Bitbucket MCP Server

@droplinkperformance/bitbucket-mcp-server

Provider-agnostic, AI-review-first Model Context Protocol (MCP) server for Bitbucket Cloud.

The primary value of this server is AI-powered code review and pull request analysis, not CRUD against the Bitbucket API. Every major dependency (SCM access, cache, token storage, rate limiting, LLM, events) is hidden behind a provider-agnostic interface so the same business logic can later target GitHub / GitLab / Azure DevOps and OpenAI / Anthropic / Gemini / Bedrock without changes to use-cases, agents, or domain contracts.

Status: Phase 1. See Roadmap.

Features (Phase 1)

• Dual transports: stdio (Cursor / Claude Desktop) and Streamable HTTP (Node http, for remote/production).
• Auto-discovered tools via a ToolRegistry — no manual registration.
• Explicit `BitbucketContext` (workspace + optional repository) on every tool — multi-workspace ready.
• Resilient BitbucketClient: auth injection, auto-pagination, retry/backoff, rate-limit handling, caching, secret masking.
• Two auth strategies: OAuth 2.0 (Authorization Code, with rotating refresh-token persistence) and Bearer token.
• AI code review (analyze_pull_request) backed by a CodeReviewAgent that chunks large PRs and returns a standard ReviewResult.
• Pluggable LLM provider (OpenAI / Anthropic / Gemini / Bedrock), cache (memory / Redis), and token store (file / memory / Redis).

Tools

All tool inputs accept workspace (optional if BITBUCKET_DEFAULT_WORKSPACE is set) and, where applicable, repository.

Architecture

src/

index.ts entry: chooses transport container.ts composition root (the only place wiring concretes) mcp/ McpServer + ToolRegistry (auto-discovery) + transports tools/ thin MCP adapters (*.tool.ts) -> call exactly one use-case application/ use-cases (CQRS-ish: command|query) with Input/Output DTOs agents/ autonomous workflows implementing Agent domain/ provider-agnostic types, repository contracts, ReviewResult repositories/bitbucket/ Bitbucket implementations of the contracts clients/bitbucket/ resilient REST client auth/ AuthProvider (+ token/oauth) and TokenStore implementations cache/ CacheProvider (+ memory/redis) ratelimit/ RateLimitStrategy (+ bitbucket) llm/ LlmProvider (+ openai/anthropic/gemini/bedrock) events/ EventBus (+ in-memory) services/ reusable services (masking, chunking) telemetry/ OpenTelemetry bootstrap + metrics infrastructure/ config, logger, http, attachments shared/ errors, result envelope, http-status, BitbucketContext

Flow: tool -> use-case -> (agent | repository contract) -> repositories/bitbucket -> BitbucketClient. Agents may also use the LlmProvider and EventBus. Tools never contain business logic.

Requirements

• Node.js 23+

Install

Published as @droplinkperformance/bitbucket-mcp-server.

npx -y @droplinkperformance/bitbucket-mcp-server

From source:

npm install

npm run build

Release

Merges to main run .github/workflows/release.yml: tests, build, then semantic-release. Version and npm publish happen only when the merge includes Conventional Commits:

Other messages skip publish. The GitHub secret NPM_TOKEN (npm Automation token for the droplinkperformance org) is required.

After a successful npm release, the same workflow waits until that version is visible on the npm registry, then publishes metadata to the MCP Registry as io.github.droplinkperformance/bitbucket-mcp-server (OIDC, no extra secret). To republish MCP metadata for the current package.json version without cutting a new release, run the workflow manually with Publish mcp only. github.com/mcp syncs from that registry; if the server does not appear, email partnerships@github.com.

To stay on 0.x for the first release, tag the current commit (git tag v0.1.0 && git push origin v0.1.0) before the first conventional merge; otherwise semantic-release starts at 1.0.0.

Configuration

Copy .env.example to .env and fill in values. Load it with Node's built-in flag:

node --env-file=.env dist/index.js

Key variables:

Authentication

Bearer (OAuth access token): set BITBUCKET_ACCESS_TOKEN only (non-ATATT tokens).

API token (recommended, ATATT…): set BITBUCKET_ACCESS_TOKEN and BITBUCKET_EMAIL (your Atlassian account email from Bitbucket → Personal settings → Email aliases). API tokens use HTTP Basic auth, not Bearer.

App password (legacy, until June 2026): set BITBUCKET_ACCESS_TOKEN and BITBUCKET_USERNAME (your Bitbucket username).

OAuth 2.0 (Authorization Code): set BITBUCKET_CLIENT_ID / BITBUCKET_CLIENT_SECRET. Tokens are persisted by the configured TOKEN_STORE; Bitbucket rotates refresh tokens, and the server persists the new one on every refresh. For headless boot, provide a previously obtained BITBUCKET_REFRESH_TOKEN.

Bitbucket OAuth endpoints used: authorize https://bitbucket.org/site/oauth2/authorize, token https://bitbucket.org/site/oauth2/access_token. The authorize URL can be built from OAuthProvider.buildAuthorizeUrl() and the returned ?code= exchanged via OAuthProvider.loginWithCode(code).

LLM provider

Set LLM_PROVIDER and the matching key:

LLM_PROVIDER=openai      # OPENAI_API_KEY

LLM_PROVIDER=anthropic # ANTHROPIC_API_KEY LLM_PROVIDER=gemini # GEMINI_API_KEY LLM_PROVIDER=bedrock # AWS creds + BEDROCK_MODEL_ID (needs @aws-sdk/client-bedrock-runtime)

ioredis (Redis providers) and @aws-sdk/client-bedrock-runtime (Bedrock) are optional and loaded lazily — only needed when selected.

Running

stdio

MCP_TRANSPORT=stdio node --env-file=.env dist/index.js

Streamable HTTP

MCP_TRANSPORT=http HTTP_PORT=3000 node --env-file=.env dist/index.js

health: GET http://localhost:3000/health

endpoint: POST http://localhost:3000/mcp

MCP Inspector

npx @modelcontextprotocol/inspector node dist/index.js

Cursor

~/.cursor/mcp.json (or project .cursor/mcp.json):

{

"mcpServers": { "bitbucket": { "command": "npx", "args": ["-y", "@droplinkperformance/bitbucket-mcp-server"], "env": { "MCP_TRANSPORT": "stdio", "BITBUCKET_ACCESS_TOKEN": "ATATT-your-api-token", "BITBUCKET_EMAIL": "you@company.com", "BITBUCKET_DEFAULT_WORKSPACE": "your-workspace", "LLM_PROVIDER": "openai", "OPENAI_API_KEY": "sk-..." } } } }

Claude Desktop

claude_desktop_config.json:

{

"mcpServers": { "bitbucket": { "command": "npx", "args": ["-y", "@droplinkperformance/bitbucket-mcp-server"], "env": { "BITBUCKET_ACCESS_TOKEN": "your-token", "BITBUCKET_DEFAULT_WORKSPACE": "your-workspace", "LLM_PROVIDER": "anthropic", "ANTHROPIC_API_KEY": "sk-ant-..." } } } }

Development

npm run dev          # tsx watch (stdio)

npm run typecheck npm run lint npm test npm run test:coverage

Roadmap

• Phase 1 (this release): auth, abstractions, BitbucketClient, tool auto-discovery, PR tools, analyze_pull_request.
• Phase 2: Pipelines + full-text paginated logs, pipeline-investigator agent, auto_review_pull_request (dry-run / publish inline comments).
• Phase 3: Remaining CRUD — repositories, commits, branches, tags, issues, workspaces, members, search.
• Phase 4: analyze_dotnet_pull_request (dotnet-review agent), advanced agents, automation workflows.
• Phase 5: Docker, Compose, Helm, production deploy guide.

License

MIT