Semaphore open source now has a built-in MCP server. AI agents can read your pipelines, find out why a build failed and rerun it, and your CI data stays on your own infrastructure.
Semaphore Open Source 1.6 is out, in both the Community Edition (CE) and the Enterprise Edition (EE). It includes 538 commits and about 530 changes from 25 contributors, 13 of them contributing for the first time.
We shared a first look at 1.6 in October. This post covers everything in the final release.
What Shipped
An MCP server for AI agents
Every 1.6 install comes with an MCP server, turned on by default, on both CE and EE.
AI assistants and coding agents such as Claude Code, Codex, VS Code and GitHub Copilot can connect to it and:
- Read workflows, pipelines, jobs, logs, test results and artifacts
- List and run scheduled tasks
- Search the Semaphore docs
- Run or rerun workflows
Agents sign in with OAuth 2.1. The server runs at mcp.<your domain>.
In practice, you can ask your agent “why did the last build fail?” It reads the failed job’s logs and test results, explains what went wrong, and reruns the build once you’ve fixed it. None of that CI data leaves your install.
You define the intent. The agent does the digging. You stay in control.
Rerun only the jobs that failed
When a pipeline fails, rerunning it now re-executes only the jobs that failed. Jobs that passed are carried over as copies, with their logs, artifacts and test results.
On large test suites, a single flaky test used to mean running everything again. Now you get back to green faster, and you stop spending compute on work that already passed.
The buttons now read Rerun Workflow and Rerun Failed Jobs, so it’s always clear which one you’re getting. This is on by default on CE and EE.
👉 Pipeline docs, including partial reruns
Artifacts and test results over the API
New API endpoints list artifacts and return signed download links. Scripts and agents can fetch build outputs and test results without opening the UI.
This also means the sem-ai CLI’s artifact and test report commands now work with the open source editions.
Organization management over the API
You can now manage members, roles, permissions, project members and service accounts through the API. On EE, that includes groups.
Onboarding, offboarding and access reviews can now be automated and managed as code.
Pre-flight checks over the API (EE)
On Enterprise, you can describe, apply and delete organization and project pre-flight checks through the API, and each change is recorded in the audit log.
Your security policy for every pipeline can now live in code, next to everything else.
Richer OIDC tokens (EE)
OIDC tokens carry more information, so you can write tighter cloud deployment policies without long-lived cloud keys:
- Tag builds get a
tagclaim, which you can use as an AWS session tag - An
actorclaim names who triggered the run on their Git provider - A short
sub127subject fits within Google Cloud’s length limits
GitHub merge queues and reliable statuses
GitHub merge queues work out of the box. Pull request checks no longer hang, statuses arrive in order, and an auto-cancelled run can no longer overwrite a newer result.
That means fewer stuck pull requests and fewer “why is this red?” moments.
New bundled storage
Artifacts, job logs and the cache now run on RustFS instead of MinIO. The MinIO images the previous chart used are no longer published, so fresh installs work out of the box again.
Storage credentials are now generated for each install, so there are no shared default passwords.
Security and trust
- Dependency and container image scans cleared across services
- Images and the Helm chart are signed with cosign
- Sign-in moved to Keycloak 26.8
- Several fixes that harden token handling and logging
Also New in 1.6
Smaller improvements that make everyday work nicer. All of them are in CE and EE unless marked.
- Job logs render full color (256-color and 24-bit), plus bold, italic, underline and strikethrough
- The pipeline diagram can be scrolled and dragged
- The project page can list all pipelines, not only the latest one per branch, and branch pages get date filters
- The job page shows why a job timed out or was stopped, and shows the pipeline, block and author up front
- Very large test reports (hundreds of MB) load without crashing the browser, and each test path has a copy button
- Download your organization’s member list as a CSV
- GitLab repositories in subgroups are supported
- Jobs get a
SEMAPHORE_ORGANIZATION_IDenvironment variable - Scheduled task parameters can be validated with a regex
- Webhook notifications retry with backoff
- Users can delete their own account (the last owner of an organization can’t)
- Fewer GitHub API calls, and services ride out a message queue restart without going down
- Project insights (performance, reliability, frequency) over the API (EE)
- Configurable SAML session length (EE)
Before You Upgrade
1.6 changes a few things for existing installs. Read the upgrade guide before you start. In short:
- Stored artifacts, job logs and cache entries are not migrated to the new storage. The upgrade stops until you confirm this with a setting.
- Sign-in (Keycloak) moves from version 25 to 26.8. Its database migration is one-way, so back up first. Sign-in is unavailable while the migration runs, and custom login themes need updating.
- The v2 API service is no longer deployed by default. It never worked in the open source editions. Use the v1alpha API.
Pipeline behavior also changes in small ways. For example, rerunning a failed pipeline now reruns only the failed jobs. The full list is in the release notes under “Before you upgrade”.
👉 Upgrade guide: Community Edition · Enterprise Edition
How to Get It
1.6 installs from the Helm chart at oci://ghcr.io/semaphoreio/semaphore, version v1.6.0. The images and the chart are signed.
👉 Install Semaphore Community Edition
Thank You, Contributors
25 people contributed to Semaphore 1.6, and 13 of them were contributing for the first time. Thank you to everyone who opened an issue, sent a pull request or tested a pre-release. Every contributor is named in the release notes.
What’s Coming
The open source docs will get the MCP server and partial rerun pages after this release. Until then, the Semaphore Cloud docs linked above cover both.
Want to discuss this article? Join our Discord.
