agentic-sdlc-mcp: Instructions file for Claude Code

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

What this is

agentic-sdlc-mcp is an MCP (Model Context Protocol) server that acts as an "Agentic SDLC Control Plane": it exposes structured tools/resources that let AI coding agents plan, create, test, review, secure, and release software against GitHub, following a six-phase lifecycle: Plan → Create → Test → Review → Optimize → Secure (full standard text lives in src/resources/index.ts under sdlc://standards/agentic-sdlc).

Commands

npm run build          # tsc -> dist/
npm run typecheck      # tsc --noEmit
npm run dev            # tsx watch src/index.ts
npm run test           # vitest run (whole suite)
npm run test:watch     # vitest watch mode
npm run test:integration # config lifecycle + real in-memory MCP protocol tests
npm run test:coverage  # vitest run --coverage (v8, text+lcov+json-summary, enforced thresholds)
npm run smoke          # node dist/index.js --smoke — loads module, registers all tools/resources, exits 0. No GITHUB_TOKEN needed.
npm run check:line-endings # rejects CRLF/mixed tracked text; Git and editors are configured for LF

Run a single test file: npx vitest run src/__tests__/tools/create-issue-set.test.ts Run a single test by name: npx vitest run -t "dryRun=true"

npm run smoke and GITHUB_TOKEN validation are also the fastest way to sanity-check that a change didn't break server startup — it does not require a real token (--smoke / SMOKE=true short-circuits config.ts validation).

Architecture

Server factory and entry point: src/server.ts exports createAgenticSdlcServer(), the single composition root that registers every tool and resource. src/index.ts owns environment loading, config validation, smoke mode, and transport selection (stdio default, or local http via TRANSPORT=http). src/http-server.ts is a loopback-only stateless adapter: preserve SDK Host validation, explicit Origin validation, per-request server/transport isolation, safe JSON-RPC errors, unsupported GET/DELETE 405, strict port parsing, and graceful shutdown. It is not a remote deployment profile; do not add a non-loopback binding without the v1.10 authentication, request-context, budget, and tenant-isolation design. Protocol integration tests instantiate the same factory over an in-memory SDK transport, while HTTP lifecycle tests open only an ephemeral 127.0.0.1 port.