Bitbucket Agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Bitbucket Agent (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
mcp-name: io.github.csgear/bitbucket-agent
This is an MCP (Model Context Protocol) server that allows AI agents to create Pull Requests in a self-hosted Bitbucket Server instance.
pip install -r requirements.txtCopy .env.example to .env and fill in your details:
cp .env.example .envEdit .env with your Bitbucket URL, credentials, project key, and repository slug.
You can test the server locally by running:
python server.py(Note: Standard MCP servers communicate over stdio, so running this directly in a terminal will just wait for input).
To use this with an MCP-compliant client, you need to configure it to run this python script.
Example `claude_desktop_config.json`:
{
"mcpServers": {
"bitbucket-agent": {
"command": "python",
"args": ["/absolute/path/to/bitbucket/server.py"],
"env": {
"BITBUCKET_URL": "https://bitbucket.yourcompany.com",
"BITBUCKET_USERNAME": "your_username",
"BITBUCKET_PASSWORD": "your_password",
"BITBUCKET_PROJECT_KEY": "PROJ",
"BITBUCKET_REPO_SLUG": "repo"
}
}
}
}_Note: You can either rely on the .env file loading (if the working directory is correct) or pass the environment variables directly in the config as shown above._
To use this agent with GitHub Copilot (or other MCP-enabled VS Code extensions), you typically need to add the server configuration to your VS Code settings.
.vscode/settings.json) or User Settings."github.copilot.mcpServers": {
"bitbucket-agent": {
"command": "python",
"args": [
"${workspaceFolder}/server.py"
],
"env": {
"BITBUCKET_URL": "https://bitbucket.yourcompany.com",
"BITBUCKET_USERNAME": "your_username",
"BITBUCKET_PASSWORD": "your_password",
"BITBUCKET_PROJECT_KEY": "PROJ",
"BITBUCKET_REPO_SLUG": "repo"
}
}
}Note: Adjust the${workspaceFolder}/server.pypath if your script is located elsewhere. You may need to use an absolute path if${workspaceFolder}is not resolved correctly by your specific extension version.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.