chore: add Claude AI skills for CVE resolution workflow [rhoai-2.25]#2546
chore: add Claude AI skills for CVE resolution workflow [rhoai-2.25]#2546ayush17 wants to merge 1 commit into
Conversation
Backport from main: Add Claude Code CLI and Cursor IDE integration for automated CVE resolution workflow. - .claude/commands/fix-cve.md: Main CVE workflow command - .claude/skills/cve-resolution/SKILL.md: CVE resolution skill - docs/cves/cve-developer-guide.md: Full workflow documentation - docs/claude-mcp.md: MCP setup guide Co-authored-by: Cursor <cursoragent@cursor.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@ayush17 — This PR is from a fork. Recommended: Push your branch to the main repo for full CI: Then open a new PR from that branch. No push access? A maintainer will cherry-pick and test your changes. See CONTRIBUTING.md for details. |
📝 WalkthroughWalkthroughAdds Jira MCP configuration and documentation, standardized assistant command and skill specifications, an autonomous CVE remediation workflow, and structured CVE resolution logging templates. ChangesAssistant workflows
Estimated code review effort: 3 (Moderate) | ~25 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/commands/fix-cve.md:
- Around line 161-187: Update the backport branch creation command to use
rhoai-2.25 instead of origin/main, and update the gh pr create command to
explicitly target rhoai-2.25 with --base. Keep the existing branch naming and PR
workflow unchanged.
- Around line 124-126: Update the Jira tool reference in the relevant workflow
step from getJiraUserProfile to the documented getJiraIssue name, preserving the
step’s intended Jira lookup behavior.
In @.claude/commands/hello.md:
- Around line 18-20: Update the Jira user-name lookup steps in hello.md to use
the configured MCP tool names documented in CLAUDE.md and docs/claude-mcp.md,
replacing jira_get_user_profile and jira_search with their documented
equivalents while preserving the existing lookup order, JQL, limit, and
displayName extraction behavior.
In @.cursor/mcp.json.example:
- Around line 4-5: Replace the non-existent `@anthropic/mcp-atlassian` package in
the npx command for both .cursor/mcp.json.example lines 4-5 and
.mcp.json.example lines 4-5 with the intended published Atlassian MCP package,
preserving the existing example command structure.
In @.mcp.json.example:
- Around line 7-8: Update the JIRA_EMAIL and JIRA_API_TOKEN placeholders in the
MCP configuration to use Claude Code’s ${VAR} syntax instead of the
Cursor-specific ${env:VAR} format.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f204bd9d-5967-494f-8c72-ac82e3861d43
📒 Files selected for processing (13)
.claude/commands/_TEMPLATE.md.claude/commands/fix-cve.md.claude/commands/hello.md.claude/skills/.keep.claude/skills/cve-resolution/SKILL.md.cursor/mcp.json.example.env.mcp.local.example.gitignore.mcp.json.exampleCLAUDE.mddocs/claude-mcp.mddocs/cves/cve-developer-guide.mddocs/cves/logs/cve-resolution-log.md
| ``` | ||
| Tool: getJiraUserProfile | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '== fix-cve.md excerpt =='
nl -ba .claude/commands/fix-cve.md | sed -n '110,210p'
echo
echo '== claude-mcp.md search for Jira tools =='
rg -n -i 'getJiraUserProfile|jira|atlassian|mcp' docs/claude-mcp.md .claude/commands/fix-cve.md
echo
echo '== all references to getJiraUserProfile in repo =='
rg -n -i 'getJiraUserProfile'
echo
echo '== all Jira tool names in docs/claude-mcp.md =='
rg -n -i 'get[A-Za-z]*Jira[A-Za-z]*|jira.*tool|tool.*jira' docs/claude-mcp.mdRepository: red-hat-data-services/notebooks
Length of output: 234
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'docs/claude-mcp.md contains getJiraUserProfile: '
if rg -q -i 'getJiraUserProfile' docs/claude-mcp.md; then
echo yes
else
echo no
fi
printf 'docs/claude-mcp.md Jira tool names:\n'
rg -n -i 'get[A-Za-z]*Jira[A-Za-z]*' docs/claude-mcp.md || true
printf '\nfix-cve.md backport branch lines:\n'
nl -ba .claude/commands/fix-cve.md | sed -n '156,190p'Repository: red-hat-data-services/notebooks
Length of output: 374
🌐 Web query:
"@anthropic/mcp-atlassian getJiraUserProfile"
💡 Result:
The tool jira_get_user_profile is a specific function provided by the community-maintained mcp-atlassian server (not the official Atlassian Rovo MCP server) [1][2][3]. It is designed to retrieve profile information for a specific Jira user [1][4]. Key details about jira_get_user_profile: * Functionality: Retrieves profile data (such as username, account ID, and key) for a user [5][1]. * Input: Requires a user_identifier argument, which can be an email address, username, account ID, or key [1][4]. * Output: Returns a JSON string containing the user's profile information or an error object if the lookup fails [1]. * Implementation: It is defined within the mcp-atlassian repository, specifically managed in src/mcp_atlassian/servers/jira.py and utilizing src/mcp_atlassian/jira/users.py for API interaction [5][1]. * Note: This tool is not part of the official Atlassian Rovo MCP server [2][6]. If you are using the official Atlassian server, you will not have access to this specific tool [2][6]. Users should be aware that, in some versions of the mcp-atlassian server, using 'me' or 'currentUser' as an identifier has been known to cause errors, requiring explicit account identifiers [7].
Citations:
- 1: https://github.com/sooperset/mcp-atlassian/blob/8e84d747/src/mcp_atlassian/servers/jira.py
- 2: https://github.com/atlassian/atlassian-mcp-server
- 3: https://github.com/sooperset/mcp-atlassian/
- 4: https://glama.ai/mcp/servers/SharkyND/mcp-atlassian/tools/jira_get_user_profile
- 5: https://github.com/sooperset/mcp-atlassian/blob/8e84d747/src/mcp_atlassian/jira/users.py
- 6: https://support.atlassian.com/atlassian-rovo-mcp-server/docs/supported-tools/
- 7: [Bug]: jira_get_user_profile fails with 'me' identifier causing LLM process crash sooperset/mcp-atlassian#596
🌐 Web query:
"site:github.com anthropic mcp atlassian getJiraUserProfile"
💡 Result:
The getJiraUserProfile tool (often referenced as jira_get_user_profile) is a common tool implemented in various community-maintained Atlassian Model Context Protocol (MCP) servers [1][2][3][4]. It is designed to retrieve profile information for a specific Jira user using an identifier such as an email address, username, account ID, or key [1][5][2][4]. Key points regarding this tool and the broader Atlassian MCP ecosystem: 1. Functionality: The tool typically takes a user_identifier argument [1][2] and returns a JSON object containing the user's Jira profile details [1][2]. It is widely used by community-built MCP servers, such as those found in the sooperset/mcp-atlassian repository, to allow AI assistants to query Jira user information [1][5]. 2. Community Implementations: Multiple independent MCP servers provide this tool, reflecting a common pattern in the MCP community for Jira integration [2][3][6][4]. Implementation details, such as parameter validation and error handling, vary across these repositories [7][1][5]. For instance, some implementations have encountered issues resolving shorthand identifiers like "me" or "currentUser" to valid Jira account IDs, leading to potential process crashes during LLM-driven workflows [7]. 3. Official vs. Community Servers: While community servers like mcp-atlassian provide tools like getJiraUserProfile via direct API wrappers [1][8], Atlassian also provides an official Rovo MCP server [9]. The official server is cloud-based and supports OAuth 2.1 and API tokens to interact with Atlassian products [9]. Some users have noted limitations in how specific MCP clients (such as Claude Code) handle the authentication flows for official HTTP-based MCP servers, sometimes pushing users toward community-maintained alternatives [10]. When working with these tools, it is recommended to check the specific documentation or README for the MCP server repository you are using, as the naming conventions (e.g., jira_get_user_profile vs. get_jira_user) and supported features can differ between implementations [8][2][6].
Citations:
- 1: https://github.com/sooperset/mcp-atlassian/blob/8e84d747/src/mcp_atlassian/servers/jira.py
- 2: https://glama.ai/mcp/servers/GeiserX/atlassian-browser-mcp/tools/jira_get_user_profile
- 3: https://registry.npmjs.org/%40guhcostan%2Fjira-mcp
- 4: https://glama.ai/mcp/servers/SharkyND/mcp-atlassian/tools/jira_get_user_profile
- 5: https://github.com/sooperset/mcp-atlassian/blob/8e84d747/src/mcp_atlassian/jira/users.py
- 6: https://github.com/jl-0/JIRA-API-MCP/blob/main/README.md
- 7: [Bug]: jira_get_user_profile fails with 'me' identifier causing LLM process crash sooperset/mcp-atlassian#596
- 8: https://github.com/zivzhang80/mcp-atlassian
- 9: https://github.com/atlassian/atlassian-mcp-server
- 10: [BUG] MCP OAuth support for HTTP servers (e.g. Atlassian official MCP) anthropics/claude-code#36374
Use a documented Jira tool name here getJiraUserProfile is not listed in docs/claude-mcp.md; the Jira tool documented there is getJiraIssue, so this step will fail as written unless the MCP server actually exposes a different profile tool.
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 124-124: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/commands/fix-cve.md around lines 124 - 126, Update the Jira tool
reference in the relevant workflow step from getJiraUserProfile to the
documented getJiraIssue name, preserving the step’s intended Jira lookup
behavior.
| ```bash | ||
| git checkout -b fix/cve-YYYY-NNNNN-package origin/main | ||
| ``` | ||
|
|
||
| 3. **Add constraint** (just do it): | ||
| ``` | ||
| # CVE-YYYY-NNNNN: description | ||
| package>=X.Y.Z | ||
| ``` | ||
|
|
||
| 4. **Regenerate lockfiles** (just do it): | ||
| ```bash | ||
| make refresh-lock-files | ||
| ``` | ||
|
|
||
| 5. **If fix fails:** Log reason, continue to next CVE | ||
|
|
||
| 6. **Commit** (just do it): | ||
| ```bash | ||
| git add . && git commit -m "RHAIENG-XXXX: chore(deps): fix CVE-..." | ||
| ``` | ||
|
|
||
| 7. **Push and create PR** (just do it): | ||
| ```bash | ||
| git push -u origin fix/cve-... | ||
| gh pr create --title "..." --body "..." | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Update base branch references for the backport.
Based on the PR objectives, this is a backport to the rhoai-2.25 branch. Hardcoding origin/main will cause the AI to branch off main rather than rhoai-2.25. Additionally, gh pr create defaults to the repository's default branch (usually main) unless a base is specified, resulting in PRs targeting the wrong branch with an incorrect git history.
Update the git checkout command to branch from rhoai-2.25 and explicitly pass --base rhoai-2.25 to gh pr create.
💻 Proposed fixes for branch targeting
For the branch creation (around line 162):
- git checkout -b fix/cve-YYYY-NNNNN-package origin/main
+ git checkout -b fix/cve-YYYY-NNNNN-package origin/rhoai-2.25For the PR creation (around line 186):
- gh pr create --title "..." --body "..."
+ gh pr create --base rhoai-2.25 --title "..." --body "..."📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ```bash | |
| git checkout -b fix/cve-YYYY-NNNNN-package origin/main | |
| ``` | |
| 3. **Add constraint** (just do it): | |
| ``` | |
| # CVE-YYYY-NNNNN: description | |
| package>=X.Y.Z | |
| ``` | |
| 4. **Regenerate lockfiles** (just do it): | |
| ```bash | |
| make refresh-lock-files | |
| ``` | |
| 5. **If fix fails:** Log reason, continue to next CVE | |
| 6. **Commit** (just do it): | |
| ```bash | |
| git add . && git commit -m "RHAIENG-XXXX: chore(deps): fix CVE-..." | |
| ``` | |
| 7. **Push and create PR** (just do it): | |
| ```bash | |
| git push -u origin fix/cve-... | |
| gh pr create --title "..." --body "..." | |
| ``` |
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 166-166: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/commands/fix-cve.md around lines 161 - 187, Update the backport
branch creation command to use rhoai-2.25 instead of origin/main, and update the
gh pr create command to explicitly target rhoai-2.25 with --base. Keep the
existing branch naming and PR workflow unchanged.
| 1. Fetch the current user's name via Jira MCP (try in order): | ||
| - `jira_get_user_profile` with `user_identifier: "me"` → use `displayName` | ||
| - If that fails: `jira_search` with JQL `assignee = currentUser() ORDER BY updated DESC`, `limit: 1`, `fields: assignee` → use `assignee.displayName` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '== Files matching relevant names ==\n'
git ls-files | rg '(^|/)(CLAUDE\.md|docs/claude-mcp\.md|.*hello\.md)$|jira_get_user_profile|jira_search|searchJiraIssuesUsingJql'
printf '\n== Search for tool names in repo ==\n'
rg -n --hidden --no-ignore 'jira_get_user_profile|jira_search|searchJiraIssuesUsingJql|`@anthropic/mcp-atlassian`' .
printf '\n== Read cited docs around matches ==\n'
for f in CLAUDE.md docs/claude-mcp.md .claude/commands/hello.md; do
if [ -f "$f" ]; then
echo "--- $f ---"
nl -ba "$f" | sed -n '1,220p'
fi
doneRepository: red-hat-data-services/notebooks
Length of output: 1736
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Narrow search for the cited docs and command file.
for f in CLAUDE.md docs/claude-mcp.md .claude/commands/hello.md; do
if [ -f "$f" ]; then
echo "--- $f (first 220 lines) ---"
nl -ba "$f" | sed -n '1,220p'
fi
done
echo "--- repo matches ---"
rg -n --hidden --no-ignore 'jira_get_user_profile|jira_search|searchJiraIssuesUsingJql|searchJiraIssuesUsingJql|`@anthropic/mcp-atlassian`' . || trueRepository: red-hat-data-services/notebooks
Length of output: 245
🌐 Web query:
@anthropic/mcp-atlassian Jira MCP tool names jira_get_user_profile jira_search searchJiraIssuesUsingJql
💡 Result:
The tools you mentioned are part of the ecosystem surrounding Model Context Protocol (MCP) servers for Atlassian products, though their availability and naming depend on whether you are using the official Atlassian Rovo MCP Server or community-maintained packages like mcp-atlassian [1][2]. 1. searchJiraIssuesUsingJql: This is a standard and well-documented tool provided by the official Atlassian Rovo MCP Server [3]. It is used to perform Jira searches using JQL queries [3][4]. Recent updates have added support for cursor-based pagination using pageInfo [5]. 2. jira_get_user_profile: This tool is found in community-maintained MCP servers (e.g., mcp-atlassian on PyPI) [6]. It is designed to fetch Jira user profile information [6]. Note that users have reported issues with this tool when using the identifier "me," which typically requires resolution to an account ID [7]. 3. jira_search: This is also typically associated with community-maintained MCP servers [8]. While it is intended for Jira searches, some users have reported issues where it returns empty results depending on the client or environment configuration [8]. Key Distinctions: - Official Atlassian Rovo MCP Server: This is the official cloud-based bridge supported by Atlassian [2]. It uses tools like searchJiraIssuesUsingJql and follows specific naming conventions documented in Atlassian's support resources [3]. - Community MCP Servers: Packages such as mcp-atlassian often provide a broader range of utility tools (like jira_get_user_profile and jira_search) but may face different bugs or integration challenges with specific AI clients [1][7][8][6]. If you are encountering errors with these tools, ensure your client is correctly configured with the required authentication (OAuth 2.1 or API tokens) and that you are using the version of the MCP server appropriate for your specific needs (official vs. community) [2].
Citations:
- 1: All tool calls return 403 on Jira Data Center despite valid PAT — atlassian-python-api works directly sooperset/mcp-atlassian#1279
- 2: https://github.com/atlassian/atlassian-mcp-server
- 3: https://support.atlassian.com/atlassian-rovo-mcp-server/docs/supported-tools/
- 4: https://github.com/atlassian/atlassian-mcp-server/blob/5d300c892a43513c4c5d3ecb534bf9c78b6d6389/skills/generate-status-report/SKILL.md
- 5: Pagination broken: searchJiraIssuesUsingJql never returns nextPageToken or pagination metadata atlassian/atlassian-mcp-server#118
- 6: https://pypi.org/project/mcp-atlassian/0.11.12/
- 7: [Bug]: jira_get_user_profile fails with 'me' identifier causing LLM process crash sooperset/mcp-atlassian#596
- 8: [BUG] MCP Bug: Atlassian MCP Server Returns Empty Results anthropics/claude-code#35235
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- CLAUDE.md (lines 60-90) ---\n'
sed -n '60,90p' CLAUDE.md
printf '\n--- docs/claude-mcp.md (lines 65-90) ---\n'
sed -n '65,90p' docs/claude-mcp.md
printf '\n--- .claude/commands/hello.md (lines 14-24) ---\n'
sed -n '14,24p' .claude/commands/hello.mdRepository: red-hat-data-services/notebooks
Length of output: 260
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- CLAUDE.md (lines 60-90) ---'
sed -n '60,90p' CLAUDE.md
echo
echo '--- docs/claude-mcp.md (lines 65-90) ---'
sed -n '65,90p' docs/claude-mcp.md
echo
echo '--- .claude/commands/hello.md (lines 14-24) ---'
sed -n '14,24p' .claude/commands/hello.mdRepository: red-hat-data-services/notebooks
Length of output: 2298
Align the Jira MCP tool names here
.claude/commands/hello.md:18-20 should use the Jira tools documented in CLAUDE.md/docs/claude-mcp.md (searchJiraIssuesUsingJql, etc.). jira_get_user_profile and jira_search aren’t listed, so this command will fail against the configured MCP server.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/commands/hello.md around lines 18 - 20, Update the Jira user-name
lookup steps in hello.md to use the configured MCP tool names documented in
CLAUDE.md and docs/claude-mcp.md, replacing jira_get_user_profile and
jira_search with their documented equivalents while preserving the existing
lookup order, JQL, limit, and displayName extraction behavior.
| "command": "npx", | ||
| "args": ["-y", "@anthropic/mcp-atlassian"], |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the existence of the Atlassian MCP server packages
echo "Checking `@anthropic/mcp-atlassian`..."
npm view `@anthropic/mcp-atlassian` name || echo "Not found"
echo -e "\nChecking `@modelcontextprotocol/server-atlassian`..."
npm view `@modelcontextprotocol/server-atlassian` name || echo "Not found"Repository: red-hat-data-services/notebooks
Length of output: 1618
🌐 Web query:
Atlassian MCP server package name official Anthropic modelcontextprotocol server-atlassian npm
💡 Result:
Atlassian does not have an official "npm package" for their MCP server in the traditional sense of a library you install [1][2][3]. Instead, the official Atlassian Rovo MCP server is a cloud-hosted service provided by Atlassian [1][3][4]. To connect local AI clients (such as Claude Desktop, Cursor, or VS Code) to this official cloud-hosted server, Atlassian provides instructions to use the mcp-remote proxy package from npm [1][5]. The standard configuration for this setup is: command: npx args: ["-y", "mcp-remote", "https://mcp.atlassian.com/v1/sse"] This allows your local environment to bridge to Atlassian’s official remote MCP infrastructure securely [1][2][4]. While there are various community-maintained MCP server packages on npm—such as atlassian-confluence-mcp-server [6] or others—they are not official products from Atlassian [7][6][8]. Anthropic is an official partner, but the MCP server infrastructure is managed and hosted by Atlassian [3][4].
Citations:
- 1: https://github.com/atlassian/atlassian-mcp-server
- 2: https://github.com/atlassian/atlassian-mcp-server?tab=readme-ov-file
- 3: https://www.atlassian.com/blog/announcements/remote-mcp-server
- 4: https://www.atlassian.com/platform/rovo-mcp
- 5: https://community.atlassian.com/forums/Atlassian-Remote-MCP-Server/Atlassian-Remote-MCP-Server-beta-now-available-for-desktop/ba-p/3022084
- 6: https://www.npmjs.com/package/atlassian-confluence-mcp-server
- 7: https://github.com/Optibus/mcp-atlassian
- 8: https://github.com/juanfranem/atlassian-mcp
🌐 Web query:
site:npmjs.com Atlassian MCP server package modelcontextprotocol server-atlassian anthropic
💡 Result:
There is no single official, all-encompassing Atlassian MCP server package; however, Atlassian does provide an official MCP server for its design system, and the ecosystem contains numerous community-developed servers for Jira and Confluence [1]. Official Package The official MCP server released by Atlassian is @atlaskit/ads-mcp [1]. It is designed specifically for the Atlassian Design System, allowing developers to programmatically access design tokens, icons, and components [1]. Atlassian provides both a package for local use and a hosted remote MCP server endpoint [1]. Community Ecosystem for Jira and Confluence While Atlassian has not released an official MCP server for its core productivity products (Jira and Confluence), there is a robust and active community ecosystem of open-source MCP servers that integrate these platforms with AI assistants like Claude [2][3][4][5]. These packages are independently maintained and typically distributed via npm [6][2][3][7][8][9][10][5]. Commonly used community packages include: - Jira-focused servers: Packages like @zierocode/mcp-atlassian-cloud (which emphasizes extensive tool coverage and native Atlassian format support) [5], mcp-jira-data-center [2], and various others like @dmikushin/mcp-server-atlassian-jira [7] and @nexus2520/jira-mcp-server [9]. - Confluence-focused servers: Packages such as atlassian-confluence-mcp-server [3] and @aashari/mcp-server-atlassian-confluence [8]. - Integrated/Wrapper servers: Some packages, such as @crypto512/jicon-mcp [4] and mcp-jira-confluence [10], provide integrated support for both Jira and Confluence within a single server instance. Usage Most community-developed MCP servers for Atlassian products are designed to be run via npx, allowing for zero-install integration with MCP-compatible clients like Claude Desktop, Cursor, and others [6][3][4][7][8][5]. Configuration typically requires providing your specific Atlassian instance URL and an API token generated from your Atlassian account settings [4][9][10]. Users are advised to review the specific GitHub repository or npm page for each package to verify whether it supports the deployment type (Cloud vs. Data Center/Server) relevant to their environment [2][3][4].
Citations:
- 1: https://www.npmjs.com/package/@atlaskit/ads-mcp
- 2: https://www.npmjs.com/package/mcp-jira-data-center
- 3: https://www.npmjs.com/package/atlassian-confluence-mcp-server
- 4: https://www.npmjs.com/package/@crypto512/jicon-mcp?activeTab=readme
- 5: https://www.npmjs.com/package/@zierocode/mcp-atlassian-cloud
- 6: https://www.npmjs.com/package/@stubbedev/atlassian-mcp
- 7: https://www.npmjs.com/package/@dmikushin/mcp-server-atlassian-jira
- 8: https://www.npmjs.com/package/@aashari/mcp-server-atlassian-confluence
- 9: https://www.npmjs.com/package/@nexus2520/jira-mcp-server
- 10: https://www.npmjs.com/package/mcp-jira-confluence
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '.cursor/mcp.json.example'
sed -n '1,40p' .cursor/mcp.json.example
printf '\n%s\n' '.mcp.json.example'
sed -n '1,40p' .mcp.json.example
printf '\n%s\n' 'CLAUDE.md'
sed -n '60,90p' CLAUDE.md
printf '\n%s\n' 'docs/cves/cve-developer-guide.md'
sed -n '35,55p' docs/cves/cve-developer-guide.mdRepository: red-hat-data-services/notebooks
Length of output: 2374
Replace the non-existent MCP package. .cursor/mcp.json.example and .mcp.json.example point npx at @anthropic/mcp-atlassian, which isn't published; switch this example to the intended Atlassian MCP setup instead.
📍 Affects 2 files
.cursor/mcp.json.example#L4-L5(this comment).mcp.json.example#L4-L5
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.cursor/mcp.json.example around lines 4 - 5, Replace the non-existent
`@anthropic/mcp-atlassian` package in the npx command for both
.cursor/mcp.json.example lines 4-5 and .mcp.json.example lines 4-5 with the
intended published Atlassian MCP package, preserving the existing example
command structure.
| "JIRA_EMAIL": "${env:JIRA_EMAIL}", | ||
| "JIRA_API_TOKEN": "${env:JIRA_API_TOKEN}", |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== .mcp.json.example ==\n'
nl -ba .mcp.json.example | sed -n '1,80p'
printf '\n== repo mentions of env substitution / mcp ==\n'
rg -n '\$\{env:|mcp\.json|Claude Code|Cursor' -S . || trueRepository: red-hat-data-services/notebooks
Length of output: 234
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== .mcp.json.example ==\n'
sed -n '1,120p' .mcp.json.example | cat -n
printf '\n== repo search for mcp/env/docs ==\n'
rg -n '\$\{env:|mcp\.json|Claude Code|Cursor|environment variable|env substitution' -S . --glob '!**/.git/**' || trueRepository: red-hat-data-services/notebooks
Length of output: 8547
🌐 Web query:
Claude Code .mcp.json ${env:VAR} environment variable substitution MCP config
💡 Result:
Claude Code supports environment variable expansion in.mcp.json configuration files using specific syntax [1][2]. Note that this functionality is specific to Claude Code and differs from the syntax sometimes used in other tools (e.g., VS Code) [3][4]. Supported Syntax - ${VAR}: Expands to the value of the environment variable VAR [1][2]. - ${VAR:-default}: Expands to the value of VAR if set, otherwise uses the provided default value [1][2]. Supported Fields Environment variable expansion is supported in the following fields within.mcp.json: - command: The server executable path [1][2]. - args: Command-line arguments [1][2]. - env: Environment variables passed to the server [1][2]. - url: For HTTP server types [1][2]. - headers: For HTTP server authentication [1][2]. Important Considerations - Variable Resolution: Claude Code reads these variables from the environment in which the Claude Code process is running [1][2]. Note that internal settings blocks (like an env block in a local settings file) are not always automatically treated as sources for this substitution [5]. - Missing Variables: If a referenced variable is not set and no default value is provided, Claude Code will load the configuration but may report a warning, using the unexpanded literal string (e.g., "${VAR}") as the value [1][2]. - Troubleshooting: Users have reported inconsistencies in some contexts (such as header substitution in HTTP transports or when using specific launch paths), where the literal string might be passed if expansion fails [5][6]. Always ensure your environment variables are exported in the shell launching Claude Code or verify your specific configuration version behavior if you encounter authentication errors [5][7].
Citations:
- 1: https://code.claude.com/docs/en/mcp
- 2: https://code.claude.com/docs/en/mcp-servers
- 3: Support ${env:VARIABLE_NAME} in mcp.json microsoft/vscode#245237
- 4: .mcp.json from plugins doesn't work with environment variables templates microsoft/vscode#305310
- 5: Stdio MCP server silently dropped when
${VAR}substitution fails — docs promise "fail to parse" but REPL silently reports "No MCP servers configured";--mcp-configspawns with unsubstituted value causing downstream auth failure anthropics/claude-code#60513 - 6: [BUG] ${VAR} substitution not applied to .mcp.json headers values (HTTP transport) anthropics/claude-code#51581
- 7: https://code.claude.com/docs/en/mcp-quickstart
🌐 Web query:
Anthropic Claude Code MCP config env substitution ${env:VAR} docs
💡 Result:
Claude Code supports environment variable substitution within MCP configuration files (such as.mcp.json or ~/.claude.json) to allow for flexible, machine-specific, or secure configurations [1][2]. Supported Syntax - ${VAR}: Expands to the value of the environment variable VAR [1][2]. - ${VAR:-default}: Expands to the value of VAR if it is set; otherwise, it uses the provided default value [1][2]. Expansion Locations Substitution is supported in the following configuration fields: - command: The server executable path [1][2]. - args: Command-line arguments [1][2]. - env: Environment variables passed to the MCP server [1][2]. - url: For HTTP-based server types [1][2]. - headers: For HTTP server authentication headers [1][2]. Important Considerations - Variable Scope: These variables are expanded from the environment of the process launching the server, not necessarily from Claude Code's own internal environment settings [1][2]. - Default Values: Using the ${VAR:-default} syntax is recommended for paths or values that may vary across machines, such as ${CLAUDE_PROJECT_DIR:-.} [1][2]. - Handling Missing Variables: If a referenced environment variable is not set and no default is provided, Claude Code may report a missing-variable warning (e.g., in claude mcp list) and will use the unexpanded literal text ${VAR} as the value [1][2]. - Known Limitations: Note that variables defined in Claude Code's own settings.json env block are not automatically available for substitution within.mcp.json files [3]. Configurations should rely on variables present in the shell environment from which Claude Code is launched [3].
Citations:
- 1: https://code.claude.com/docs/en/mcp
- 2: https://code.claude.com/docs/en/mcp.md
- 3: Stdio MCP server silently dropped when
${VAR}substitution fails — docs promise "fail to parse" but REPL silently reports "No MCP servers configured";--mcp-configspawns with unsubstituted value causing downstream auth failure anthropics/claude-code#60513
🌐 Web query:
Claude Code MCP config ${env:VAR} environment variable substitution docs
💡 Result:
Claude Code supports environment variable expansion within MCP configuration files, specifically in .mcp.json files and server entries within ~/.claude.json [1][2][3]. This feature allows for dynamic configuration of paths, API keys, and other machine-specific or sensitive values [1][3]. Supported Syntax Claude Code supports the following expansion patterns [1][3]: - ${VAR}: Expands to the value of the environment variable VAR [1][3]. - ${VAR:-default}: Expands to the value of VAR if it is set; otherwise, it uses the provided default value [1][3]. Expansion Locations Environment variable expansion is supported in the following fields within MCP server configurations [1][3]: - command: The server executable path [1][3]. - args: Command-line arguments passed to the server [1][3]. - env: Environment variables passed to the server [1][3]. - url: For HTTP-based MCP servers [1][3]. - headers: For HTTP server authentication [1][3]. Important Considerations and Limitations - Availability: These variables are referenced from the server's environment (your shell environment), not Claude Code's internal configuration environment [1][2]. - Missing Variables: If a referenced environment variable is not set and no default value (via:-default) is provided, Claude Code may fail to parse the configuration or, in some contexts, use the literal unexpanded string [1][4]. It is recommended to use a default value (e.g., ${CLAUDE_PROJECT_DIR:-.}) for portability [1][2]. - Settings Files: Be aware that environment variables defined in Claude Code's env settings (e.g., in .claude/settings.local.json) are generally not automatically available as sources for ${VAR} substitution within .mcp.json files; the substitution typically draws from the shell environment in which the Claude Code process was launched [4]. - Debugging: You can verify your configuration by running claude mcp list, which reports warnings for missing variables [1][3]. If an MCP server fails to start, ensure the required variables are exported in your terminal session before launching Claude Code [5][6].
Citations:
- 1: https://code.claude.com/docs/en/mcp.md
- 2: https://code.claude.com/docs/en/mcp
- 3: https://code.claude.com/docs/en/mcp-servers
- 4: Stdio MCP server silently dropped when
${VAR}substitution fails — docs promise "fail to parse" but REPL silently reports "No MCP servers configured";--mcp-configspawns with unsubstituted value causing downstream auth failure anthropics/claude-code#60513 - 5: https://code.claude.com/docs/en/agent-sdk/mcp
- 6: https://code.claude.com/docs/en/mcp-quickstart
🌐 Web query:
Anthropic Claude Code .mcp.json ${env:VAR} env substitution
💡 Result:
In the context of Anthropic Claude Code, the supported syntax for environment variable substitution in.mcp.json files is ${VAR} and ${VAR:-default} [1][2][3]. The ${env:VAR} syntax (commonly associated with VS Code configuration files) is not the standard or documented syntax for Claude Code's.mcp.json configuration [1][3]. Key details regarding Claude Code environment variable substitution: - Supported Syntax: Use ${VAR} for direct substitution and ${VAR:-default} to provide a fallback value if the environment variable is not set [1][3]. - Expansion Locations: Claude Code supports this expansion in the command, args, env, url (for HTTP), and headers fields within your.mcp.json [1][3]. - Behavior with Missing Variables: If a referenced environment variable is missing and no default is provided, Claude Code may report a warning and proceed using the literal string ${VAR} [1][3]. In some launch scenarios, this can result in the server spawning with an unexpanded or empty value [4]. - Note on Sources: Ensure the environment variable is set in the shell or environment that launches Claude Code [4]. It is important to note that variables defined in settings.local.json's env block are not automatically available for ${VAR} substitution within.mcp.json [4]. If you are using Claude Code, stick to the ${VAR} format [1][3]. If you are encountering issues where variables are not being expanded, verify that they are exported in your current shell environment, as Claude Code relies on the host process's environment variables for this substitution [4].
Citations:
- 1: https://code.claude.com/docs/en/mcp
- 2: https://code.claude.com/docs/en/mcp.md
- 3: https://code.claude.com/docs/en/mcp-servers
- 4: Stdio MCP server silently dropped when
${VAR}substitution fails — docs promise "fail to parse" but REPL silently reports "No MCP servers configured";--mcp-configspawns with unsubstituted value causing downstream auth failure anthropics/claude-code#60513
Use Claude Code’s ${VAR} syntax here
${env:VAR} is a Cursor-style placeholder and won’t expand in .mcp.json; these should be ${JIRA_EMAIL} and ${JIRA_API_TOKEN}.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.mcp.json.example around lines 7 - 8, Update the JIRA_EMAIL and
JIRA_API_TOKEN placeholders in the MCP configuration to use Claude Code’s ${VAR}
syntax instead of the Cursor-specific ${env:VAR} format.
|
Closing in favor of creating a separate agent skills marketplace repository. Skills will be available via |
1 participant
Summary
Backport from main: Add Claude Code CLI and Cursor IDE integration for automated CVE resolution.
Files Added
.claude/commands/fix-cve.md- Main CVE workflow command.claude/skills/cve-resolution/SKILL.md- CVE resolution skilldocs/cves/cve-developer-guide.md- Full workflow documentationdocs/claude-mcp.md- MCP setup guideJira
https://redhat.atlassian.net/browse/RHAIENG-5845
Made with Cursor
Summary by CodeRabbit
New Features
Documentation
Chores