Building Enterprise Workflows with Claude Code Plugins and MCP

Level 1: Individual Use
├── Individual developers use Claude Code locally
├── Ad-hoc plugin adoption
└── Limited governance

Level 2: Team Standardization
├── Teams agree on standard plugins
├── Shared configuration templates
├── Basic permission controls
└── Informal documentation

Level 3: Enterprise Integration
├── Integrated with internal tools (Git, CI/CD, issue tracking)
├── Central MCP registry
├── RBAC and audit logging
└── Formal policies and procedures

Level 4: Advanced Governance
├── Custom internal plugins
├── Workflow automation
├── Cost allocation and chargeback
├── Advanced compliance reporting

Level 5: Organizational Excellence
├── AI-driven development as core capability
├── Continuous optimization
├── Industry leadership
└── Strategic competitive advantage

{
  "security": {
    "zeroTrust": {
      "verify-identity": {
        "required": true,
        "mechanism": "oauth2-with-mfa",
        "revalidateInterval": 3600
      },
      "verify-device": {
        "required": true,
        "checkpoints": [
          "device-compliance",
          "antivirus-current",
          "firewall-enabled"
        ]
      },
      "verify-network": {
        "required": true,
        "requirements": [
          "corporate-vpn-or-zero-trust-gateway",
          "ip-whitelisting"
        ]
      },
      "least-privilege": {
        "default": "deny",
        "grantRequiresApproval": true,
        "timeboxed": true
      }
    }
  }
}

dataGovernance:
  classification:
    public: { retention: indefinite, sharing: unrestricted }
    internal: { retention: 7-years, sharing: employees-only }
    confidential: { retention: 3-years, sharing: need-to-know }
    restricted: { retention: permanent, sharing: approved-only }

  codeHandling:
    proprietary:
      storage: on-premise-only
      transmission: encrypted
      thirdPartyAccess: prohibited
      localCacheRetention: 24-hours
      indexing: disabled

  auditRequirements:
    logging: enabled
    retentionDays: 90
    immutable: true
    alerts: on-sensitive-operations

{
  "compliance": {
    "certifications": ["soc2-type2", "iso27001", "hipaa"],
    "requirementsMappings": {
      "soc2": {
        "CC7.2": "encryption-in-transit",
        "CC9.2": "mfa-required",
        "CC6.1": "audit-logging"
      },
      "hipaa": {
        "164.312": "access-controls",
        "164.313": "transmission-security"
      }
    },
    "automatedChecks": {
      "enabled": true,
      "frequency": "continuous",
      "onFailure": "disable-feature"
    }
  }
}

enterprise-claude-config/
├── README.md
├── config.schema.json
├── policies/
│   ├── security-policy.json
│   ├── coding-standards.json
│   ├── plugin-approval-list.json
│   └── compliance-rules.json
├── plugins/
│   ├── approved-plugins.json
│   ├── internal-plugins/
│   │   ├── jira-integration/
│   │   ├── confluence-integration/
│   │   └── internal-api-client/
│   └── third-party-plugins.json
├── roles/
│   ├── developer.json
│   ├── senior-engineer.json
│   ├── architect.json
│   └── admin.json
├── teams/
│   ├── backend-team.json
│   ├── frontend-team.json
│   └── platform-team.json
└── environments/
    ├── dev.json
    ├── staging.json
    └── production.json

#!/bin/bash
# deploy-claude-config.sh - Distribute config to all team members

REPO="https://github.com/company/enterprise-claude-config"
CONFIG_VERSION="v2.1.0"

# Pull latest config
git clone --depth 1 --branch $CONFIG_VERSION $REPO ~/.claude-enterprise

# Validate configuration
claude-code validate-config ~/.claude-enterprise/config.json

# Apply to user's local Claude Code
cp ~/.claude-enterprise/config.json ~/.claude/config.json

# Verify installation
claude-code health-check

echo "Claude Code enterprise configuration deployed successfully"

{
  "roles": {
    "junior-developer": {
      "description": "Junior developers with supervised access",
      "permissions": {
        "plugins": ["approved-list-only"],
        "codeReview": "peer-review-required",
        "deployment": "disabled",
        "internalAPIs": ["read-only"],
        "modelAccess": ["claude-opus-3.5-sonnet"]
      },
      "restrictions": {
        "maxConcurrentTasks": 2,
        "maxMonthlyTokens": 1000000,
        "allowedRepositories": "approved-training-repos"
      }
    },
    "senior-engineer": {
      "description": "Senior engineers with broad access",
      "permissions": {
        "plugins": ["all-approved"],
        "codeReview": "self-approved",
        "deployment": "production",
        "internalAPIs": ["read-write"],
        "modelAccess": ["claude-opus-4-6", "claude-opus-4"]
      },
      "responsibilities": [
        "code-review-approval",
        "plugin-recommendation",
        "best-practices-enforcement"
      ]
    },
    "architect": {
      "description": "Architects designing systems",
      "permissions": {
        "plugins": ["all"],
        "codeReview": "exempt",
        "designTools": "full",
        "documentationAccess": "all"
      },
      "canApprove": ["plugin-adoption", "architectural-changes"]
    }
  }
}

┌──────────────────────────────────┐
│  Claude Code Instances (Teams)   │
└──────────────┬───────────────────┘
               │
        MCP Protocol
               │
┌──────────────▼───────────────────┐
│  Enterprise MCP Gateway           │
│  ├─ Authentication                │
│  ├─ Rate Limiting                 │
│  ├─ Audit Logging                 │
│  └─ Load Balancing                │
└──────────────┬───────────────────┘
               │
   ┌───────────┼───────────┐
   │           │           │
   ▼           ▼           ▼
┌──────┐  ┌──────┐    ┌──────┐
│ Jira │  │ Git  │    │ Code │
│ MCP  │  │ MCP  │    │ Scan │
└──────┘  └──────┘    └──────┘
   │           │           │
   └───────────┼───────────┘
               │
   ┌───────────┼───────────┐
   │           │           │
   ▼           ▼           ▼
┌──────┐  ┌──────┐    ┌──────┐
│DB    │  │APIs  │    │Auth  │
│Conn  │  │      │    │      │
└──────┘  └──────┘    └──────┘

// enterprise-mcp-server/src/index.ts
import Anthropic from "@anthropic-ai/sdk";
import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

interface Tool {
  name: string;
  description: string;
  inputSchema: Record<string, unknown>;
  execute: (args: Record<string, unknown>) => Promise<unknown>;
}

class EnterpriseMCPServer {
  private server: Server;
  private tools: Map<string, Tool> = new Map();
  private auditLog: unknown[] = [];

  constructor() {
    this.server = new Server({
      name: "enterprise-mcp-server",
      version: "1.0.0",
    });

    this.setupTools();
    this.setupAudit();
  }

  private setupTools() {
    // Jira Integration Tool
    this.tools.set("create-jira-issue", {
      name: "create-jira-issue",
      description: "Create a Jira issue with proper validation",
      inputSchema: {
        type: "object",
        properties: {
          project: { type: "string", description: "Project key" },
          issueType: { type: "string", description: "Type of issue" },
          summary: { type: "string", description: "Issue summary" },
          description: { type: "string", description: "Issue description" },
        },
        required: ["project", "issueType", "summary"],
      },
      execute: async (args) => {
        // Validate project authorization
        const isAuthorized = await this.checkAuthorization(
          args.project as string
        );
        if (!isAuthorized) throw new Error("Unauthorized project");

        // Create issue through Jira API
        const jiraResponse = await this.createJiraIssue(args);

        // Audit log
        this.auditLog.push({
          action: "create-jira-issue",
          timestamp: new Date().toISOString(),
          actor: args.actor,
          result: "success",
        });

        return jiraResponse;
      },
    });
  }

  private setupAudit() {
    // Setup audit logging middleware
    this.server.setRequestHandler(async (request) => {
      const startTime = Date.now();
      try {
        const response = await this.handleRequest(request);
        this.logAudit({
          action: request.method,
          duration: Date.now() - startTime,
          status: "success",
        });
        return response;
      } catch (error) {
        this.logAudit({
          action: request.method,
          duration: Date.now() - startTime,
          status: "error",
          error: String(error),
        });
        throw error;
      }
    });
  }

  private logAudit(entry: unknown) {
    console.log(JSON.stringify({ audit: entry }));
  }

  private async checkAuthorization(project: string): Promise<boolean> {
    // Implement actual authorization check
    return true;
  }

  private async createJiraIssue(args: Record<string, unknown>) {
    // Implement Jira API call
    return { id: "PROJ-123" };
  }

  private async handleRequest(request: unknown) {
    // Handle MCP protocol requests
    return {};
  }

  async run() {
    const transport = new StdioServerTransport();
    await this.server.connect(transport);
  }
}

const server = new EnterpriseMCPServer();
server.run();

name: jira-enterprise-integration
version: 2.0.0
type: mcp-server
description: |
  Enterprise Jira integration with workflow automation,
  permission validation, and audit logging

endpoints:
  create-issue:
    description: Create Jira issue with validation
    requiredPermissions: ["jira:create-issue"]
    rateLimit: 100/hour
    audit: required

  search-issues:
    description: Search issues across authorized projects
    requiredPermissions: ["jira:search"]
    rateLimit: 500/hour
    audit: optional

  update-issue:
    description: Update issue with change tracking
    requiredPermissions: ["jira:edit"]
    rateLimit: 200/hour
    audit: required

  list-workflows:
    description: List available workflows
    requiredPermissions: ["jira:read"]
    rateLimit: 1000/hour
    audit: optional

authorization:
  projectMapping:
    - pattern: "PROJ-*"
      roles: ["backend-team", "devops-team"]
    - pattern: "FE-*"
      roles: ["frontend-team"]
    - pattern: "INFRA-*"
      roles: ["devops-team", "architect"]

auditLogging:
  enabled: true
  retentionDays: 90
  immutable: true
  fields:
    - timestamp
    - userId
    - action
    - resourceId
    - result
    - ipAddress

// confluence-mcp-server/src/pages.ts
export interface ConfluencePage {
  id: string;
  title: string;
  spaceKey: string;
  content: string;
  version: number;
}

export class ConfluenceAPI {
  async createPage(
    spaceKey: string,
    title: string,
    content: string,
    parentPageId?: string
  ): Promise<ConfluencePage> {
    // Validate space access
    const hasAccess = await this.checkSpaceAccess(spaceKey);
    if (!hasAccess) throw new Error("No access to space");

    // Create page through API
    const response = await fetch(
      `${this.baseUrl}/rest/api/content`,
      {
        method: "POST",
        headers: this.headers,
        body: JSON.stringify({
          type: "page",
          title,
          space: { key: spaceKey },
          body: { storage: { value: content, representation: "storage" } },
          ancestors: parentPageId ? [{ id: parentPageId }] : [],
        }),
      }
    );

    return response.json();
  }

  async updatePage(
    pageId: string,
    content: string,
    version: number
  ): Promise<ConfluencePage> {
    const response = await fetch(
      `${this.baseUrl}/rest/api/content/${pageId}`,
      {
        method: "PUT",
        headers: this.headers,
        body: JSON.stringify({
          type: "page",
          version: { number: version + 1 },
          body: { storage: { value: content, representation: "storage" } },
        }),
      }
    );

    return response.json();
  }

  private async checkSpaceAccess(spaceKey: string): Promise<boolean> {
    // Implement access control
    return true;
  }
}

# .github/workflows/claude-code-review.yml
name: Claude Code Review

on: [pull_request]

jobs:
  claude-code-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Claude Code
        uses: anthropic/claude-code-action@v1
        with:
          api-key: ${{ secrets.CLAUDE_API_KEY }}
          config: .claude/enterprise-config.json

      - name: Run Code Review
        run: |
          claude-code task delegate 
            --agent "code-reviewer" 
            --task "Review PR #${{ github.event.pull_request.number }}" 
            --context "enterprise" 
            --output "review-results.json"

      - name: Post Review Results
        uses: actions/github-script@v6
        with:
          script: |
            const fs = require('fs');
            const results = JSON.parse(fs.readFileSync('review-results.json'));

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## Claude Code Review
${results.summary}`
            });

      - name: Enforce Quality Gates
        run: |
          if grep -q "BLOCKER" review-results.json; then
            echo "❌ Review found blocking issues"
            exit 1
          fi
          echo "✅ All quality gates passed"

// Jenkinsfile
pipeline {
  agent any

  stages {
    stage('Claude Code Analysis') {
      steps {
        script {
          sh '''
            # Initialize Claude Code context
            claude-code init-context 
              --git-info 
              --build-info 
              --test-results

            # Run specialized analysis
            claude-code task delegate 
              --agent "code-analyzer" 
              --task "Analyze build for optimization opportunities" 
              --output "analysis-report.json"
          '''
        }
      }
    }

    stage('Claude Code Testing') {
      parallel {
        stage('Unit Tests') {
          steps {
            sh 'npm test:unit'
          }
        }
        stage('Integration Tests') {
          steps {
            sh 'npm test:integration'
          }
        }
        stage('Claude Test Generation') {
          steps {
            script {
              sh '''
                claude-code task delegate 
                  --agent "test-generator" 
                  --task "Generate tests for untested code paths" 
                  --output "generated-tests.ts"
              '''
            }
          }
        }
      }
    }

    stage('Claude Code Review') {
      when {
        branch 'main'
      }
      steps {
        script {
          sh '''
            claude-code task delegate 
              --agent "code-reviewer" 
              --task "Comprehensive code review before release" 
              --context "enterprise,production-ready" 
              --output "release-review.json"
          '''
        }
      }
    }
  }

  post {
    always {
      publishHTML(target: [
        reportDir: '.',
        reportFiles: 'analysis-report.json',
        reportName: 'Claude Code Analysis'
      ])
    }
  }
}

{
  "prReviewWorkflow": {
    "enabled": true,
    "triggers": ["pull_request_opened", "pull_request_synchronize"],
    "stages": [
      {
        "name": "quick-check",
        "agent": "code-analyzer",
        "timeout": 60000,
        "tasks": [
          "Check for syntax errors",
          "Identify obvious anti-patterns",
          "Flag security vulnerabilities"
        ],
        "failureAction": "block-merge"
      },
      {
        "name": "comprehensive-review",
        "agent": "code-reviewer",
        "timeout": 300000,
        "tasks": [
          "Architectural review",
          "Performance analysis",
          "Test coverage assessment",
          "Documentation completeness"
        ],
        "failureAction": "request-changes"
      },
      {
        "name": "test-generation",
        "agent": "test-generator",
        "condition": "low-test-coverage",
        "timeout": 180000,
        "tasks": ["Generate missing tests"]
      }
    ],
    "reporting": {
      "postCommentToGitHub": true,
      "createSummaryReport": true,
      "trackMetrics": true
    }
  }
}

{
  "rbac": {
    "resources": {
      "plugins": {
        "actions": ["install", "configure", "remove"],
        "rolePermissions": {
          "admin": ["*"],
          "team-lead": ["install", "configure"],
          "developer": ["configure"]
        }
      },
      "repositories": {
        "actions": ["read", "write", "approve-changes"],
        "rolePermissions": {
          "admin": ["*"],
          "architect": ["read", "approve-changes"],
          "senior-engineer": ["read", "write"],
          "developer": ["read"]
        }
      },
      "internal-apis": {
        "actions": ["read", "write"],
        "rolePermissions": {
          "admin": ["*"],
          "backend-team": ["read", "write"],
          "frontend-team": ["read"],
          "other": ["denied"]
        }
      }
    },
    "policies": {
      "approval-required": {
        "resources": ["production-deployment"],
        "approvers": ["architect", "tech-lead"]
      },
      "audit-required": {
        "resources": ["sensitive-apis", "production-code"],
        "retentionDays": 365
      }
    }
  }
}

auditingAndMonitoring:
  centralizedLogging:
    enabled: true
    sink: elasticsearch
    retention: 90-days
    immutable: true

  metrics:
    - name: claude-code-usage
      labels: ["team", "role", "plugin", "model"]
      frequency: daily

    - name: code-review-effectiveness
      labels: ["reviewer-agent", "issues-found", "false-positives"]
      frequency: daily

    - name: workflow-performance
      labels: ["workflow-type", "duration", "cost", "success-rate"]
      frequency: hourly

  alerts:
    - condition: "unauthorized-access-attempt"
      severity: critical
      action: "immediate-notification"

    - condition: "unusual-usage-pattern"
      severity: high
      action: "alert-security-team"

    - condition: "plugin-failure-rate > 5%"
      severity: medium
      action: "notify-admin"

  complianceReports:
    - type: "SOC2 Attestation"
      frequency: quarterly
      content: ["access-logs", "incident-reports", "security-assessments"]

    - type: "Audit Trail"
      frequency: monthly
      recipients: ["compliance-team", "audit-committee"]

// monitoring/dashboard.ts
export class EnterpriseMonitoringDashboard {
  async buildDashboard() {
    const metrics = {
      realTimeUsage: await this.getRealTimeUsage(),
      costBreakdown: await this.getCostBreakdown(),
      teamProductivity: await this.getTeamProductivity(),
      securityAlerts: await this.getSecurityAlerts(),
      systemHealth: await this.getSystemHealth(),
    };

    return {
      timestamp: new Date().toISOString(),
      overview: {
        activeUsers: metrics.realTimeUsage.count,
        tasksInProgress: metrics.realTimeUsage.tasks,
        costToday: metrics.costBreakdown.today,
        securityIncidents: metrics.securityAlerts.critical,
      },
      detailed: metrics,
      trends: await this.analyzeTrends(metrics),
    };
  }
}

{
  "roiFramework": {
    "metrics": {
      "timeSavings": {
        "category": "developer-productivity",
        "measurement": "hours-saved-per-developer-per-month",
        "baseline": 0,
        "target": 20,
        "calculation": {
          "codeGeneration": "tasks-automated * hours-per-task",
          "codeReview": "reviews-automated * hours-per-review",
          "testing": "tests-generated * hours-per-test",
          "documentation": "docs-generated * hours-per-doc"
        }
      },
      "qualityImprovements": {
        "category": "code-quality",
        "measurement": "bugs-prevented-per-month",
        "baseline": 0,
        "target": 15,
        "calculation": {
          "securityVulnerabilities": "vulnerabilities-caught-by-review",
          "performanceIssues": "performance-problems-detected",
          "architecturalFlaws": "design-issues-identified"
        }
      },
      "costReduction": {
        "category": "operational",
        "measurement": "total-cost-of-ownership-reduction",
        "baseline": 0,
        "target": 25,
        "components": {
          "toolConsolidation": "reduced-license-costs",
          "processOptimization": "fewer-manual-reviews"
        }
      }
    },
    "measurement": {
      "frequency": "monthly",
      "reporting": ["executive-summary", "detailed-analytics", "team-breakdowns"],
      "comparisons": ["previous-month", "annual-target", "industry-benchmarks"]
    }
  }
}

Baseline Metrics:
- Average developer cost: $150,000/year
- Code review time per PR: 3 hours
- Test creation time: 5 hours per 500 LOC
- Average PRs per developer per month: 8
- Average test effort per developer per month: 40 hours

With Claude Code Enterprise:
- Code review time reduced: 60% → 1.2 hours per PR
- Test creation time reduced: 70% → 1.5 hours per 500 LOC
- Developer time freed: 8 PRs × 1.8 hours + 28 test hours = 42.4 hours/month

Annual ROI Calculation:
- Time saved per developer: 42.4 hours/month × 12 months = 509 hours/year
- Value per developer: 509 hours × $150,000/2000 = $38,175/year
- Organization total: 100 developers × $38,175 = $3,817,500/year

Claude Code Cost (100 developers):
- Enterprise license: $10,000/month = $120,000/year
- MCP infrastructure: $5,000/month = $60,000/year
- Training & support: $2,500/month = $30,000/year
- Total investment: $210,000/year

Net ROI: $3,817,500 - $210,000 = $3,607,500 profit
ROI Percentage: 1,718% return on investment
Payback Period: 0.66 weeks

Phase 1: Pilot (Weeks 1-4)
├── Select 2-3 teams for pilot
├── Deploy basic Claude Code setup
├── Establish metrics baseline
└── Gather feedback

Phase 2: Expansion (Weeks 5-12)
├── Deploy to 25% of organization
├── Implement MCP integrations (Jira, Git)
├── Establish policies and governance
└── Provide training

Phase 3: Scale (Weeks 13-20)
├── Deploy to 75% of organization
├── Integrate with CI/CD pipelines
├── Implement advanced automation
└── Continuous optimization

Phase 4: Optimization (Ongoing)
├── Monitor metrics and KPIs
├── Iteratively improve workflows
├── Develop custom plugins
└── Share best practices