---
title: tabkit
tagline: Let your AI agent read Jira and Confluence through your logged-in Chrome tab
description: tabkit is an open-source, read-only MCP server with a Chrome extension that lets Claude Code, GitHub Copilot or Codex read Jira and Confluence with your logged-in Chrome session, without an Atlassian API token.
date: 2026-10-14
repo: https://github.com/brbousnguar/tabkit
download: https://github.com/brbousnguar/tabkit/archive/refs/tags/v0.1.0.zip
stack: JavaScript · Node.js · MCP · Chrome extension
license: Apache-2.0
status: v0.1 preview
---

tabkit lets Claude Code, GitHub Copilot or Codex read your Jira issues and Confluence pages with the session you're already logged in with in Chrome. No Atlassian API token: a small Chrome extension runs each request inside an Atlassian tab.

It's the sibling of [pilotkit](/projects/pilotkit.html). pilotkit keeps an API token in the OS keychain and works without a browser. tabkit needs no token, and stops when Chrome is closed. Pick the one your company allows.

## How it works

Two pieces run on your machine: a Node MCP server that your agent starts, and an extension in Chrome.

1. Your agent calls a tool, say `jira_get_issue`.
2. The server passes the request to the extension over a WebSocket on `127.0.0.1`.
3. The extension runs a `fetch()` inside a tab of your Atlassian site, with `chrome.scripting`.
4. That request is same-origin, so Chrome adds your session itself, the way it does for Jira's own page. The answer comes back the same way.

The extension never reads your cookies, and the server only sees the status and the JSON body.

## The fun part: pairing without sending the secret

A port on localhost is open to every program on the machine. So the server only accepts a `chrome-extension://` origin, and the two sides share a pairing token. Each one proves it holds the token with an HMAC-SHA256 over a fresh random value, so the token itself never crosses the socket.

The extension is read-only on its own, too. It sends `GET`, plus `POST` to the two Jira search endpoints that only exist as `POST`. Anything else is refused before it reaches the tab.

## Install it

You need Node.js 20+, Chrome 116+ and an Atlassian Cloud site you're logged in to in Chrome.

1. Download the [v0.1.0 zip](https://github.com/brbousnguar/tabkit/archive/refs/tags/v0.1.0.zip) or clone the repo, then run `npm install` in the folder.
2. Open `chrome://extensions`, turn on Developer mode, click Load unpacked and pick the `extension/` folder.
3. Run `npm run -s pairing-token`. In the tabkit popup, set your site (`https://<name>.atlassian.net`), paste the token and click Save.
4. Register the server with your agent:

```bash
# Claude Code
claude mcp add tabkit -- node /path/to/tabkit/src/index.js

# GitHub Copilot CLI
copilot mcp add tabkit -- node /path/to/tabkit/src/index.js
```

For VS Code, add it to `mcp.json` as a `stdio` server with the same command. The [README](https://github.com/brbousnguar/tabkit#setup) has that snippet and the Codex one.

Then ask your agent "who am I in Jira?".

## Four tools, all read-only

- `atlassian_whoami`: the site and the account the extension is using.
- `jira_get_issue`: one issue by key.
- `jira_search_issues`: a JQL search, one page at a time.
- `confluence_get_page`: a page by id, with its body.

## What I tested, and what I didn't

The server has 9 tests against a fake extension that speaks the real protocol. I also ran the real extension in headless Chrome for Testing 153, against a Jira Cloud site that allows anonymous reads: the pairing, the background tab, a JQL search, an issue fetch and the "log in to Chrome" hint on a 401 all worked.

Not tested yet: a logged-in session on a private site, a real Confluence page, Windows and Linux, and the Copilot clients. That's why it's a v0.1 preview. If you try one of those, [open an issue](https://github.com/brbousnguar/tabkit/issues) and tell me what breaks.