sourcey
Submit

research:SKILL.mdmcp.jsonopenapi.yml

← CircleCI

Can an agent start a workflow run with CircleCI Cloud?

A person has to keep renewing, replacing or revoking its access.

observedProbed revision sha256:ec69c1384ef3…

Who does each step

how grades work →

Whether the agent handles it alone or a person has to step in.

  1. 01

    Discover

    Machine

    The vendor's machine-readable docs show the agent where and how to call this job.

  2. 02

    Access

    Workaround · setup

    You give the agent a key or token.

  3. 03

    Onboard

    Workaround · setup

    You sign up or register a client for the agent.

  4. 04

    Pay

    Not applicable

    Nothing to pay for the job.

  5. 05

    Confirm

    Machine

    The response or specification defines errors the agent can distinguish from success.

  6. 06

    Sustain

    Workaround · recurring

    You renew the agent's access each time it expires.

  • Access: handing over a key or token.
  • Onboard: signing up or registering a client for the agent.
  • A person again and again, at Sustain: renewing, replacing or revoking its access.

To remove these handoffs: support OAuth client registration so the agent can register its own client and ask for consent; provide an agent registration route, such as auth.md, a sign-up API or OAuth client registration; provide key management or OAuth refresh and revocation so the agent can maintain its own access.

Agent surfaces

6 kinds · 13 entries
OAuth
circleci.com3 more
app.circleci.comcircleci.com/api/v3circleci.com/api/v3/runs
Names the job's endpoint
For agents
circleci.com2 more
circleci.com/auth.mdcircleci.com/llms.txt
Names the job's endpoint
API
circleci.com
Names the job's endpoint
API catalog
circleci.com/api/v3
api-catalog
MCP
mcp.circleci.com/v1/mcp
server card
Skills
circleci.com/.well-known/agent-skills/circleci-api/SKILL.md2 more
circleci.com/.well-known/agent-skills/circleci-docs/SKILL.mdcircleci.com/.well-known/agent-skills/circleci-mcp-server/SKILL.md
skills index

The probe

13 Oct 2026 · 09:43 UTC · 65.61 s

Each request it sent and what came back; the descriptors it read, counted, with what they named.

Discover21 descriptor reads17 facts
Found
API catalogcircleci.com/api/v3MCPmcp.circleci.com/v1/mcpAPIcircleci.comOAuthapp.circleci.comFor agentscircleci.com/auth.mdFor agentscircleci.com/llms.txtAPIcircleci.comAPI catalogcircleci.com/api/v3OAuthapp.circleci.comOAuthcircleci.com/api/v3/runsOAuthapp.circleci.comAPIcircleci.comAPIcircleci.comAPIcircleci.comSkillscircleci.com/.well-known/agent-skills/circleci-mcp-server/SKILL.mdSkillscircleci.com/.well-known/agent-skills/circleci-api/SKILL.mdSkillscircleci.com/.well-known/agent-skills/circleci-docs/SKILL.md
From
circleci.com/.well-known/api-catalog · circleci.com/.well-known/mcp/server-card.json · circleci.com/.well-known/oauth-protected-resource · circleci.com/auth.md · circleci.com/llms.txt · circleci.com/openapi.json · circleci.com/.well-known/oauth-protected-resource/api/v3 · circleci.com/.well-known/oauth-protected-resource/api/v3/runs · circleci.com/fullopenapi.yaml · circleci.com/fullopenapi.json · circleci.com/.well-known/agent-skills/index.json
This endpoint
circleci.com/api/v3 is named by a descriptor it read
Job requestPOST circleci.com/api/v3/runs40055 ms
Request
POST https://circleci.com/api/v3/runs
Response
400 · application/json · 159 bytes
Body
sha256:7d51234065587e7d3fdb649f5499094a749935f71e38b9b46db969dc85ed1c8f
Exchange
sha256:ed5b0cb4f0a5d207bed7799e5928c1b4da55f74d0b9a102b9451fb3014c6b716
Resource metadataGET circleci.com/.well-known/oauth-protected-resource/api/v3/runs20054 ms
Request
GET https://circleci.com/.well-known/oauth-protected-resource/api/v3/runs
Response
200 · application/json · 138 bytes
Body
sha256:3bce90abcc528934b31af882eab2b5f8ce913c5d094b6d9c0910e97fd5e311d3
Exchange
sha256:9e409f00b3772704c896bc386e9c0ac3505e4dc70a5e873dffc031cf670a0fc7
Authorization serverGET app.circleci.com/.well-known/oauth-authorization-server20070 ms
Request
GET https://app.circleci.com/.well-known/oauth-authorization-server
Response
200 · application/json · 431 bytes
Body
sha256:074da36aa80ee103aee65c8007bfdb733bdbee361bb33cbb572b2db5c14b8764
Exchange
sha256:55cec58bd0d667ad950c63a6d41ef1e3eac978ba17351572600f164a8e9eca1b
Client registrationPOST app.circleci.com/oauth/register40056 ms
Request
POST https://app.circleci.com/oauth/register
Response
400 · application/json · 220 bytes
Body
sha256:a41f68fbb3b6f72cd843bccf1c8ed840e1abebd092c061e0dd5e63115c2edb84
Exchange
sha256:23f4aaee59d731835d0cc9d36baf7f1c69125410b712a0f4b9da3d471723164e
Declared pageGET app.circleci.com/signup20087 ms
Request
GET https://app.circleci.com/signup
Response
200 · text/html · 118912 bytes
Body
sha256:fba8ff298b6c37bc2c58c19afb913411e06fc7de7d2b7e620e39cface0c969cf
Exchange
sha256:9f39ad0e3a53c66b0ed81d29b15958681ddabd0ef77852de1462d2130d724d85

CircleCI on the startup-offers board

catalog record →

The grade’s badge

One image that keeps itself current, linking here.

Live badge for CircleCI Cloud, agent grade: C[![agent grade](https://sourcey.com/badges/agent-readiness/arp_01m4ta9b8ht0ngvv2r3b0yvg3f.svg)](https://sourcey.com/c/circleci/agent-readiness/circleci-cloud/workflow-run)

Improve the report

Correct it, probe it again, or improve the path.

Report outdated evidenceRequest reassessmentVerify the jobClaim this record
Profile
arp_01m4ta9b8ht0ngvv2r3b0yvg3f
Projection
sha256:e5daf243762be55b3e4a47704cbb2685246590203b2f2a0c46ef6b8a38a01008
Policy
kind-2026-10-12.2 · sha256:b612172aad277b54461de84e006815126f2df566563954b02f4432a39cad89ac

A report or a reassessment request names this profile, its revision and its projection. How report cards are assessed →View the exact declaration