk purchases can be made starting at 1 million credits for $600. Discounts start when you purchase 5 million credits for $3,000.
        
    *   To purchase discounted credits in bulk, visit the **Plan Overview** Page in your CircleCI account, and select the **Prepaid Billing** option.
        

Please note that all paid credits are valid up to 12 months from the time of purchase, regardless of the purchase option. Updates to payments can be made in the billing portal, and also in the applications Plan Overview page.

[Learn more about Prepaid Billing here](https://circleci.com/docs/guides/plans-pricing/credits/#what-is-prepaid-billing).

### What if I am building open-source?

CircleCI offers free access to compute time and resources for organizations on our Free plan. Open source projects can access up to 400,000 credits per month (equivalent to 80,000 build minutes) to use on Linux, Arm, and Docker.

Open source Windows and macOS builds or private repositories can use the 30,000 credits offered in our free plan.

If you are building a bigger open source project and would like the flexibility of our new plans, [let us know](https://circleci.com/contact/) how we can help you!

[Learn more about building open source projects with CircleCI.](https://circleci.com/open-source/)

### What are concurrent job runs?

Concurrent job runs refers to the number of jobs that can run simultaneously without queueing. You pay for compute based on the total amount of time you use compute resources, not the number of resources that you have access to. This means you can choose the right plan for your team to maximize concurrent jobs and parallelism for your jobs to minimize queuing.

For example, say you have a workflow with 10 jobs that each take 5 minutes to run. If you are limited to 1x concurrency, each of these jobs runs sequentially, and the workflow completes in 50 minutes. With scaling concurrency, you can run all 10 jobs concurrently (at the same time), and the workflow completes in 5 minutes. In both cases, your total usage time is 50 minutes since you used 10 machines for 5 minutes each. With usage-based pricing, that means you pay the same amount either way, but if you maximize your concurrency, you save 45 minutes of time waiting for your workflow to complete.

### What is self-hosted runner concurrency?

Self-hosted runner concurrency is the amount of runner tasks that can be run at the same time. This applies to both machine and container runner. For example, CircleCI customers on the Free plan have 5 concurrent tasks that can be used for machine and container runner.

### How is network egress measured?

Network egress is triggered by restoring caches and workspaces to self-hosted runners.

Any egress triggered by our cloud executors is not passed on to the customer.

Self-hosted runners can incur network egress cost (at a rate of 420 credits per GB) if usage exceeds the network allowance included in your plan. CircleCI does not charge per build minute on self-hosted runners.

[Learn more about how to calculate and adjust network usage](https://circleci.com/docs/persist-data/#managing-network-and-storage-usage)

Activities that utilize **storage** include saving caches and workspaces in jobs, uploading test results, and building artifacts.

[Learn more about how to calculate and adjust storage usage](https://circleci.com/docs/2.0/persist-data/#managing-network-and-storage-use)

Both network and storage beyond the monthly thresholds are charged at 420 credits per GB ($0.252/GB).

### How is Docker Layer Caching (DLC) charged?

Docker layer caching uses 200 credits per job run in a pipeline (equivalent to $0.12 per job run). For example, if your configuration specifies a workflow with three parallel Docker build jobs, you will be charged 600 credits each time these jobs are run in addition to the compute credits per minute usage.

### How much does the IP ranges feature cost?

The IP ranges feature costs 450 credits per GB of data used by jobs with the feature enabled.

---

# Source: https://circleci.com/security.md

# Your security is our priority

At CircleCI, our top concern is protecting our users’ intellectual property and sensitive secrets such as keys, tokens, and credentials.

## Compliance and authorizations

CircleCI takes the security of your applications seriously. We partner with the top security organizations to ensure that your projects are built, deployed, and maintained securely.

FedRAMP tailored

First CI/CD tool to meet the rigorous security and privacy [NIST](https://www.nist.gov/)\-standards of [FedRAMP](https://www.fedramp.gov/)

SOC 2 Type II compliant

[SOC 2 Type II compliance](https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/serviceorganization-smanagement.html) is a component of the American Institute of CPAs (AICPA)’s Service Organization Control reporting platform

## Product security features

Get the compliance, security, and [audit logging](https://circleci.com/docs/security/#audit-logs) features that you need. Choose our cloud-hosted service with the option to use CircleCI compute and self-hosted runners, or run your own instance of CircleCI entirely on your own infrastructure.

### Source code security

Communication with your VCS to access source code is always encrypted over the wire using SSH and/or HTTPS.

### Config policies

Enforce organizational compliance and standardization across projects.

### Environment variables (secrets)

Protect secrets and other sensitive data in CircleCI using environment variables.

### OpenID Connect

CircleCI supports authentication via OpenID Connect at the job level. Using OIDC, pipelines can authenticate to systems like Vault, AWS and GCP without distributing secrets.

### Restricted contexts

Restricted contexts allow encrypted storage and sharing of environment variables across multiple projects while limiting access to certain user groups or at the project level.

### Audit logging

Use audit logs to monitor anomalies, assist in forensics, and demonstrate compliance.

### Runtime isolation

CircleCI runs all builds in isolated sandboxes that are destroyed after each use.

### Console output and artifacts

Encryption is employed over the wire using SSH and/or HTTPS for both console output and artifacts. Both are only available to those with read access to your repository.

### Two-factor authentication

CircleCI inherits 2FA authentication established in your third-party VCS provider.

### Compliance & certifications

| Current compliance & certifications |  |
| :-- | --- |
| SOC 2 Type II compliant | SOC 2 Type II provides CircleCI with an opportunity to meet (and exceed) industry standards and gives our customer organization’s access to industry-recognized, standardized reports that they can compare across services in our space. Achieving SOC 2 Type II compliance means that CircleCI has put in place and follows the procedures and security policies necessary to reduce risks, and that their processes can be requested and audited.  **Learn more about SOC 2 Type II at** [https://www.aicpa.org/](https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/soclogosinfo.html). |
| FedRAMP tailored | Our FedRAMP Tailored designation demonstrates that CircleCI meets US government data security standards and is authorized for use within US government agencies.  **Learn more about the FedRAMP certification at** <https://www.fedramp.gov/>. |
| Data privacy frameworks | The certification ensures that CircleCI meets all data transfer security standards for the United States, the EU, the UK (and Gibraltar) and Switzerland under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce.  **Learn more about the Data Privacy Framework at** <https://www.dataprivacyframework.gov/>. |
| PCI compliance | CircleCI leverages the PCI compliance of Stripe. |

### Business practices

| Personnel & Processors |  |
| :-- | --- |
| Background checks | All CircleCI employees and contractors must pass a background check and sign confidentiality agreements. |
| Employee security awareness | CircleCI mandates that new employees attend classes covering security best practices. |
| Engineer security education | Engineers are required to attend an additional technical security workshop. |
| Policies | CircleCI maintains various security policies which are maintained and communicated by our security management team. |
| Partner management | CircleCI requires all partners and third-party vendors to fill out a security questionnaire. Those which handle PII are also required to sign a Data Processing Addendum. |

| Security incident response |  |
| :-- | --- |
| Response team | CircleCI maintains a dedicated Incident Response Team. |
| Response policy + plan | CircleCI maintains an Incident Response Policy and Runbook to facilitate decision making during critical situations. |
| Communication | Network and security incidents are published at <https://status.circleci.com/>. *At our discretion, based on the nature of a security incident, we may contact customers directly and/or publish security alert information to <https://circleci.com/blog/> in addition to (or in lieu of) posting to our general status page.* |

### Physical security

| Offices security |  |
| :-- | --- |
| Headquarters security | CircleCI headquarters employs 24-hour door personnel and badge access is required at all hours. Visitors are required to sign in and be escorted at all times. |
| Remote offices security | CircleCI’s remote offices in Denver, Japan, and London implement similar physical security controls to the San Francisco headquarters. |

| Fleet security |  |
| :-- | --- |
| Linux fleet security | CircleCI uses Amazon and Google Cloud Platform for its computing. Both vendors are industry leaders in security and privacy. |
| macOS fleet security | CircleCI operates macOS fleets housed at three data centers, located in Milwaukee, Las Vegas, and Atlanta. No CircleCI employee has physical access to the machines and all administration is done remotely. Data center engineers are the only people with access to provisioning machines, updating or deprovisioning machines. Federal regulators completed a full-day onsite audit in 2022 to assess the security, availability and integrity of the facility. Additionally, a penetration test was performed in late 2022 to identify and resolve any potential threats to the platform. Extensive badging, access logging, and other security controls are in place, all of which have been audited and approved under SOC 2 Type II compliance programs at CircleCI or the data center provider. |

### Network & data security

| Network security |  |
| :-- | --- |
| Vulnerability scanning | CircleCI implements a Docker-centric vulnerability scanning tool in its software development CI/CD process. Patching timelines for CircleCI’s cloud service are: - Critical – 14 days - High – 14 days - Medium – 30 days - Low – 30 days  Monthly scans are submitted to federal authorities as part of ongoing FedRAMP compliance. |
| Internal systems auditing | CircleCI maintains a formal Audit Policy governing application events, system events, hardware events, and physical access. This includes the what, when, and where of the event, its source, its object, its outcome, and the person associated with it. |
| Architecture | CircleCI’s architecture consists of multiple layers of data security including a DMZ, bastion hosts, and firewalls. |
| Global distribution | CircleCI’s Site Reliability, Support and Engineering teams are globally distributed for 24/7/365 coverage. |
| Build isolation | CircleCI runs all builds in isolated sandboxes that are destroyed after each use. |

| Data security |  |
| :-- | --- |
| Traffic encryption | All data in transit is encrypted via TLS and SSH. |
| Environment variable encryption | Environment variables are encrypted at rest and in transit, and injected into the runtime environment at the start of a job. All sensitive secrets such as keys, tokens, and other credentials should be stored as environment variables within CircleCI. |
| Source code encryption | Source code is always encrypted via TLS and SSH in transit, but is not encrypted at rest. Source code at rest is secured behind multiple layers of architecture security such as DMZ, bastion hosts, and firewalls. |
| Data backup | CircleCI maintains a Data Backup and Snapshot Policy that requires restoration capabilities within common industry timelines. |

### Application security

| Secure development |  |
| :-- | --- |
| Secure coding | The Software Development Lifecycle Policy dictates delivery, review and merge processes to minimize rollbacks, downtime, design flaws and security incidents. |
| Site reliability | CircleCI employs a team of Site Reliability Engineers ensuring that the CircleCI application security layers are consistently maintained. |

| Application-level security |  |
| :-- | --- |
| OWASP Top 10 | CircleCI’s web application is designed to withstand OWASP Top 10 matters such as injections, broken authentication and session management, cross-site scripting (XSS), insecure direct object references, missing function level access control, cross-site request forgery (CSRF), unvalidated redirects and forwards. |
| Application penetration testing | Third-party penetration testers are hired annually to test the CircleCI application, network, infrastructure, and new products for vulnerabilities. Coverage ranges from OWASP Top 10 to threat modeling of new product features. |

## Have a security concern about CircleCI?

### Finding serious security issues

If you find any of the following issues, please contact us with relevant details including steps to reproduce or a proof-of-concept.

*   Injection vulnerabilities
*   Authentication or session problems
*   Improper access to sensitive data
*   Broken access controls
*   Cross-site scripting
*   Anything from the OWASP Top 10 Project
*   Email spoofing, SPF, DKIM, and DMARC errors

### Protect our users’ data

Upon discovering a vulnerability, we ask that you:

*   Inform us as soon as possible, contact our security team by email at [security@circleci.com](mailto:security@circleci.com)
    *   If you are reporting a sensitive issue, please encrypt your message using our security team’s GPG key (ID: `0x4013DDA7`, fingerprint: `3CD2 A48F 2071 61C0 B9B7 1AE2 6170 15B8 4013 DDA7`)
*   Test against fake data and accounts, not our users’ private data (please ask if you’d like a free account to work on this)
*   Work with us to close the vulnerability before disclosing it to others

[Email security@circleci.com](mailto:security@circleci.com) 

### CircleCI does not have a bounty program

We do not offer bug bounties for discovered vulnerabilities. We hope that if you discover vulnerabilities in the course of your work that you share them with us so we can improve the health of the internet ecosystem.

### Reports we do not act on

*   Credentials in a 3rd party’s `.circleci/config.yml`

## Learn more

[Integrate CircleCI with HashiCorp Vault using OIDC](https://circleci.com/blog/oidc-with-vault/)

[Security best practices for CI/CD](https://circleci.com/blog/security-best-practices-for-ci-cd/)

[Vulnerability management and DevSecOps with CI/CD](https://circleci.com/resources/devsecops-ebook/)