igs-sdlc-mcp

SDLC Documentation Generator — MCP stdio server for local Git-based workflows.

This server is the infrastructure layer for the IGS SDLC AI agent. It gives the AI (running in your IDE, guided by CLAUDE.md as its system prompt) the ability to:

• Read and write project files locally (in your cloned repo)
• Run git pull/push/commit/status on your machine, not a remote server
• Send webhook notifications (Teams / Power Automate)

Because it runs as a stdio process in your IDE, every Git operation targets your local repo clone — no more sync issues.

Quick Start

1. Clone the SDLC repo

git clone https://[email protected]/ArroyoCodes/IGSVelocity/_git/ClaudeSDLCAgent
cd ClaudeSDLCAgent

2. Add to your mcp.json

VS Code (%APPDATA%\Code\User\mcp.json on Windows, ~/.config/Code/User/mcp.json on Mac/Linux):

{
  "mcpServers": {
    "sdlc": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "igs-sdlc-mcp"],
      "cwd": "D:\\Work\\YourPath\\ClaudeSDLCAgent"
    }
  }
}

With API key (if the package was built with build:secure):

{
  "mcpServers": {
    "sdlc": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "igs-sdlc-mcp"],
      "env": {
        "SDLC_API_KEY": "your-team-key-here"
      },
      "cwd": "D:\\Work\\YourPath\\ClaudeSDLCAgent"
    }
  }
}

Cursor (.cursor/mcp.json in your home directory):

{
  "mcpServers": {
    "sdlc": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "igs-sdlc-mcp"],
      "cwd": "/Users/yourname/repos/ClaudeSDLCAgent"
    }
  }
}

Important: cwd must point to the root of the cloned SDLC repo — the folder that contains projects/ and .claude/.

3. Configure the AI agent

Copy the contents of CLAUDE.md from the repo as your AI agent's system prompt (or use it as a .instructions.md / copilot-instructions.md file in VS Code). The AI reads the SKILL.md files and generates documents; this MCP server gives it the hands to save files and run git.

Available Tools (13)

| Tool | Description | |------|-------------| | read_file | Read any file in the workspace | | write_file | Write/create any file in the workspace | | list_directory | List directory contents | | file_exists | Check if a file/directory exists | | create_directory | Create a directory recursively | | git_pull | Pull latest from remote | | git_push | Push commits to remote | | git_commit | Stage all + commit with message | | git_status | Get current git status | | get_git_identity | Get git user.name and user.email | | git_log | Get recent commits (filterable by path) | | list_projects | List all projects in projects/ folder | | send_webhook | POST to a Teams/Power Automate webhook |

Development

# Install dependencies
npm install

# Build (no API key)
npm run build

# Run in development (uses tsx, no build needed)
npm run dev

# Type check
npm run typecheck

Building with API key (for publishing)

# Linux / Mac
SDLC_API_KEY_VALUE="arroyo-sdlc-2026-yourkey" npm run build:secure

# Windows PowerShell
$env:SDLC_API_KEY_VALUE="arroyo-sdlc-2026-yourkey"; npm run build:secure

# Windows CMD
set SDLC_API_KEY_VALUE=arroyo-sdlc-2026-yourkey && node scripts/build-secure.mjs

The key is embedded in dist/index.js at build time (via esbuild --define). The src/ folder is not included in the published npm package.

Publishing to npm

npm login
npm publish

For a private Azure Artifacts registry, add to package.json:

"publishConfig": {
  "registry": "https://pkgs.dev.azure.com/ArroyoCodes/_packaging/IGSVelocity/npm/registry/"
}

How it works

IDE (VS Code / Cursor)
  └── AI Agent (Claude / Copilot)
        System Prompt = CLAUDE.md
        │
        │  MCP tool calls (stdio)
        ▼
  @igs/sdlc-mcp server (this package)
  Running as local process with cwd = your repo
        │
        ├── read_file / write_file → local filesystem
        ├── git_pull / git_push / git_commit → your local git repo
        └── send_webhook → Teams / Power Automate

The AI agent (guided by CLAUDE.md) handles all SDLC logic: which skill to execute, what sections to generate, signature validation, checklist updates. This server only provides the infrastructure tools.

Security

• All file operations are restricted to the workspace cwd (path traversal protection)
• Git commands use execFileSync with argument arrays (no shell injection)
• Webhooks only allow HTTPS URLs
• Optional API key authentication (embedded at build time)
• For stronger access control: publish to a private npm registry (Azure Artifacts or GitHub Packages) where npm authentication acts as the gate