Developer MCP Server

An MCP (Model Context Protocol) server that connects AI assistants to developer tools — Jira, Confluence, Veracode SAST, and SonarQube — through a single server. It enables AI-driven workflows: read Jira stories, search Confluence docs, check security scan results, and fix code — all via natural language.

Table of Contents

• Quick Start
• Prerequisites
• Environment Variables
• Atlassian (Jira & Confluence) Setup
• Veracode Setup
• SonarQube Setup
• Git Branch Auto-Detection
• VS Code MCP Configuration
• Claude Code Configuration
• Build & Run
• Available Tools
• Project Structure
• Documentation
• Troubleshooting

Quick Start

# 1. Install dependencies
npm install

# 2. Copy and configure environment variables
cp .env.example .env
# Edit .env with your credentials (see sections below)

# 3. Build
npm run build

# 4. Run
npm start

Prerequisites

• Node.js v18+ (required for native fetch)
• Atlassian Cloud account (Jira & Confluence) — required
• Veracode API credentials — optional
• SonarQube User Token — optional
• GitHub PAT — optional (for Veracode PR-to-scan matching)

Environment Variables

All configuration is done through environment variables. Copy .env.example to .env and fill in your values.

Required (Atlassian)

Optional (Veracode)

Optional (SonarQube)

Optional (Shared)

Atlassian (Jira & Confluence) Setup

Jira and Confluence tools are always registered — they are the base integration.

1. Generate an API Token

1. Go to id.atlassian.com/manage-profile/security/api-tokens
2. Click Create API token
3. Give it a label (e.g. mcp-server)
4. Copy the token

2. Configure

ATLASSIAN_BASE_URL=https://yourcompany.atlassian.net
ATLASSIAN_EMAIL=your-email@company.com
ATLASSIAN_API_TOKEN=your-api-token

Authentication

All Jira and Confluence API calls use HTTP Basic Authentication:

Authorization: Basic {base64(email:apiToken)}

Veracode Setup

Veracode tools are optional. If VERACODE_API_ID and VERACODE_API_KEY are not set, they are silently disabled.

1. Generate API Credentials

1. Log into the Veracode web UI via SAML/SSO
2. Click your name (top right) > API Credentials
3. Click Generate API Credentials
4. Copy the API ID and API Secret Key

API credentials are valid for 1 year and are separate from your SSO login.

2. Configure GitHub (for PR-to-scan matching)

The veracode_find_scan_for_pr tool resolves your current branch to a GitHub PR, finds the CI workflow run, and matches it to a Veracode scan. This requires:

• GITHUB_TOKEN — A PAT with Actions:read and Contents:read scopes
• GITHUB_REPO — Repository in owner/repo format (e.g. inContact/POCR)

Authentication

Veracode uses per-request HMAC-SHA256 signing. This is handled automatically by the client.

SonarQube Setup

SonarQube tools are optional. If SONARQUBE_BASE_URL and SONARQUBE_TOKEN are not set, they are silently disabled.

1. Generate a User Token

SAML/SSO is for the web UI only. The API requires a User Token:

1. Log into SonarQube via SAML
2. Go to My Account > Security > Generate Tokens
3. Token type: User Token (not Global Analysis or Project Analysis)
4. Give it a name (e.g. mcp-server)
5. Copy the token

Do NOT use Global Analysis Token or Project Analysis Token — those are for scanners/CI only and cannot read issues or reports.

2. Find Your Project Key

Run sonarqube_list_projects after setup to find the correct project key, or check your SonarQube project settings page.

Authentication

Authorization: Bearer {SONARQUBE_TOKEN}

Git Branch Auto-Detection

Veracode and SonarQube tools auto-detect the current Git branch so developers don't need to specify it. Set GIT_REPO_PATH to the local path of your repository:

GIT_REPO_PATH=C:\Users\you\Documents\POCR

The server runs git rev-parse --abbrev-ref HEAD in this directory to detect the branch.

VS Code MCP Configuration

Create or update .vscode/mcp.json in your workspace:

{
  "servers": {
    "dev-mcp": {
      "command": "node",
      "args": ["C:/path/to/pocr_dev_mcp/dist/index.js"],
      "env": {
        "NODE_TLS_REJECT_UNAUTHORIZED": "0",

        "ATLASSIAN_BASE_URL": "https://yourcompany.atlassian.net",
        "ATLASSIAN_EMAIL": "your-email@company.com",
        "ATLASSIAN_API_TOKEN": "your-api-token",

        "VERACODE_API_ID": "your-api-id",
        "VERACODE_API_KEY": "your-api-secret-key",
        "VERACODE_APP_NAME": "your-veracode-app-name",

        "GITHUB_TOKEN": "ghp_your-token",
        "GITHUB_REPO": "owner/repo",

        "SONARQUBE_BASE_URL": "https://sonar.nice.com",
        "SONARQUBE_TOKEN": "your-sonarqube-user-token",
        "SONARQUBE_PROJECT_KEY": "your-project-key",

        "GIT_REPO_PATH": "C:/path/to/your/repo"
      }
    }
  }
}

After configuring, restart the MCP server in VS Code (Ctrl+Shift+P > "MCP: Restart Server").

Claude Code Configuration

Add to your Claude Code MCP settings (~/.claude/claude_desktop_config.json or project-level):

{
  "mcpServers": {
    "dev-mcp": {
      "command": "node",
      "args": ["C:/path/to/pocr_dev_mcp/dist/index.js"],
      "env": {
        "NODE_TLS_REJECT_UNAUTHORIZED": "0",
        "ATLASSIAN_BASE_URL": "https://yourcompany.atlassian.net",
        "ATLASSIAN_EMAIL": "your-email@company.com",
        "ATLASSIAN_API_TOKEN": "your-api-token",
        "VERACODE_API_ID": "your-api-id",
        "VERACODE_API_KEY": "your-api-secret-key",
        "VERACODE_APP_NAME": "your-veracode-app-name",
        "GITHUB_TOKEN": "ghp_your-token",
        "GITHUB_REPO": "owner/repo",
        "SONARQUBE_BASE_URL": "https://sonar.nice.com",
        "SONARQUBE_TOKEN": "your-sonarqube-user-token",
        "SONARQUBE_PROJECT_KEY": "your-project-key",
        "GIT_REPO_PATH": "C:/path/to/your/repo"
      }
    }
  }
}

Build & Run

# Install dependencies
npm install

# Build (compiles TypeScript to dist/)
npm run build

# Run the server
npm start

# Development mode (auto-reloads)
npm run dev

Rebuild and restart the MCP server after any code changes.

Available Tools

Jira (7 tools) — always registered

Confluence (5 tools) — always registered

Veracode (6 tools) — optional

SonarQube (3 tools) — optional

Project Structure

src/
  index.ts                              # Entry point — loads config, starts server
  server.ts                             # Creates MCP server, registers all tools
  config.ts                             # Config loaders for all integrations
  utils/
    git.ts                              # getCurrentBranch() — auto-detects branch
  clients/
    http-client.ts                      # Atlassian HTTP client (Basic Auth, retry on 429)
    jira-client.ts                      # Jira REST API v3
    jira-agile-client.ts               # Jira Agile API v1 (boards, sprints)
    confluence-client.ts                # Confluence REST API v2
    veracode-client.ts                  # Veracode XML API v5 (HMAC-SHA256 auth)
    sonarqube-client.ts                 # SonarQube Web API (Bearer token auth)
  tools/
    jira/                               # 7 Jira MCP tools
    confluence/                         # 5 Confluence MCP tools
    veracode/                           # 6 Veracode MCP tools
    sonarqube/                          # 3 SonarQube MCP tools
  resources/
    index.ts                            # MCP resources for Jira & Confluence
  converters/
    adf-to-markdown.ts                  # Atlassian Document Format to markdown
    storage-to-markdown.ts              # Confluence storage format to markdown
    drawio-to-text.ts                   # Draw.io diagram to text
    truncation.ts                       # Content truncation utilities
  types/
    jira.ts                             # Jira type definitions
    confluence.ts                       # Confluence type definitions
    veracode.ts                         # Veracode type definitions
    sonarqube.ts                        # SonarQube type definitions

Documentation

Detailed integration guides and usage prompts:

Troubleshooting

401 Unauthorized

TLS Certificate Error

If behind a corporate proxy:

NODE_TLS_REJECT_UNAUTHORIZED=0

Tools Not Showing Up

• Veracode tools require both VERACODE_API_ID and VERACODE_API_KEY
• SonarQube tools require both SONARQUBE_BASE_URL and SONARQUBE_TOKEN
• Check the server stderr for "tools disabled" messages
• Rebuild (npm run build) and restart the MCP server

Branch Not Auto-Detected

• Set GIT_REPO_PATH to the local repo path (not the MCP server path)
• Ensure git is available on PATH
• The path must be the repo root (where .git/ lives)

Rate Limiting (Atlassian)

The HTTP client automatically retries on HTTP 429 with exponential backoff (up to 3 retries). If you consistently hit rate limits, reduce request frequency.

Veracode Scan Not Found

• The CI-triggered scan may still be running
• Ensure GITHUB_TOKEN has Actions:read scope
• Check that GITHUB_REPO matches the correct org/repo

SonarQube No Data for Branch

• SonarQube only has data for branches that have been analyzed in CI
• If the branch has never been scanned, results will be empty