# Buildkite Adds Scoped Secrets and New Agentic CI Tools Buildkite enhances CI security and automation with pipeline-scoped secrets and Model Context Protocol tools. - **Source:** [InfoQ](https://brifing.si/source/68ac18af-a4f3-4f7c-9c2c-44d4af8f89dd) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/458321f1-40bf-4866-9529-1ed03a504e72 ## Pipeline-Scoped Secret Management Buildkite introduced pipeline-scoped secrets, allowing engineers to restrict access to cluster secrets based on specific branches, queues, or creators. This feature moves away from broad cluster-wide management, keeping sensitive credentials isolated within individual pipelines. Users must hold specific permissions for both the pipeline and the cluster to configure these restricted secret settings. ## Agentic Validation and Diagnostics The new open-source Model Context Protocol server includes a validate_pipeline tool that checks YAML syntax against official schemas without triggering builds. Additionally, the compare_builds tool analyzes failed jobs against previous successful runs. These tools provide AI agents with structured diagnostic data, reducing the need for parsing raw, unstructured log files. ## Automated Webhook and Workflow Repair Buildkite added a create_pipeline_webhook tool to address missing GitHub webhooks, preventing the need for full pipeline recreation. Version 1.23.0 introduced a breaking change requiring callers to explicitly specify this webhook creation. These agentic capabilities allow for automated configuration repairs, though they necessitate strict permission controls to maintain overall system security. ## Enhanced GitHub Actions Compatibility The GitHub Actions compatibility layer now supports Linux arm64 agents, enabling organizations to maintain architecture consistency. Labels like ubuntu-24.04-arm require explicit queue mapping without x86-64 fallback. Furthermore, the CLI now includes commands for migrating GitHub Actions secrets, while compatibility fixes address environment values, runtime variables, and matrix configurations for service containers. ## Telemetry and Performance Monitoring Agent v4.1.0 expands OpenTelemetry data by including commit, pull request, and build author information in job spans. It also tracks cache save and restore durations. These metrics provide deeper context for investigating build latency or retry patterns, similar to how teams previously utilized Honeycomb to isolate agent waiting times. ## Security and Credential Redaction Buildkite has implemented stricter credential handling across its agent versions. Agent v4.0.9 redacts tokens by prefix in job logs, while v4.0.8 redacts captured errors using registered secrets. Despite these improvements, scoped storage does not eliminate the necessity of controlling secret exposure within individual pipeline steps, aligning with broader industry prevention-first security practices. ## Elastic CI Stack Upgrades The Elastic CI Stack v7 release brings Agent v4 to Linux and Windows instances on AWS, officially removing support for Agent v3. This transition requires users to review custom parameter files and deployment automation. Buildkite has set the final support deadline for all Agent v3 releases for 3 September 2027. ## Strategic Shift Toward Agentic CI By providing discrete tools for validation, comparison, and repair, Buildkite reduces AI agents' reliance on low-level API calls. This architectural shift emphasizes isolated execution and auditable actions. As CI/CD environments become more complex, these agent-ready features represent a move toward more resilient, self-healing pipelines that prioritize both security and operational visibility. ## Sources covering this story - https://www.infoq.com/news/2026/10/buildkite-ci-secrets-agentic/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=global — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._