veracode-mcp: Instructions file for Claude Code

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Overview

This is a Model Context Protocol (MCP) server implementation in Go that provides Veracode security scanning capabilities to AI assistants and LLMs. It supports stdio transport for local filesystem operations and uses JSON-RPC 2.0 for communication.

Building and Testing

Build Commands

# Full build with UI, quality checks, and tests
.\build.ps1

# Quick build (skip quality checks)
.\build.ps1 -Quick

# Build without tests
.\build.ps1 -NoTest

# Skip UI builds (Go server only)
.\build.ps1 -SkipUI

# UI only build
.\build.ps1 -UIOnly

# Verbose test output
.\build.ps1 -Verbose

The build script performs these steps:

1. Builds 5 React UI apps (pipeline/static/dynamic/local-sca/local-iac findings)
2. Runs go fmt ./...
3. Runs go vet (excludes /api/generated/)
4. Runs golangci-lint run (if available)
5. Runs go test ./...
6. Builds binary to dist/veracode-mcp.exe

Manual Build

go mod download
go build -o dist/veracode-mcp.exe .

Testing

go test ./...              # All tests
go test ./... -v           # Verbose output
go test ./internal/mcp_tools/...  # Specific package

Architecture

Auto-Registration Pattern

This codebase uses an auto-registration architecture where tools register themselves on package import via init() functions. There are three coordinated registries:

1. ToolRegistry (internal/tool_registry/tool_loader.go)

   • Loads tool definitions from tools.json (embedded at compile time)
   • Validates parameter schemas
   • Provides tool metadata to MCP clients

2. ToolHandlerRegistry (internal/tool_registry/tool_handlers.go)

   • Maps tool names to handler functions
   • Runtime tool invocation

3. ToolImplRegistry (internal/tool_registry/tool_implementations.go)

   • Manages tool lifecycle: Initialize → RegisterHandlers → Shutdown
   • Factory-based instantiation