jfeeneydemo3/dubjug-atlassian-mcp-kit:1.2.3

schemaVersion: "2"
kind: mixin
name: atlassian-mcp
version: 1.2.3
displayName: Atlassian Cloud MCP server
description: Registers the hosted Atlassian Rovo MCP server, authenticated with an Atlassian API token kept as an sbx secret, and requires Jira tickets to exist in the "Ecommerce Monorepo" project.
sourceURL: https://gitlab.com/dubjug/sandbox-mixin-kits
licenses:
    - Apache-2.0
args:
    site:
        default: ""
        description: 'Hostname of your Atlassian Cloud site, for example `yourteam.atlassian.net` (no https:// prefix). Optional: when left empty the agent asks you for the site instead. Pass it with `--kit-arg atlassian-mcp.site=yourteam.atlassian.net`, or under the kit''s `args:` in an sbxenv.yaml.'
        pattern: ^([A-Za-z0-9-]+\.atlassian\.net)?$
agentInstructions:
    content: |
        ## Atlassian Cloud and Jira

        The hosted Atlassian MCP server is registered with the agent as `atlassian`
        (`https://mcp.atlassian.com/v2/mcp`). It authenticates with an Atlassian API
        token that the user keeps as an sbx secret on the host
        (`sbx secret set atlassian`); the sandbox only holds a placeholder in
        `ATLASSIAN_AUTH_HEADER`. There is nothing to sign in to.

        Jira site: `${{ kit.args.site }}`. If that is blank, ask the user for their
        Atlassian Cloud site (for example `yourteam.atlassian.net`) before querying
        anything. Where an Atlassian tool asks for a `cloudId`, pass
        `https://<site>`, or look the cloud ID up with the tool that lists
        accessible Atlassian resources.

        ### Use only the Atlassian MCP tools

        - Do all Atlassian work through the `atlassian` MCP server's tools. Do not
          call Atlassian REST APIs directly (for example with `curl`), and do not
          ask for network approval for any other Atlassian host such as
          `api.atlassian.com`.
        - Do not search the environment, files or shell history for credentials,
          and do not read, print or reuse `ATLASSIAN_AUTH_HEADER`. It holds only a
          placeholder that works inside the MCP server's own requests, and it is not
          a token you can use yourself.
        - The `search` tool is a natural-language relevance search. It returns no
          assignee or status and can miss tickets that exist, so do not answer "what
          are my tickets" or "what is open" from it. Run JQL with
          `searchJiraIssuesUsingJql`, for example
          `assignee = currentUser() AND resolution = Unresolved ORDER BY updated DESC`.
        - The server exposes only some tools directly. If a tool you need is not in
          your tool list, ask the server's `discover` tool for it and run the
          operation it names with `executeRead`, `executeWrite` or
          `executeDestructive` (the one matching the operation) before telling the
          user it is impossible.
        - If the `atlassian` server gives you only the `search` tool (no tools to
          read, JQL-search or create Jira issues, and no `discover` or `execute*`
          tools),
          the API token's scopes are probably too narrow, because the server lists
          only the tools the token is scoped for. Say so and stop. Never answer a
          ticket-list question from `search`, and never report "no tickets" from a
          natural-language search that returned nothing.
        - If the server answers 401 or 403, says it is not authorized, or Codex
          reports it failed to start, stop and report the exact message. It usually
          means the API token is missing, expired or rejected, or that an Atlassian
          admin has not enabled API token authentication for the Rovo MCP server.
          Do not work around it.

        ### Jira tickets for the "Ecommerce Monorepo"

        Work must be tracked in the Jira project (space) named **Ecommerce
        Monorepo**, which has a Kanban board. Before you start changing code:

        1. Look up the project by its name through the Atlassian MCP server (for
           example a `search` for the project name, or `discover` and then
           `executeRead` with `listJiraProjects`) and use
           the project key it returns. Do not guess the key.
        2. Search that project for an existing ticket that covers the requested
           work. If one exists, use it and do not create a duplicate.
        3. If no ticket exists, create one in the Ecommerce Monorepo project with a
           clear summary and a description of the work and its acceptance criteria.
           New tickets appear on the project's Kanban board.
        4. Mention the ticket key in your summary of the work.

        Only create tickets in the Ecommerce Monorepo project. If you cannot find
        that project, or the Atlassian server is unavailable or unauthenticated,
        stop and report the exact problem instead of using another project or
        skipping the ticket.
permissions:
    network:
        allow:
            - mcp.atlassian.com
credentials:
    - service: atlassian
      description: 'Atlassian API token for the Rovo MCP server, stored as the complete Authorization header value: `Basic ` followed by the base64 of `email:api_token`. Stored on the host; the sandbox only ever sees a placeholder.'
      required: true
      apiKey:
        name: ATLASSIAN_AUTH_HEADER
        proxyManaged: true
        inject:
            - domain: mcp.atlassian.com
              header: Authorization
              format: '%s'
setup:
    install:
        - command: |
            export PATH="$HOME/.local/bin:$HOME/.claude/local:/usr/local/share/npm-global/bin:$PATH"
            if command -v claude >/dev/null 2>&1; then
              claude mcp add atlassian "https://mcp.atlassian.com/v2/mcp" --transport http --scope user --header "Authorization: ${ATLASSIAN_AUTH_HEADER:-proxy-managed}" || true
            fi
            if command -v codex >/dev/null 2>&1; then
              mkdir -p "$HOME/.codex"
              cfg="$HOME/.codex/config.toml"
              touch "$cfg"
              grep -q '^\[mcp_servers\.atlassian\]' "$cfg" || printf '\n[mcp_servers.atlassian]\nurl = "https://mcp.atlassian.com/v2/mcp"\nenv_http_headers = { Authorization = "ATLASSIAN_AUTH_HEADER" }\n' >> "$cfg"
            fi
          user: agent
          description: Register the Atlassian MCP server with the Claude or Codex agent (install-time, race-free)
        - command: |
            export PATH="$HOME/.local/bin:$HOME/.claude/local:/usr/local/share/npm-global/bin:$PATH"
            add_block() {
              f="$1"
              mkdir -p "$(dirname "$f")"
              touch "$f"
              grep -q 'atlassian-mcp:start' "$f" && return 0
              cat >> "$f" <<'ATLASSIAN_BLOCK'

            <!-- atlassian-mcp:start -->
            ## Atlassian and Jira (kit: atlassian-mcp)

            - Jira site: `${{ kit.args.site }}`. If that is blank, ask the user for it. Where an
              Atlassian tool wants a `cloudId`, pass `https://<site>`.
            - Use only the `atlassian` MCP server's tools for Atlassian work. Do not call
              Atlassian REST APIs (for example with `curl`), do not scan the environment for
              credentials, and never use `ATLASSIAN_AUTH_HEADER`: it is only a placeholder.
            - Before changing code, make sure a Jira ticket exists in the project named
              "Ecommerce Monorepo": look the project up by name and use the key it returns,
              search it for an existing ticket, create one only if none exists, and mention
              the ticket key in your summary. Create tickets nowhere else.
            - The `search` tool is a natural-language relevance search: it returns no assignee
              or status and can miss tickets that exist. For "my tickets", assignee or status
              questions, run JQL with `searchJiraIssuesUsingJql`, for example
              `assignee = currentUser() AND resolution = Unresolved ORDER BY updated DESC`. If
              that tool is not in your tool list, ask the server's `discover` tool for it and run
              the operation it names with `executeRead`, `executeWrite` or `executeDestructive`
              (the one matching the operation).
            - If the `atlassian` server gives you only the `search` tool (no tools to read,
              JQL-search or create Jira issues, and no `discover` or `execute*` tools), the API token's
              scopes are probably too narrow, because the server lists only the tools the token
              is scoped for. Say so and stop. Never answer a ticket-list question from `search`,
              and never report "no tickets" from a natural-language search that returned nothing.
            - On a 401, a 403 or "not authorized", stop and report the exact message.
            <!-- atlassian-mcp:end -->
            ATLASSIAN_BLOCK
            }
            command -v codex >/dev/null 2>&1 || [ -d "$HOME/.codex" ] && add_block "$HOME/.codex/AGENTS.md"
            command -v claude >/dev/null 2>&1 || [ -d "$HOME/.claude" ] && add_block "$HOME/.claude/CLAUDE.md"
            exit 0
          user: agent
          description: Add the Atlassian site and rules to the agent's always-loaded instructions
    startup:
        - command:
            - sh
            - -c
            - |
              export PATH="$HOME/.local/bin:$HOME/.claude/local:/usr/local/share/npm-global/bin:$PATH"
              if command -v claude >/dev/null 2>&1; then
                claude mcp add atlassian "https://mcp.atlassian.com/v2/mcp" --transport http --scope user --header "Authorization: ${ATLASSIAN_AUTH_HEADER:-proxy-managed}" || true
              fi
              if command -v codex >/dev/null 2>&1; then
                mkdir -p "$HOME/.codex"
                cfg="$HOME/.codex/config.toml"
                touch "$cfg"
                grep -q '^\[mcp_servers\.atlassian\]' "$cfg" || printf '\n[mcp_servers.atlassian]\nurl = "https://mcp.atlassian.com/v2/mcp"\nenv_http_headers = { Authorization = "ATLASSIAN_AUTH_HEADER" }\n' >> "$cfg"
              fi
          user: agent
          description: Register the Atlassian MCP server with the Claude or Codex agent (startup fallback)