jfeeneydemo3/dubjug-atlassian-mcp-kit:1.3.0

schemaVersion: "3"
displayName: Atlassian Cloud MCP server
description: Registers the hosted Atlassian Rovo MCP server, authenticated with an Atlassian API token kept as an sbx secret, and requires a Jira ticket in the "Ecommerce Monorepo" project before the agent edits code.
version: 1.3.0
kind: mixin
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - mcp.atlassian.com
    - type: com.docker.sandbox/credential@1
      config:
        apiKey:
            inject:
                - domain: mcp.atlassian.com
                  format: '%s'
                  header: Authorization
            name: ATLASSIAN_AUTH_HEADER
            proxyManaged: true
        phase: runtime
        service: atlassian
      description: 'Atlassian API token for the Rovo MCP server, stored as the complete Authorization header value: `Basic ` followed by the base64 of `email:api_token`. Stored on the host; the sandbox only ever sees a placeholder.'
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: |
                export HOME="${HOME:-/home/agent}"
                export PATH="$HOME/.local/bin:$HOME/.claude/local:/usr/local/share/npm-global/bin:${PATH:-/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}"
                if command -v claude >/dev/null 2>&1; then
                  claude mcp add atlassian "https://mcp.atlassian.com/v2/mcp" --transport http --scope user --header "Authorization: ${ATLASSIAN_AUTH_HEADER:-proxy-managed}" || true
                fi
                if command -v codex >/dev/null 2>&1; then
                  mkdir -p "$HOME/.codex"
                  cfg="$HOME/.codex/config.toml"
                  touch "$cfg"
                  grep -q '^\[mcp_servers\.atlassian\]' "$cfg" || printf '\n[mcp_servers.atlassian]\nurl = "https://mcp.atlassian.com/v2/mcp"\nenv_http_headers = { Authorization = "ATLASSIAN_AUTH_HEADER" }\n' >> "$cfg"
                fi
              description: Register the Atlassian MCP server with the Claude or Codex agent (install-time, race-free)
              env:
                - HOME
                - PATH
                - ATLASSIAN_AUTH_HEADER
              user: agent
            - command: |
                export HOME="${HOME:-/home/agent}"
                export PATH="$HOME/.local/bin:$HOME/.claude/local:/usr/local/share/npm-global/bin:${PATH:-/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}"
                add_block() {
                  f="$1"
                  mkdir -p "$(dirname "$f")"
                  touch "$f"
                  grep -q 'atlassian-mcp:start' "$f" && return 0
                  cat >> "$f" <<'ATLASSIAN_BLOCK'

                <!-- atlassian-mcp:start -->
                ## Atlassian and Jira (kit: atlassian-mcp)

                - Jira site: `${{ kit.args.site }}`. If that is blank, ask the user for it. Where an
                  Atlassian tool wants a `cloudId`, pass `https://<site>`.
                - Use only the `atlassian` MCP server's tools for Atlassian work. Do not call
                  Atlassian REST APIs (for example with `curl`), do not scan the environment for
                  credentials, and never use `ATLASSIAN_AUTH_HEADER`: it is only a placeholder.
                - Use Jira and the `atlassian` MCP server only when the user asks about Jira or
                  Atlassian, or when you are about to edit, create or delete source files in the
                  project. Building, running, testing, installing dependencies, reading, explaining,
                  status questions and security checks never need a ticket or any Jira call. Neither
                  do git operations or undoing work: reverting, discarding or restoring changes
                  (`git restore`, `git checkout -- <file>`, `git reset`, `git revert`, `git stash`),
                  committing, pushing, pulling, merging, rebasing and branching. A ticket is for new
                  work you author (a feature, a fix, a refactor), never for removing or undoing work.
                  If unsure, do not use Jira; ask.
                - Immediately before such a first edit, make sure a Jira ticket exists in the project
                  named "Ecommerce Monorepo": look the project up by name and use the key it
                  returns, search it for an existing ticket, create one only if none exists, and
                  mention the ticket key in your summary. Create tickets nowhere else. If a build
                  fails and fixing it needs edits, do this right before the first edit, not before
                  the build.
                - The `search` tool is a natural-language relevance search: it returns no assignee
                  or status and can miss tickets that exist. For "my tickets", assignee or status
                  questions, run JQL with `searchJiraIssuesUsingJql`, for example
                  `assignee = currentUser() AND resolution = Unresolved ORDER BY updated DESC`. If
                  that tool is not in your tool list, ask the server's `discover` tool for it and run
                  the operation it names with `executeRead`, `executeWrite` or `executeDestructive`
                  (the one matching the operation).
                - If the `atlassian` server gives you only the `search` tool (no tools to read,
                  JQL-search or create Jira issues, and no `discover` or `execute*` tools), the API token's
                  scopes are probably too narrow, because the server lists only the tools the token
                  is scoped for. Say so and stop. Never answer a ticket-list question from `search`,
                  and never report "no tickets" from a natural-language search that returned nothing.
                - On a 401, a 403 or "not authorized", stop and report the exact message.
                <!-- atlassian-mcp:end -->
                ATLASSIAN_BLOCK
                }
                command -v codex >/dev/null 2>&1 || [ -d "$HOME/.codex" ] && add_block "$HOME/.codex/AGENTS.md"
                command -v claude >/dev/null 2>&1 || [ -d "$HOME/.claude" ] && add_block "$HOME/.claude/CLAUDE.md"
                exit 0
              description: Add the Atlassian site and rules to the agent's always-loaded instructions
              env:
                - HOME
                - PATH
              user: agent
        startup:
            - command: |
                export HOME="${HOME:-/home/agent}"
                export PATH="$HOME/.local/bin:$HOME/.claude/local:/usr/local/share/npm-global/bin:$PATH"
                if command -v claude >/dev/null 2>&1; then
                  claude mcp add atlassian "https://mcp.atlassian.com/v2/mcp" --transport http --scope user --header "Authorization: ${ATLASSIAN_AUTH_HEADER:-proxy-managed}" || true
                fi
                if command -v codex >/dev/null 2>&1; then
                  mkdir -p "$HOME/.codex"
                  cfg="$HOME/.codex/config.toml"
                  touch "$cfg"
                  grep -q '^\[mcp_servers\.atlassian\]' "$cfg" || printf '\n[mcp_servers.atlassian]\nurl = "https://mcp.atlassian.com/v2/mcp"\nenv_http_headers = { Authorization = "ATLASSIAN_AUTH_HEADER" }\n' >> "$cfg"
                fi
              description: Register the Atlassian MCP server with the Claude or Codex agent (startup fallback)
              user: agent
    - type: com.docker.sandbox/agent-context@1
      config:
        content: |
            ## Atlassian Cloud and Jira

            The hosted Atlassian MCP server is registered with the agent as `atlassian`
            (`https://mcp.atlassian.com/v2/mcp`). It authenticates with an Atlassian API
            token that the user keeps as an sbx secret on the host
            (`sbx secret set atlassian`); the sandbox only holds a placeholder in
            `ATLASSIAN_AUTH_HEADER`. There is nothing to sign in to.

            Jira site: `${{ kit.args.site }}`. If that is blank, ask the user for their
            Atlassian Cloud site (for example `yourteam.atlassian.net`) before querying
            anything. Where an Atlassian tool asks for a `cloudId`, pass
            `https://<site>`, or look the cloud ID up with the tool that lists
            accessible Atlassian resources.

            ### Use only the Atlassian MCP tools

            - Do all Atlassian work through the `atlassian` MCP server's tools. Do not
              call Atlassian REST APIs directly (for example with `curl`), and do not
              ask for network approval for any other Atlassian host such as
              `api.atlassian.com`.
            - Do not search the environment, files or shell history for credentials,
              and do not read, print or reuse `ATLASSIAN_AUTH_HEADER`. It holds only a
              placeholder that works inside the MCP server's own requests, and it is not
              a token you can use yourself.
            - The `search` tool is a natural-language relevance search. It returns no
              assignee or status and can miss tickets that exist, so do not answer "what
              are my tickets" or "what is open" from it. Run JQL with
              `searchJiraIssuesUsingJql`, for example
              `assignee = currentUser() AND resolution = Unresolved ORDER BY updated DESC`.
            - The server exposes only some tools directly. If a tool you need is not in
              your tool list, ask the server's `discover` tool for it and run the
              operation it names with `executeRead`, `executeWrite` or
              `executeDestructive` (the one matching the operation) before telling the
              user it is impossible.
            - If the `atlassian` server gives you only the `search` tool (no tools to
              read, JQL-search or create Jira issues, and no `discover` or `execute*`
              tools),
              the API token's scopes are probably too narrow, because the server lists
              only the tools the token is scoped for. Say so and stop. Never answer a
              ticket-list question from `search`, and never report "no tickets" from a
              natural-language search that returned nothing.
            - If the server answers 401 or 403, says it is not authorized, or Codex
              reports it failed to start, stop and report the exact message. It usually
              means the API token is missing, expired or rejected, or that an Atlassian
              admin has not enabled API token authentication for the Rovo MCP server.
              Do not work around it.

            ### Jira tickets for the "Ecommerce Monorepo"

            Code changes are tracked in the Jira project (space) named **Ecommerce
            Monorepo**, which has a Kanban board. This applies only when you are about
            to author new work by editing, creating or deleting source files in the
            project (a feature, a fix, a refactor). It does not apply to building,
            running, testing, installing dependencies, reading, explaining, status
            questions or security checks, and it does not apply to git operations or to
            undoing work: reverting, discarding or restoring changes (`git restore`,
            `git checkout -- <file>`, `git reset`, `git revert`, `git stash`),
            committing, pushing, pulling, merging, rebasing or branching. Do not touch
            Jira at all for those unless the user asks about Jira. If you are unsure,
            do not use Jira; ask. If
            a build fails and fixing it needs edits, do the following immediately before
            the first edit, not before the build:

            1. Look up the project by its name through the Atlassian MCP server (for
               example a `search` for the project name, or `discover` and then
               `executeRead` with `listJiraProjects`) and use
               the project key it returns. Do not guess the key.
            2. Search that project for an existing ticket that covers the requested
               work. If one exists, use it and do not create a duplicate.
            3. If no ticket exists, create one in the Ecommerce Monorepo project with a
               clear summary and a description of the work and its acceptance criteria.
               New tickets appear on the project's Kanban board.
            4. Mention the ticket key in your summary of the work.

            Only create tickets in the Ecommerce Monorepo project. If you cannot find
            that project, or the Atlassian server is unavailable or unauthenticated,
            stop and report the exact problem instead of using another project or
            skipping the ticket.
args:
    site:
        default: ""
        description: 'Hostname of your Atlassian Cloud site, for example `yourteam.atlassian.net` (no https:// prefix). Optional: when left empty the agent asks you for the site instead. Pass it with `--kit-arg atlassian-mcp.site=yourteam.atlassian.net`, or under the kit''s `args:` in an sbxenv.yaml.'
        pattern: ^([A-Za-z0-9-]+\.atlassian\.net)?$