Security notice and deprecation: standalone circleci-mcp-server

What it is

CircleCI's forum notice for GHSA-8xjg-jpfh-5257 in the standalone circleci-mcp-server (npm @circleci/mcp-server-circleci). The patched version is 0.19.0. The summary states the deprecation and the two paths; what it omits is the actual migration mechanics — the removal steps, install commands, and the exact version-pinned config that the fixed-in-place path requires.

Preconditions / Affected

Anyone running the standalone MCP server wired into an AI tool (Cursor, Windsurf, VS Code, Claude Desktop, or Claude Code). Two audiences diverge: CircleCI cloud users can migrate to the CLI's built-in MCP server; CircleCI Server users, or anyone who cannot migrate yet, must stay on the standalone package pinned to 0.19.0.

What to do

Fastest fix is upgrading the standalone server to 0.19.0. If you stay on the standalone package, pin the version explicitly in your MCP config args:

"args": ["-y", "@circleci/mcp-server-circleci@0.19.0"]

To migrate to the CLI (cloud only), first remove the old server from your AI tool. For Claude Code:

claude mcp remove circleci-mcp-server

For Cursor/Windsurf/VS Code, delete the circleci-mcp-server block from the MCP config file; for Claude Desktop, remove it from claude_desktop_config.json via Settings > Developer > Edit Config.

Then install the CLI (@next / preview channel), e.g.:

brew install circleci-public/circleci/circleci@next
winget install --id CircleCI.CLI.Preview
sudo snap install circleci --channel=edge

For Debian/Ubuntu:

curl -1sLf 'https://packages.circleci.com/public/setup.deb.sh' | sudo -E bash
sudo apt install circleci

Finally authenticate and configure the agent (the order matters — auth before enable):

circleci auth login
circleci mcp claude enable

The CLI path adds OAuth-based auth and native pipeline watching. Contact CircleCI Support if you believe you were affected before updating.

Caveats

The standalone package will receive security and bug patches only — no new features and no contributions accepted. The CLI is distributed on preview/edge/next channels, so it is not yet a stable release. Migration is not available to CircleCI Server users.