@stubbedev/atlassian-mcp 0.1.17 → 0.1.19

package/README.md

@@ -54,7 +54,7 @@ A [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server for **s
 | `bitbucket_decline_pr` | Decline a pull request |
 | `bitbucket_get_pr_comments` | Get PR comment threads in bulk, including task-style BLOCKER comments and blocker counts |
 | `bitbucket_add_pr_comment` | Add a PR comment; when remarking on an existing comment, pass `commentId` so it is posted as a thread reply |
-| `bitbucket_update_pr_comment` | Update comment text/severity, resolve or reopen normal threads via `threadResolved`, and resolve/reopen BLOCKER tasks via `state` (strictly enforced) |
+| `bitbucket_update_pr_comment` | Update comment text/severity (own comments only), resolve or reopen normal threads via `threadResolved`, and resolve/reopen BLOCKER tasks via `state` |
 | `bitbucket_delete_pr_comment` | Delete a PR comment by comment ID |
 | `bitbucket_get_pr_commits` | List commits included in a pull request |
 | `bitbucket_get_branches` | List branches in a repository |

package/dist/bitbucket.js

@@ -181,6 +181,7 @@ function validateCommentText(textValue) {
 export class BitbucketClient {
     baseUrl;
     headers;
+    currentUserCache;
     constructor(baseUrl, token) {
         this.baseUrl = baseUrl.replace(/\/$/, '');
         this.headers = {
@@ -237,6 +238,38 @@ export class BitbucketClient {
         }
         return res.text();
     }
+    normalizeIdentity(value) {
+        return (value ?? '').trim().toLowerCase();
+    }
+    async getCurrentUser() {
+        if (this.currentUserCache)
+            return this.currentUserCache;
+        const me = await this.request('GET', '/users/~self');
+        if (!me) {
+            throw new Error('Could not determine current Bitbucket user identity.');
+        }
+        this.currentUserCache = me;
+        return me;
+    }
+    async assertOwnComment(comment) {
+        const me = await this.getCurrentUser();
+        const commentAuthorName = this.normalizeIdentity(comment.author?.name);
+        const commentAuthorDisplayName = this.normalizeIdentity(comment.author?.displayName);
+        const meName = this.normalizeIdentity(me.name);
+        const meSlug = this.normalizeIdentity(me.slug);
+        const meDisplayName = this.normalizeIdentity(me.displayName);
+        const hasStrongCommentIdentity = commentAuthorName.length > 0;
+        const hasStrongUserIdentity = meName.length > 0 || meSlug.length > 0;
+        const matchesByName = commentAuthorName.length > 0 && (commentAuthorName === meName || commentAuthorName === meSlug);
+        const matchesByDisplayNameFallback = !hasStrongCommentIdentity
+            && !hasStrongUserIdentity
+            && commentAuthorDisplayName.length > 0
+            && commentAuthorDisplayName === meDisplayName;
+        if (matchesByName || matchesByDisplayNameFallback) {
+            return;
+        }
+        throw new Error(`You can only edit your own Bitbucket comments. Comment #${comment.id} is authored by ${comment.author?.displayName ?? comment.author?.name ?? 'another user'}.`);
+    }
     // Used internally by context tools — finds the open PR for a given source branch
     async findOpenPrForBranch(projectKey, repoSlug, branch) {
         const targetBranch = branchDisplayId(branch);
@@ -758,7 +791,15 @@ export class BitbucketClient {
         const current = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/comments/${args.commentId}`);
         if (!current)
             throw new Error(`Comment #${args.commentId} not found.`);
-        const targetSeverity = args.severity ?? current.severity ?? 'NORMAL';
+        const currentSeverity = current.severity ?? 'NORMAL';
+        const severityIsChanging = args.severity !== undefined && args.severity !== currentSeverity;
+        const isResolutionOnlyUpdate = (args.state !== undefined || args.threadResolved !== undefined)
+            && args.text === undefined
+            && !severityIsChanging;
+        if (!isResolutionOnlyUpdate) {
+            await this.assertOwnComment(current);
+        }
+        const targetSeverity = args.severity ?? currentSeverity;
         if (args.state && targetSeverity !== 'BLOCKER') {
             throw new Error('state is only supported for BLOCKER comments (tasks). Use threadResolved for normal comment threads.');
         }
@@ -807,7 +848,11 @@ export class BitbucketClient {
         const current = await this.request('GET', `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/comments/${args.commentId}`);
         if (!current)
             throw new Error(`Comment #${args.commentId} not found.`);
-        const path = `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/comments/${args.commentId}?version=${current.version}`;
+        await this.assertOwnComment(current);
+        const commentPath = current.severity === 'BLOCKER'
+            ? `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/blocker-comments/${args.commentId}`
+            : `/projects/${projectKey}/repos/${repoSlug}/pull-requests/${args.prId}/comments/${args.commentId}`;
+        const path = `${commentPath}?version=${current.version}`;
         await this.request('DELETE', path);
         return text(`Comment #${args.commentId} deleted from PR #${args.prId}.`);
     }

package/dist/index.js

@@ -260,7 +260,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         },
         {
             name: 'jira_get_comments',
-            description: 'Use when you want the discussion thread on a Jira ticket, with pagination for long threads.',
+            description: 'Use when you want the discussion thread on a Jira ticket, with pagination for long threads. Includes comment IDs for follow-up edits.',
             inputSchema: {
                 type: 'object',
                 properties: {
@@ -283,6 +283,31 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
                 required: ['issueKey', 'body'],
             },
         },
+        {
+            name: 'jira_edit_comment',
+            description: `Use when you want to edit one of your own comments on a Jira ticket. Editing comments from other users is rejected. Never include emojis. ${JIRA_WIKI_MARKUP_HINT}`,
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    issueKey: { type: 'string', description: 'Jira issue key' },
+                    commentId: { type: 'string', description: 'Jira comment ID (from jira_get_comments or jira_issue_overview output)' },
+                    body: { type: 'string', description: `Updated concise comment text. No filler. Do not include emojis. ${JIRA_WIKI_MARKUP_HINT}` },
+                },
+                required: ['issueKey', 'commentId', 'body'],
+            },
+        },
+        {
+            name: 'jira_delete_comment',
+            description: 'Use when you want to delete one of your own comments on a Jira ticket by comment ID. Deleting comments from other users is rejected.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    issueKey: { type: 'string', description: 'Jira issue key' },
+                    commentId: { type: 'string', description: 'Jira comment ID to delete (from jira_get_comments or jira_issue_overview output)' },
+                },
+                required: ['issueKey', 'commentId'],
+            },
+        },
         {
             name: 'jira_transition_issue',
             description: 'Use when you want to move a Jira ticket to another status. Provide a transition name (for example "In Progress") or a transition ID.',
@@ -605,7 +630,7 @@ Keep comments concise, plain text, and free of filler. Never include emojis. You
         },
         {
             name: 'bitbucket_update_pr_comment',
-            description: 'Use when you want to edit PR comments, resolve/reopen normal discussion threads, or manage task-style BLOCKER comments. Hint: for normal comments, resolve/reopen means threadResolved; for BLOCKER tasks, resolve/reopen uses state. Keep comments concise, plain text, and free of filler. Never include emojis. You can pass projectKey/repoSlug or project/repo.',
+            description: 'Use when you want to edit your own PR comments, resolve/reopen normal discussion threads, or manage task-style BLOCKER comments. Text/severity edits are limited to your own comments, but thread/task resolution via threadResolved/state is allowed for comments from other users. Hint: for normal comments, resolve/reopen means threadResolved; for BLOCKER tasks, resolve/reopen uses state. Keep comments concise, plain text, and free of filler. Never include emojis. You can pass projectKey/repoSlug or project/repo.',
             inputSchema: {
                 type: 'object',
                 properties: {
@@ -625,7 +650,7 @@ Keep comments concise, plain text, and free of filler. Never include emojis. You
         },
         {
             name: 'bitbucket_delete_pr_comment',
-            description: 'Use when you want to delete a PR comment by comment ID. You can pass projectKey/repoSlug or project/repo.',
+            description: 'Use when you want to delete one of your own PR comments by comment ID. Deleting comments from other users is rejected. You can pass projectKey/repoSlug or project/repo.',
             inputSchema: {
                 type: 'object',
                 properties: {
@@ -747,6 +772,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 return await jira.getComments(args);
             case 'jira_add_comment':
                 return await jira.addComment(args);
+            case 'jira_edit_comment':
+                return await jira.editComment(args);
+            case 'jira_delete_comment':
+                return await jira.deleteComment(args);
             case 'jira_transition_issue':
                 return await jira.transitionIssue(args);
             // Bitbucket

package/dist/jira.js

@@ -90,6 +90,7 @@ function validateCommentBody(body) {
 export class JiraClient {
     baseUrl;
     headers;
+    currentUserCache;
     constructor(baseUrl, token) {
         this.baseUrl = baseUrl.replace(/\/$/, '');
         this.headers = {
@@ -129,6 +130,40 @@ export class JiraClient {
     async requestAgile(method, path, body) {
         return this.requestWithBase('/rest/agile/1.0', method, path, body);
     }
+    normalizeIdentity(value) {
+        return (value ?? '').trim().toLowerCase();
+    }
+    async getCurrentUser() {
+        if (this.currentUserCache)
+            return this.currentUserCache;
+        const me = await this.request('GET', '/myself');
+        if (!me) {
+            throw new Error('Could not determine current Jira user identity.');
+        }
+        this.currentUserCache = me;
+        return me;
+    }
+    async assertOwnComment(comment) {
+        const me = await this.getCurrentUser();
+        const commentAuthorName = this.normalizeIdentity(comment.author.name);
+        const commentAuthorKey = this.normalizeIdentity(comment.author.key);
+        const commentAuthorDisplayName = this.normalizeIdentity(comment.author.displayName);
+        const meName = this.normalizeIdentity(me.name);
+        const meKey = this.normalizeIdentity(me.key);
+        const meDisplayName = this.normalizeIdentity(me.displayName);
+        const hasStrongCommentIdentity = commentAuthorName.length > 0 || commentAuthorKey.length > 0;
+        const hasStrongUserIdentity = meName.length > 0 || meKey.length > 0;
+        const matchesByNameOrKey = (commentAuthorName.length > 0 && (commentAuthorName === meName || commentAuthorName === meKey))
+            || (commentAuthorKey.length > 0 && (commentAuthorKey === meName || commentAuthorKey === meKey));
+        const matchesByDisplayNameFallback = !hasStrongCommentIdentity
+            && !hasStrongUserIdentity
+            && commentAuthorDisplayName.length > 0
+            && commentAuthorDisplayName === meDisplayName;
+        if (matchesByNameOrKey || matchesByDisplayNameFallback) {
+            return;
+        }
+        throw new Error(`You can only edit your own Jira comments. Comment ${comment.id} is authored by ${comment.author.displayName}.`);
+    }
     async addIssuesToSprintInternal(sprintId, issueKeys) {
         await this.requestAgile('POST', `/sprint/${sprintId}/issue`, { issues: issueKeys });
     }
@@ -365,7 +400,7 @@ export class JiraClient {
             else {
                 for (const c of items) {
                     const date = c.created.slice(0, 10);
-                    lines.push(`--- ${c.author.displayName} (${date}) ---`, c.body, '');
+                    lines.push(`--- #${c.id} ${c.author.displayName} (${date}) ---`, c.body, '');
                 }
             }
         }
@@ -536,7 +571,7 @@ export class JiraClient {
             return text('No comments found.');
         const blocks = data.comments.map((c) => {
             const date = c.created.slice(0, 10);
-            return `--- ${c.author.displayName} (${date}) ---\n${c.body}`;
+            return `--- #${c.id} ${c.author.displayName} (${date}) ---\n${c.body}`;
         });
         const page = pagination(data.total, startAt, data.comments.length);
         return text(`${data.total} comment(s) on ${issueKey}${page}:\n\n${blocks.join('\n\n')}`);
@@ -545,6 +580,32 @@ export class JiraClient {
         await this.request('POST', `/issue/${args.issueKey}/comment`, { body: validateCommentBody(args.body) });
         return text(`Comment added to ${args.issueKey}.`);
     }
+    async editComment(args) {
+        const commentId = String(args.commentId).trim();
+        if (!commentId) {
+            throw new Error('commentId is required.');
+        }
+        const path = `/issue/${args.issueKey}/comment/${commentId}`;
+        const current = await this.request('GET', path);
+        if (!current)
+            throw new Error(`Comment ${commentId} not found on ${args.issueKey}.`);
+        await this.assertOwnComment(current);
+        await this.request('PUT', path, { body: validateCommentBody(args.body) });
+        return text(`Comment ${commentId} updated on ${args.issueKey}.`);
+    }
+    async deleteComment(args) {
+        const commentId = String(args.commentId).trim();
+        if (!commentId) {
+            throw new Error('commentId is required.');
+        }
+        const path = `/issue/${args.issueKey}/comment/${commentId}`;
+        const current = await this.request('GET', path);
+        if (!current)
+            throw new Error(`Comment ${commentId} not found on ${args.issueKey}.`);
+        await this.assertOwnComment(current);
+        await this.request('DELETE', path);
+        return text(`Comment ${commentId} deleted from ${args.issueKey}.`);
+    }
     async transitionIssue(args) {
         const transitionId = await this.resolveTransitionId(args.issueKey, args.transitionId, args.transitionName);
         await this.transitionIssueInternal(args.issueKey, transitionId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stubbedev/atlassian-mcp",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "MCP server for self-hosted Jira and Bitbucket",
   "license": "MIT",
   "type": "module",