jfeeneydemo3/dubjug-atlassian-mcp-kit:1.2.0

schemaVersion: "2"
kind: mixin
name: atlassian-mcp
version: 1.2.0
displayName: Atlassian Cloud MCP server
description: Registers the hosted Atlassian Rovo MCP server, authenticated with an Atlassian API token kept as an sbx secret, and requires Jira tickets to exist in the "Ecommerce Monorepo" project.
sourceURL: https://gitlab.com/dubjug/sandbox-mixin-kits
licenses:
    - Apache-2.0
args:
    site:
        default: ""
        description: 'Hostname of your Atlassian Cloud site, for example `yourteam.atlassian.net` (no https:// prefix). Optional: when left empty the agent asks you for the site instead. Pass it with `--kit-arg atlassian-mcp.site=yourteam.atlassian.net`, or under the kit''s `args:` in an sbxenv.yaml.'
        pattern: ^([A-Za-z0-9-]+\.atlassian\.net)?$
agentInstructions:
    content: |
        ## Atlassian Cloud and Jira

        The hosted Atlassian MCP server is registered with the agent as `atlassian`
        (`https://mcp.atlassian.com/v1/mcp`). It authenticates with an Atlassian API
        token that the user keeps as an sbx secret on the host
        (`sbx secret set atlassian`); the sandbox only holds a placeholder in
        `ATLASSIAN_AUTH_HEADER`. There is nothing to sign in to.

        Jira site: `${{ kit.args.site }}`. If that is blank, ask the user for their
        Atlassian Cloud site (for example `yourteam.atlassian.net`) before querying
        anything. Where an Atlassian tool asks for a `cloudId`, pass
        `https://<site>`, or look the cloud ID up with the tool that lists
        accessible Atlassian resources.

        ### Use only the Atlassian MCP tools

        - Do all Atlassian work through the `atlassian` MCP server's tools. Do not
          call Atlassian REST APIs directly (for example with `curl`), and do not
          ask for network approval for any other Atlassian host such as
          `api.atlassian.com`.
        - Do not search the environment, files or shell history for credentials,
          and do not read, print or reuse `ATLASSIAN_AUTH_HEADER`. It holds only a
          placeholder that works inside the MCP server's own requests, and it is not
          a token you can use yourself.
        - If the server answers 401 or 403, says it is not authorized, or Codex
          reports it failed to start, stop and report the exact message. It usually
          means the API token is missing, expired or rejected, or that an Atlassian
          admin has not enabled API token authentication for the Rovo MCP server.
          Do not work around it.

        ### Jira tickets for the "Ecommerce Monorepo"

        Work must be tracked in the Jira project (space) named **Ecommerce
        Monorepo**, which has a Kanban board. Before you start changing code:

        1. Look up the project by its name through the Atlassian MCP server (for
           example by listing visible Jira projects) and use the project key it
           returns. Do not guess the key.
        2. Search that project for an existing ticket that covers the requested
           work. If one exists, use it and do not create a duplicate.
        3. If no ticket exists, create one in the Ecommerce Monorepo project with a
           clear summary and a description of the work and its acceptance criteria.
           New tickets appear on the project's Kanban board.
        4. Mention the ticket key in your summary of the work.

        Only create tickets in the Ecommerce Monorepo project. If you cannot find
        that project, or the Atlassian server is unavailable or unauthenticated,
        stop and report the exact problem instead of using another project or
        skipping the ticket.
permissions:
    network:
        allow:
            - mcp.atlassian.com
credentials:
    - service: atlassian
      description: 'Atlassian API token for the Rovo MCP server, stored as the complete Authorization header value: `Basic ` followed by the base64 of `email:api_token`. Stored on the host; the sandbox only ever sees a placeholder.'
      required: true
      apiKey:
        name: ATLASSIAN_AUTH_HEADER
        proxyManaged: true
        inject:
            - domain: mcp.atlassian.com
              header: Authorization
              format: '%s'
setup:
    install:
        - command: |
            export PATH="$HOME/.local/bin:$HOME/.claude/local:/usr/local/share/npm-global/bin:$PATH"
            if command -v claude >/dev/null 2>&1; then
              claude mcp add atlassian https://mcp.atlassian.com/v1/mcp --transport http --scope user --header "Authorization: ${ATLASSIAN_AUTH_HEADER:-proxy-managed}" || true
            fi
            if command -v codex >/dev/null 2>&1; then
              mkdir -p "$HOME/.codex"
              cfg="$HOME/.codex/config.toml"
              touch "$cfg"
              grep -q '^\[mcp_servers\.atlassian\]' "$cfg" || printf '\n[mcp_servers.atlassian]\nurl = "https://mcp.atlassian.com/v1/mcp"\nenv_http_headers = { Authorization = "ATLASSIAN_AUTH_HEADER" }\n' >> "$cfg"
            fi
          user: agent
          description: Register the Atlassian MCP server with the Claude or Codex agent (install-time, race-free)
    startup:
        - command:
            - sh
            - -c
            - |
              export PATH="$HOME/.local/bin:$HOME/.claude/local:/usr/local/share/npm-global/bin:$PATH"
              if command -v claude >/dev/null 2>&1; then
                claude mcp add atlassian https://mcp.atlassian.com/v1/mcp --transport http --scope user --header "Authorization: ${ATLASSIAN_AUTH_HEADER:-proxy-managed}" || true
              fi
              if command -v codex >/dev/null 2>&1; then
                mkdir -p "$HOME/.codex"
                cfg="$HOME/.codex/config.toml"
                touch "$cfg"
                grep -q '^\[mcp_servers\.atlassian\]' "$cfg" || printf '\n[mcp_servers.atlassian]\nurl = "https://mcp.atlassian.com/v1/mcp"\nenv_http_headers = { Authorization = "ATLASSIAN_AUTH_HEADER" }\n' >> "$cfg"
              fi
          user: agent
          description: Register the Atlassian MCP server with the Claude or Codex agent (startup fallback)