@stubbedev/atlassian-mcp 0.5.20 → 0.5.23

package/README.md

@@ -249,9 +249,6 @@ has no workspace, so it advertises no MCP roots and there is no useful cwd to fa
 Comma-separate several worktrees (first git repo wins); a per-call `repoPath` still
 overrides it.
 
-On Windows, Git is frequently absent from a GUI app's `PATH`. The server probes the usual
-install locations before giving up; set `ATLASSIAN_MCP_GIT_PATH` if yours lives elsewhere.
-
 Server stderr is logged to `~/Library/Logs/Claude/mcp-server-atlassian.log` (macOS) or
 `%APPDATA%\Claude\logs\mcp-server-atlassian.log` (Windows) — read that first when a
 connection fails.
@@ -453,18 +450,15 @@ attached to every [release](https://github.com/stubbedev/atlassian-mcp/releases/
 
 ```bash
 # Go toolchain — installs to $GOBIN / $GOPATH/bin
-go install github.com/stubbedev/atlassian-mcp@latest
+go install -tags nodynamic github.com/stubbedev/atlassian-mcp@latest
 
 # Nix flake
 nix run github:stubbedev/atlassian-mcp -- --config ~/.atlassian-mcp.json
 ```
 
 Then point your MCP client's `command` at the resulting `atlassian-mcp` binary
-instead of `npx`. On these Node-free paths (`go install`, Nix, a release binary or the
-`.mcpb` bundle) `ffmpeg`/`ffprobe` must be available on `PATH` for video and
-animated-image attachments (or set `ATLASSIAN_MCP_FFMPEG_PATH` /
-`ATLASSIAN_MCP_FFPROBE_PATH`); the npm wrapper bundles them automatically. Everything
-else — still images, PDF text, JSON/text — is pure Go and needs nothing extra.
+instead of `npx`. Every install path is the same single static binary: it needs no `git`,
+`ffmpeg` or other program on the machine.
 
 ### Running as an HTTP server (shared / behind a proxy)
 
@@ -615,28 +609,31 @@ The `get_attachment` tool decodes binary attachments into model-readable content
 
 | Input | What gets returned | How |
 | --- | --- | --- |
-| Static images (PNG/JPEG/WebP/BMP/TIFF/GIF/SVG…) | Resized image content blocks | native Go (`imaging`, long edge ≤ `maxDimension`, default 1568; EXIF auto-orient; PNG for alpha, else JPEG) |
-| Animated images (GIF/APNG/animated WebP) | N sampled frames as image content blocks | `ffmpeg` + native Go re-encode (default 6 frames @ 768 px) |
-| Video (mp4/webm/mov/…) | N sampled frames as image content blocks | `ffmpeg`/`ffprobe`. Uniform or scene-change sampling. Re-call with `start`, `end`, `frames`, `mode`, `sceneThreshold` to zoom in |
+| Static images (PNG/JPEG/WebP/BMP/TIFF/GIF/SVG/AVIF/HEIC/JPEG XL…) | Resized image content blocks | `imaging`, long edge ≤ `maxDimension`, default 1568; EXIF auto-orient; PNG for alpha, else JPEG. AVIF/HEIC/JPEG XL via [`gen2brain`](https://github.com/gen2brain) decoders (libavif/libheif/libjxl compiled to WebAssembly) |
+| Animated images (GIF/APNG/animated WebP) | N sampled frames as image content blocks | composited in Go, as a browser shows them (default 6 frames @ 768 px) |
+| Video (MP4/MOV, MKV/WebM, AVI) | N sampled frames as image content blocks | H.264 via [`goh264`](https://github.com/thesyncim/goh264) (GOPs decoded in parallel), Motion JPEG, and VP8 keyframes only (`x/image/vp8` has no inter frames); MP4 demuxed by [`mp4ff`](https://github.com/Eyevinn/mp4ff), Matroska and AVI in-tree. Uniform or scene-change sampling (ffmpeg's scene metric), near-duplicate frames dropped. Re-call with `start`, `end`, `frames`, `mode`, `sceneThreshold` to zoom in. HEVC, VP9, AV1 and MPEG-4 Part 2 are reported as unsupported; pass `saveTo` to keep the original |
 | Audio (mp3/wav/ogg/…) | MCP audio content block | passthrough |
-| PDFs | Extracted text — or rasterized pages if text is empty (scanned PDFs) | native Go text extraction (`ledongthuc/pdf`); rasterization shells to `pdftoppm`/`mutool` if present, else the original is saved to disk |
+| PDFs | Extracted text — or rasterized pages if text is empty (scanned PDFs) | text via `ledongthuc/pdf`; pages rendered by PDFium compiled to WebAssembly ([`go-pdfium`](https://github.com/klippa-app/go-pdfium)) |
 | Text-like (json/xml/yaml/…) | Text content block | passthrough |
 | Everything else (or oversized) | Auto-saved to a temp file; path is returned | `os.TempDir()` with `atlmcp-` prefix |
 
 Auto-saved files are periodically pruned by TTL and total-size quota — see *Environment overrides* below.
 
-### External tools (optional)
+### No external tools
+
+The binary is self-contained and built without cgo (release builds use `-tags nodynamic`, so the image decoders never look for system libraries). Git access goes through
+[`go-git`](https://github.com/go-git/go-git) (status, log, diff, branch, checkout, fetch, push);
+the C libraries some formats need (PDFium, libavif, libheif, libjxl) run as embedded
+WebAssembly under [`wazero`](https://wazero.io).
 
-Image and PDF-text decoding are pure Go and need nothing extra. The two pipelines that have no
-pure-Go implementation shell out to external binaries:
+Git credentials for fetch/push come from where git keeps them, minus anything that needs another
+program: ssh-agent, `IdentityFile` entries in `~/.ssh/config` and unencrypted `~/.ssh/id_*`
+keys (host keys checked against `~/.ssh/known_hosts`); for https, credentials in the URL,
+`~/.git-credentials`, `~/.netrc`, and the Bitbucket token itself for the configured Bitbucket
+host. Credential helpers, passphrase prompts, git hooks and Git LFS smudging do not run.
 
-- **`ffmpeg` + `ffprobe`** — video and animated-image frame sampling. The npm wrapper bundles
-  [`ffmpeg-static`](https://www.npmjs.com/package/ffmpeg-static) /
-  [`ffprobe-static`](https://www.npmjs.com/package/ffprobe-static) and injects their paths, so the
-  npx install path is zero-config. On every Node-free path (`go install`, Nix, release binary,
-  `.mcpb` bundle), install `ffmpeg` (it provides `ffprobe`) or set the env vars below.
-- **`pdftoppm` (poppler) or `mutool` (MuPDF)** — only needed to rasterize *scanned* PDFs that have no
-  extractable text. If neither is on `PATH`, such PDFs are saved to disk instead.
+`goh264` is LGPL-2.1; it is linked unmodified and the full source of this server is public, so
+the binary can be rebuilt against a modified copy.
 
 ### Environment overrides
 
@@ -645,10 +642,7 @@ pure-Go implementation shell out to external binaries:
 | `ATLASSIAN_MCP_HTTP` | Run as a Streamable HTTP server instead of stdio. `1`/`true` → `127.0.0.1:7337`; or set an explicit `host:port`. Same as `--http`. | unset (stdio) |
 | `ATLASSIAN_MCP_HTTP_TOKEN` | Bearer token for HTTP mode. Optional on loopback binds; **required** on non-loopback binds. | unset |
 | `ATLASSIAN_MCP_REPO_ROOT` | Default workspace root(s) for the git/PR tools, comma-separated. `file://` URIs, absolute paths, `~/…` and Windows drive paths all work. Needed by clients that expose no MCP roots (desktop apps). Overridden by a `repoPath` argument or a root header. | unset |
-| `ATLASSIAN_MCP_GIT_PATH` | Path to the `git` executable. Only needed when `git` is off the host app's `PATH`; the server already probes the usual install locations. | `git` on `PATH` |
 | `ATLASSIAN_MCP_MARK_AI_TEXT` | Set `false` to stop appending the bold `[AI]` attribution line to Jira/Bitbucket text this server posts. | `true` |
-| `ATLASSIAN_MCP_FFMPEG_PATH` | Path to `ffmpeg` binary. | npm: bundled `ffmpeg-static`; otherwise `ffmpeg` on `PATH` |
-| `ATLASSIAN_MCP_FFPROBE_PATH` | Path to `ffprobe` binary. | npm: bundled `ffprobe-static`; otherwise `ffprobe` on `PATH` |
 | `ATLASSIAN_MCP_TMP_TTL_DAYS` | Auto-saved attachments older than this are pruned. | `7` |
 | `ATLASSIAN_MCP_TMP_MAX_BYTES` | Total-size quota for auto-saved attachments in `os.tmpdir()`. When exceeded, oldest are evicted. | `1073741824` (1 GB) |
 

package/bin/cli.mjs

@@ -2,11 +2,6 @@
 // npm/npx launcher. Ensures the prebuilt Go binary for this platform is present
 // (npx @latest guarantees the newest version), then hands stdio to it directly.
 //
-// It also injects the bundled ffmpeg-static / ffprobe-static binaries via env so
-// video and animated-image attachments work with zero extra setup on the npm
-// install path. Users who install the Go binary directly (go install / Nix)
-// supply ffmpeg/ffprobe on PATH, or set ATLASSIAN_MCP_FFMPEG_PATH / _FFPROBE_PATH.
-//
 // Note on overhead: with stdio 'inherit' the Go binary reads/writes the real
 // stdin/stdout, so this launcher adds ZERO per-message latency — it only relays
 // signals and the exit code.
@@ -21,26 +16,7 @@ try {
   process.exit(1);
 }
 
-// Resolve bundled ffmpeg/ffprobe and expose them to the Go binary unless the
-// user already pinned a path. Best-effort: missing modules are non-fatal.
-const env = { ...process.env };
-async function resolveBundled(envKey, importer) {
-  if (env[envKey]) return;
-  try {
-    const p = await importer();
-    if (p) env[envKey] = p;
-  } catch { /* dependency absent — fall back to PATH lookup in the binary */ }
-}
-await resolveBundled('ATLASSIAN_MCP_FFMPEG_PATH', async () => {
-  const m = await import('ffmpeg-static');
-  return m.default ?? m;
-});
-await resolveBundled('ATLASSIAN_MCP_FFPROBE_PATH', async () => {
-  const m = await import('ffprobe-static');
-  return (m.default ?? m)?.path;
-});
-
-const child = spawn(bin, process.argv.slice(2), { stdio: 'inherit', env });
+const child = spawn(bin, process.argv.slice(2), { stdio: 'inherit' });
 
 // Forward termination signals so the Go binary shuts down cleanly with its host.
 for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT']) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stubbedev/atlassian-mcp",
-  "version": "0.5.20",
+  "version": "0.5.23",
   "description": "MCP server for self-hosted Jira and Bitbucket (Go, distributed as a prebuilt binary)",
   "license": "MIT",
   "type": "module",
@@ -16,18 +16,14 @@
   ],
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
-    "build": "go build -o atlassian-mcp .",
+    "build": "go build -tags nodynamic -o atlassian-mcp .",
     "test": "go test ./...",
-    "smoke": "go build -o atlassian-mcp . && { printf '%s\\n' '{\"jsonrpc\":\"2.0\",\"id\":0,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"npm-smoke\",\"version\":\"0\"}}}' '{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}' '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":{}}'; sleep 3; } | ATLASSIAN_MCP_CONFIG=/nonexistent JIRA_URL=https://github.com JIRA_ACCESS_TOKEN=smoke BITBUCKET_URL=https://github.com BITBUCKET_ACCESS_TOKEN=smoke ./atlassian-mcp | node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const rs=d.trim().split('\\n').filter(Boolean).map(l=>JSON.parse(l));const err=rs.find(r=>r.error);if(err)throw new Error('server error: '+err.error.message);const t=rs.find(r=>r.id===1)?.result?.tools;if(!Array.isArray(t)||!t.length)throw new Error('no tools in response');const bad=t.filter(x=>!x.name||!x.inputSchema);if(bad.length)throw new Error('malformed tools: '+bad.map(x=>x.name??'(unnamed)').join(', '));console.log('smoke OK — '+t.length+' tool(s): '+t.map(x=>x.name).join(', '))}catch(e){console.error('smoke FAIL:',e.message);process.exit(1)}})\"",
+    "smoke": "go build -tags nodynamic -o atlassian-mcp . && { printf '%s\\n' '{\"jsonrpc\":\"2.0\",\"id\":0,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"npm-smoke\",\"version\":\"0\"}}}' '{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}' '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":{}}'; sleep 3; } | ATLASSIAN_MCP_CONFIG=/nonexistent JIRA_URL=https://github.com JIRA_ACCESS_TOKEN=smoke BITBUCKET_URL=https://github.com BITBUCKET_ACCESS_TOKEN=smoke ./atlassian-mcp | node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const rs=d.trim().split('\\n').filter(Boolean).map(l=>JSON.parse(l));const err=rs.find(r=>r.error);if(err)throw new Error('server error: '+err.error.message);const t=rs.find(r=>r.id===1)?.result?.tools;if(!Array.isArray(t)||!t.length)throw new Error('no tools in response');const bad=t.filter(x=>!x.name||!x.inputSchema);if(bad.length)throw new Error('malformed tools: '+bad.map(x=>x.name??'(unnamed)').join(', '));console.log('smoke OK — '+t.length+' tool(s): '+t.map(x=>x.name).join(', '))}catch(e){console.error('smoke FAIL:',e.message);process.exit(1)}})\"",
     "preversion": "go vet ./... && npm run test && npm run smoke",
     "release:patch": "npm version patch && git push origin HEAD --follow-tags",
     "release:minor": "npm version minor && git push origin HEAD --follow-tags",
     "release:major": "npm version major && git push origin HEAD --follow-tags"
   },
-  "dependencies": {
-    "ffmpeg-static": "^5.3.0",
-    "ffprobe-static": "^3.1.0"
-  },
   "engines": {
     "node": ">=18.0.0"
   },