diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 69a14b28..b06796be 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,7 +41,7 @@ jobs:
           DISPLAY: :99.0
         run: |
           Xvfb -ac :99 -screen 0 1920x1080x16 &
-          mvn verify -Dtest.includes="**/ui/*.java"
+          ./mvnw verify -Dtest.includes="**/ui/*.java"
       - name: Upload Coverage Report
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
@@ -80,7 +80,7 @@ jobs:
           DISPLAY: :99.0
         run: |
           Xvfb -ac :99 -screen 0 1920x1080x16 &
-          mvn verify -Dtest.includes="**/integration/*Test.java"
+          ./mvnw verify -Dtest.includes="**/integration/*Test.java"
       - name: Upload Coverage Report
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
@@ -119,7 +119,7 @@ jobs:
           DISPLAY: :99.0
         run: |
           Xvfb -ac :99 -screen 0 1920x1080x16 &
-          mvn clean verify -Dtest.includes="**/unit/**/*Test.java"
+          ./mvnw clean verify -Dtest.includes="**/unit/**/*Test.java"
       - name: Upload Coverage Report
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 958a0e3a..06c925f3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -111,10 +111,10 @@ jobs:
       - name: Update the POM version
         env:
           VERSION: ${{ inputs.tag }}
-        run: mvn -B org.eclipse.tycho:tycho-versions-plugin:set-version -DnewVersion="${VERSION}" --file pom.xml
+        run: ./mvnw -B org.eclipse.tycho:tycho-versions-plugin:set-version -DnewVersion="${VERSION}" --file pom.xml
 
       - name: Create release
-        run: mvn -B clean install --file pom.xml  -DskipTests -pl "!checkmarx-ast-eclipse-plugin-tests"
+        run: ./mvnw -B clean install --file pom.xml  -DskipTests -pl "!checkmarx-ast-eclipse-plugin-tests"
 
       - name: Extract CLI version
         id: extract_cli_version
diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties
new file mode 100644
index 00000000..fe9deed0
--- /dev/null
+++ b/.mvn/wrapper/maven-wrapper.properties
@@ -0,0 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+wrapperVersion=3.3.2
+distributionType=only-script
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
+distributionSha256Sum=4ec3f26fb1a692473aea0235c300bd20f0f9fe741947c82c1234cefd76ac3a3c
diff --git a/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/enums/SeverityExtendedTest.java b/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/enums/SeverityExtendedTest.java
index 3e1f0d67..c3b6aed6 100644
--- a/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/enums/SeverityExtendedTest.java
+++ b/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/enums/SeverityExtendedTest.java
@@ -79,27 +79,14 @@ void testEnumOrdinal_correctSequence() {
 	@Test
 	void testValues_returnsAllConstants() {
 		Severity[] values = Severity.values();
-		assertEquals(8, values.length);
+		assertEquals(6, values.length);
 	}
 
 	@Test
 	void testValues_containsAllExpected() {
-		Severity[] values = Severity.values();
-		boolean hasCritical = false;
-		boolean hasHigh = false;
-		boolean hasLow = false;
-		boolean hasGroupBy = false;
-
-		for (Severity s : values) {
-			if (s == Severity.CRITICAL) hasCritical = true;
-			if (s == Severity.HIGH) hasHigh = true;
-			if (s == Severity.LOW) hasLow = true;
-		}
-
-		assertTrue(hasCritical);
-		assertTrue(hasHigh);
-		assertTrue(hasLow);
-		assertTrue(hasGroupBy);
+		// Grouping modes live in GroupingMode; Severity holds only real severity levels
+		assertArrayEquals(new Severity[] { Severity.CRITICAL, Severity.HIGH, Severity.MEDIUM, Severity.LOW,
+				Severity.INFO, Severity.MALICIOUS }, Severity.values());
 	}
 
 	@Test
diff --git a/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/enums/SeverityTest.java b/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/enums/SeverityTest.java
index 52126ba1..6fa8c3c7 100644
--- a/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/enums/SeverityTest.java
+++ b/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/enums/SeverityTest.java
@@ -47,6 +47,6 @@ void testGetSeverity_roundTrip_allValues() {
 
     @Test
     void testEnumValues_count() {
-        assertEquals(8, Severity.values().length);
+        assertEquals(6, Severity.values().length);
     }
 }
diff --git a/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/properties/PreferencesTest.java b/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/properties/PreferencesTest.java
index 4c8c6d91..d5658deb 100644
--- a/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/properties/PreferencesTest.java
+++ b/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/properties/PreferencesTest.java
@@ -5,7 +5,6 @@
 
 import org.eclipse.core.runtime.Platform;
 import org.eclipse.core.runtime.preferences.IPreferencesService;
-import org.eclipse.jface.preference.IPreferenceStore;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -13,7 +12,6 @@
 import org.mockito.MockedStatic;
 import org.mockito.MockitoAnnotations;
 
-import com.checkmarx.eclipse.Activator;
 import com.checkmarx.eclipse.common.preferences.Preferences;
 
 class PreferencesTest {
@@ -21,20 +19,14 @@ class PreferencesTest {
 	@Mock
 	private IPreferencesService mockPreferencesService;
 
-	@Mock
-	private IPreferenceStore mockPreferenceStore;
-
-	@Mock
-	private Activator mockActivator;
+	private static final String KEY_PREFIX = "preferencesTest.";
 
 	private MockedStatic<Platform> platformMock;
-	private MockedStatic<Activator> activatorMock;
 
 	@BeforeEach
 	void setUp() {
 		MockitoAnnotations.openMocks(this);
 		platformMock = mockStatic(Platform.class);
-		activatorMock = mockStatic(Activator.class);
 	}
 
 	@AfterEach
@@ -42,11 +34,20 @@ void tearDown() {
 		if (platformMock != null) {
 			platformMock.close();
 		}
-		if (activatorMock != null) {
-			activatorMock.close();
+		for (String key : new String[] { "testKey", "key1", "key2" }) {
+			Preferences.STORE.setToDefault(KEY_PREFIX + key);
 		}
 	}
 
+	/**
+	 * Preferences.store writes to the real ScopedPreferenceStore, which reads
+	 * through Platform.getPreferencesService(), so the Platform mock must be released.
+	 */
+	private void useRealPlatform() {
+		platformMock.close();
+		platformMock = null;
+	}
+
 	@Test
 	void testGetPref_returnsValue() {
 		platformMock.when(Platform::getPreferencesService).thenReturn(mockPreferencesService);
@@ -118,33 +119,29 @@ void testGetAdditionalOptions_returnNull_whenNotSet() {
 
 	@Test
 	void testStore_setsValueInPreferenceStore() {
-		activatorMock.when(Activator::getDefault).thenReturn(mockActivator);
-		when(mockActivator.getPreferenceStore()).thenReturn(mockPreferenceStore);
+		useRealPlatform();
 
-		Preferences.store("testKey", "testValue");
+		Preferences.store(KEY_PREFIX + "testKey", "testValue");
 
-		verify(mockActivator).getPreferenceStore();
-		verify(mockPreferenceStore).setValue("testKey", "testValue");
+		assertEquals("testValue", Preferences.STORE.getString(KEY_PREFIX + "testKey"));
 	}
 
 	@Test
 	void testStore_withEmptyValue() {
-		activatorMock.when(Activator::getDefault).thenReturn(mockActivator);
-		when(mockActivator.getPreferenceStore()).thenReturn(mockPreferenceStore);
+		useRealPlatform();
+		Preferences.store(KEY_PREFIX + "testKey", "testValue");
 
-		Preferences.store("testKey", "");
+		Preferences.store(KEY_PREFIX + "testKey", "");
 
-		verify(mockPreferenceStore).setValue("testKey", "");
+		assertEquals("", Preferences.STORE.getString(KEY_PREFIX + "testKey"));
 	}
 
 	@Test
-	void testStore_withNullValue() {
-		activatorMock.when(Activator::getDefault).thenReturn(mockActivator);
-		when(mockActivator.getPreferenceStore()).thenReturn(mockPreferenceStore);
-
-		Preferences.store("testKey", null);
+	void testStore_withNullValue_throws() {
+		useRealPlatform();
 
-		verify(mockPreferenceStore).setValue("testKey", null);
+		// Eclipse preference nodes reject null values
+		assertThrows(NullPointerException.class, () -> Preferences.store(KEY_PREFIX + "testKey", null));
 	}
 
 	@Test
@@ -179,13 +176,12 @@ void testGetPref_multipleCallsWithDifferentKeys() {
 
 	@Test
 	void testStore_multipleValuesSequentially() {
-		activatorMock.when(Activator::getDefault).thenReturn(mockActivator);
-		when(mockActivator.getPreferenceStore()).thenReturn(mockPreferenceStore);
+		useRealPlatform();
 
-		Preferences.store("key1", "value1");
-		Preferences.store("key2", "value2");
+		Preferences.store(KEY_PREFIX + "key1", "value1");
+		Preferences.store(KEY_PREFIX + "key2", "value2");
 
-		verify(mockPreferenceStore).setValue("key1", "value1");
-		verify(mockPreferenceStore).setValue("key2", "value2");
+		assertEquals("value1", Preferences.STORE.getString(KEY_PREFIX + "key1"));
+		assertEquals("value2", Preferences.STORE.getString(KEY_PREFIX + "key2"));
 	}
 }
diff --git a/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/actions/ToolBarActionsTest.java b/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/actions/ToolBarActionsTest.java
index af8d8612..c2b13ec8 100644
--- a/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/actions/ToolBarActionsTest.java
+++ b/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/actions/ToolBarActionsTest.java
@@ -25,11 +25,13 @@
 import com.checkmarx.eclipse.enums.ActionName;
 import com.checkmarx.eclipse.views.DataProvider;
 
+import com.checkmarx.eclipse.enums.GroupingMode;
 import com.checkmarx.eclipse.enums.PluginListenerType;
 import com.checkmarx.eclipse.common.enums.Severity;
 import com.checkmarx.eclipse.views.DisplayModel;
 import com.checkmarx.eclipse.views.PluginListenerDefinition;
 import com.checkmarx.eclipse.views.actions.ToolBarActions;
+import com.checkmarx.eclipse.views.GlobalSettings;
 import com.checkmarx.eclipse.views.filters.FilterState;
 import com.google.common.eventbus.EventBus;
 
@@ -137,6 +139,9 @@ void testRefreshToolbarRecreatesActions() {
     void testGroupBySeverityAction() {
         // createGroupByActions() runs inside a background Job so we test the toggle directly.
         FilterState.groupBySeverity = false;
+        try (MockedStatic<GlobalSettings> gs = Mockito.mockStatic(GlobalSettings.class)) {
+            FilterState.setGroupingMode(GroupingMode.SEVERITY);
+        }
         assertTrue(FilterState.groupBySeverity);
     }
 
diff --git a/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/filters/FilterStateExtendedTest.java b/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/filters/FilterStateExtendedTest.java
index 089d188b..4fd26a37 100644
--- a/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/filters/FilterStateExtendedTest.java
+++ b/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/filters/FilterStateExtendedTest.java
@@ -9,6 +9,7 @@
 import org.mockito.MockitoAnnotations;
 
 import com.checkmarx.eclipse.common.enums.Severity;
+import com.checkmarx.eclipse.enums.GroupingMode;
 import com.checkmarx.eclipse.enums.State;
 import com.checkmarx.eclipse.views.GlobalSettings;
 import com.checkmarx.eclipse.views.filters.FilterState;
@@ -87,6 +88,7 @@ void testSetState_groupBySeverityToggle() {
 		boolean beforeState = FilterState.groupBySeverity;
 
 		try (MockedStatic<GlobalSettings> mockSettings = mockStatic(GlobalSettings.class)) {
+			FilterState.setGroupingMode(GroupingMode.SEVERITY);
 			assertNotEquals(beforeState, FilterState.groupBySeverity);
 		}
 	}
diff --git a/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/filters/FilterStateTest.java b/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/filters/FilterStateTest.java
index ad5da5c0..8da6c6a6 100644
--- a/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/filters/FilterStateTest.java
+++ b/checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/filters/FilterStateTest.java
@@ -13,6 +13,7 @@
 import org.mockito.Mockito;
 
 import com.checkmarx.eclipse.common.enums.Severity;
+import com.checkmarx.eclipse.enums.GroupingMode;
 import com.checkmarx.eclipse.enums.State;
 import com.checkmarx.eclipse.views.GlobalSettings;
 import com.checkmarx.eclipse.views.filters.FilterState;
@@ -136,6 +137,7 @@ void testSetState_info_togglesFromFalse() {
     void testSetState_groupBySeverity_toggles() {
         FilterState.groupBySeverity = true;
         try (MockedStatic<GlobalSettings> gs = Mockito.mockStatic(GlobalSettings.class)) {
+            FilterState.setGroupingMode(GroupingMode.SEVERITY);
         }
         assertFalse(FilterState.groupBySeverity);
     }
@@ -144,6 +146,7 @@ void testSetState_groupBySeverity_toggles() {
     void testSetState_groupByQueryName_toggles() {
         FilterState.groupByQueryName = false;
         try (MockedStatic<GlobalSettings> gs = Mockito.mockStatic(GlobalSettings.class)) {
+            FilterState.setGroupingMode(GroupingMode.QUERY_NAME);
         }
         assertTrue(FilterState.groupByQueryName);
     }
@@ -152,6 +155,7 @@ void testSetState_groupByQueryName_toggles() {
     void testSetState_groupByStateName_toggles() {
         FilterState.groupByStateName = false;
         try (MockedStatic<GlobalSettings> gs = Mockito.mockStatic(GlobalSettings.class)) {
+            FilterState.setGroupingMode(GroupingMode.STATE_NAME);
         }
         assertTrue(FilterState.groupByStateName);
     }
diff --git a/checkmarx-ast-eclipse-plugin/.classpath b/checkmarx-ast-eclipse-plugin/.classpath
index 56a85caa..5ea8e9bf 100644
--- a/checkmarx-ast-eclipse-plugin/.classpath
+++ b/checkmarx-ast-eclipse-plugin/.classpath
@@ -15,7 +15,7 @@
 	</classpathentry>
 	<classpathentry exported="true" kind="lib" path="../common-lib/lib/ast-cli-java-wrapper-2.4.31.jar"/>
 	<classpathentry kind="lib" path="../common-lib/lib/commons-lang3-3.18.0.jar"/>
-	<classpathentry kind="lib" path="../common-lib/lib/jackson-core-2.21.4.jar"/>
+	<classpathentry kind="lib" path="../common-lib/lib/jackson-core-2.21.7.jar"/>
 	<classpathentry kind="lib" path="../common-lib/lib/jackson-databind-2.21.5.jar"/>
 	<classpathentry kind="lib" path="../common-lib/lib/jackson-annotations-2.21.jar"/>
 	<classpathentry kind="lib" path="../common-lib/lib/slf4j-api-2.0.17.jar"/>
diff --git a/common-lib/.classpath b/common-lib/.classpath
index 082d5a03..343d372c 100644
--- a/common-lib/.classpath
+++ b/common-lib/.classpath
@@ -9,7 +9,7 @@
 	<classpathentry kind="src" path="src"/>
 	<classpathentry exported="true" kind="lib" path="lib/ast-cli-java-wrapper-2.4.31.jar"/>
 	<classpathentry kind="lib" path="lib/commons-lang3-3.18.0.jar"/>
-	<classpathentry kind="lib" path="lib/jackson-core-2.21.4.jar"/>
+	<classpathentry kind="lib" path="lib/jackson-core-2.21.7.jar"/>
 	<classpathentry kind="lib" path="lib/jackson-databind-2.21.5.jar"/>
 	<classpathentry kind="lib" path="lib/jackson-annotations-2.21.jar"/>
 	<classpathentry kind="lib" path="lib/slf4j-api-2.0.17.jar"/>
diff --git a/common-lib/META-INF/MANIFEST.MF b/common-lib/META-INF/MANIFEST.MF
index dd946b85..2c4c6be5 100644
--- a/common-lib/META-INF/MANIFEST.MF
+++ b/common-lib/META-INF/MANIFEST.MF
@@ -6,7 +6,7 @@ Bundle-Version: 1.0.0.qualifier
 Bundle-Vendor: Checkmarx
 Bundle-ClassPath: .,
  lib/ast-cli-java-wrapper-2.4.31.jar,
- lib/jackson-core-2.21.4.jar,
+ lib/jackson-core-2.21.7.jar,
  lib/jackson-databind-2.21.5.jar,
  lib/jackson-annotations-2.21.jar,
  lib/slf4j-api-2.0.17.jar,
diff --git a/common-lib/build.properties b/common-lib/build.properties
index d53d55b3..0239c7b0 100644
--- a/common-lib/build.properties
+++ b/common-lib/build.properties
@@ -1,7 +1,7 @@
 output.. = bin/
 bin.includes = META-INF/,\
                lib/ast-cli-java-wrapper-2.4.31.jar,\
-               lib/jackson-core-2.21.4.jar,\
+               lib/jackson-core-2.21.7.jar,\
                lib/jackson-databind-2.21.5.jar,\
                lib/jackson-annotations-2.21.jar,\
                lib/slf4j-api-2.0.17.jar,\
diff --git a/common-lib/lib/jackson-core-2.21.4.jar b/common-lib/lib/jackson-core-2.21.4.jar
deleted file mode 100644
index d43b85b8..00000000
--- a/common-lib/lib/jackson-core-2.21.4.jar
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:4b40a06396f239f8de2da57419adde6e94e5edc18a2171d471ea05eeed4e5c2d
-size 594183
diff --git a/common-lib/lib/jackson-core-2.21.7.jar b/common-lib/lib/jackson-core-2.21.7.jar
new file mode 100644
index 00000000..591a9119
--- /dev/null
+++ b/common-lib/lib/jackson-core-2.21.7.jar
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8c5623b98f32d5f7e1287ff61ed50e08ab7b11381e991fff89327faabba42261
+size 594782
diff --git a/devassist-lib/.classpath b/devassist-lib/.classpath
index d011c85e..40a5ceb9 100644
--- a/devassist-lib/.classpath
+++ b/devassist-lib/.classpath
@@ -5,7 +5,7 @@
 	<classpathentry kind="src" path="src"/>
 	<classpathentry kind="lib" path="../common-lib/lib/ast-cli-java-wrapper-2.4.31.jar"/>
 	<classpathentry kind="lib" path="../common-lib/lib/commons-lang3-3.18.0.jar"/>
-	<classpathentry kind="lib" path="../common-lib/lib/jackson-core-2.21.4.jar"/>
+	<classpathentry kind="lib" path="../common-lib/lib/jackson-core-2.21.7.jar"/>
 	<classpathentry kind="lib" path="../common-lib/lib/jackson-databind-2.21.5.jar"/>
 	<classpathentry kind="lib" path="../common-lib/lib/jackson-annotations-2.21.jar"/>
 	<classpathentry kind="lib" path="../common-lib/lib/slf4j-api-2.0.17.jar"/>
diff --git a/devassist-lib/src/com/checkmarx/eclipse/devassist/configuration/McpSettingsInjector.java b/devassist-lib/src/com/checkmarx/eclipse/devassist/configuration/McpSettingsInjector.java
index 7b2dc6cc..0a5e8bb7 100644
--- a/devassist-lib/src/com/checkmarx/eclipse/devassist/configuration/McpSettingsInjector.java
+++ b/devassist-lib/src/com/checkmarx/eclipse/devassist/configuration/McpSettingsInjector.java
@@ -6,6 +6,8 @@
 import java.util.LinkedHashMap;
 import java.util.Map;
 import java.util.Objects;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import org.eclipse.core.runtime.preferences.IEclipsePreferences;
 import org.eclipse.core.runtime.preferences.InstanceScope;
@@ -54,6 +56,7 @@ public final class McpSettingsInjector {
 	private static final String LOG_TAG = "[MCP-INJECTOR]";
 	private static final ObjectMapper MAPPER = new ObjectMapper();
 	private static final String FALLBACK_BASE = "https://ast-master-components.dev.cxast.net";
+	private static final Pattern IAM_HOST_LABEL = Pattern.compile("(^|\\.)iam\\.");
 	private static final String SERVER_KEY = "checkmarx";
 	public static final String MCP_ENDPOINT = "/api/security-mcp/mcp";
 
@@ -297,7 +300,7 @@ private static String tryExtractIssuer(String rawToken) {
 	/**
 	 * Derives AST base URL from issuer claim.
 	 * If issuer is like https://iam.checkmarx.com, converts to
-	 * https://ast.checkmarx.com
+	 * https://ast.checkmarx.com; otherwise (single-tenant) uses the issuer host.
 	 */
 	private static String deriveBaseUrlFromIssuer(String issuer) {
 		if (issuer == null || issuer.isBlank()) {
@@ -309,15 +312,15 @@ private static String deriveBaseUrlFromIssuer(String issuer) {
 			CxLogger.info(LOG_TAG + " Deriving base URL from issuer: " + issuer);
 			String host = URI.create(issuer).getHost();
 
-			if (host != null && host.contains("iam.checkmarx")) {
-				String newHost = host.replace("iam", "ast");
-				String baseUrl = "https://" + newHost;
-				CxLogger.info(LOG_TAG + "Derived base URL: " + baseUrl);
-				return baseUrl;
+			if (host == null || host.isBlank()) {
+				CxLogger.info(LOG_TAG + " Issuer has no host, using fallback");
+				return FALLBACK_BASE;
 			}
 
-			CxLogger.info(LOG_TAG + " Host does not match iam.checkmarx pattern, using fallback");
-			return FALLBACK_BASE;
+			// Multi-tenant: swap only the "iam" host label (e.g. eu.iam.checkmarx.net -> eu.ast.checkmarx.net).
+			// Single-tenant: the issuer host is the tenant base URL.
+			Matcher iamLabel = IAM_HOST_LABEL.matcher(host);
+			return "https://" + (iamLabel.find() ? iamLabel.replaceFirst("$1ast.") : host);
 		} catch (Exception e) {
 			CxLogger.warning(LOG_TAG + " Failed to derive base URL from issuer: " + e.getMessage());
 			return FALLBACK_BASE;
diff --git a/mvnw b/mvnw
new file mode 100755
index 00000000..19529ddf
--- /dev/null
+++ b/mvnw
@@ -0,0 +1,259 @@
+#!/bin/sh
+# ----------------------------------------------------------------------------
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+# ----------------------------------------------------------------------------
+
+# ----------------------------------------------------------------------------
+# Apache Maven Wrapper startup batch script, version 3.3.2
+#
+# Optional ENV vars
+# -----------------
+#   JAVA_HOME - location of a JDK home dir, required when download maven via java source
+#   MVNW_REPOURL - repo url base for downloading maven distribution
+#   MVNW_USERNAME/MVNW_PASSWORD - user and password for downloading maven
+#   MVNW_VERBOSE - true: enable verbose log; debug: trace the mvnw script; others: silence the output
+# ----------------------------------------------------------------------------
+
+set -euf
+[ "${MVNW_VERBOSE-}" != debug ] || set -x
+
+# OS specific support.
+native_path() { printf %s\\n "$1"; }
+case "$(uname)" in
+CYGWIN* | MINGW*)
+  [ -z "${JAVA_HOME-}" ] || JAVA_HOME="$(cygpath --unix "$JAVA_HOME")"
+  native_path() { cygpath --path --windows "$1"; }
+  ;;
+esac
+
+# set JAVACMD and JAVACCMD
+set_java_home() {
+  # For Cygwin and MinGW, ensure paths are in Unix format before anything is touched
+  if [ -n "${JAVA_HOME-}" ]; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ]; then
+      # IBM's JDK on AIX uses strange locations for the executables
+      JAVACMD="$JAVA_HOME/jre/sh/java"
+      JAVACCMD="$JAVA_HOME/jre/sh/javac"
+    else
+      JAVACMD="$JAVA_HOME/bin/java"
+      JAVACCMD="$JAVA_HOME/bin/javac"
+
+      if [ ! -x "$JAVACMD" ] || [ ! -x "$JAVACCMD" ]; then
+        echo "The JAVA_HOME environment variable is not defined correctly, so mvnw cannot run." >&2
+        echo "JAVA_HOME is set to \"$JAVA_HOME\", but \"\$JAVA_HOME/bin/java\" or \"\$JAVA_HOME/bin/javac\" does not exist." >&2
+        return 1
+      fi
+    fi
+  else
+    JAVACMD="$(
+      'set' +e
+      'unset' -f command 2>/dev/null
+      'command' -v java
+    )" || :
+    JAVACCMD="$(
+      'set' +e
+      'unset' -f command 2>/dev/null
+      'command' -v javac
+    )" || :
+
+    if [ ! -x "${JAVACMD-}" ] || [ ! -x "${JAVACCMD-}" ]; then
+      echo "The java/javac command does not exist in PATH nor is JAVA_HOME set, so mvnw cannot run." >&2
+      return 1
+    fi
+  fi
+}
+
+# hash string like Java String::hashCode
+hash_string() {
+  str="${1:-}" h=0
+  while [ -n "$str" ]; do
+    char="${str%"${str#?}"}"
+    h=$(((h * 31 + $(LC_CTYPE=C printf %d "'$char")) % 4294967296))
+    str="${str#?}"
+  done
+  printf %x\\n $h
+}
+
+verbose() { :; }
+[ "${MVNW_VERBOSE-}" != true ] || verbose() { printf %s\\n "${1-}"; }
+
+die() {
+  printf %s\\n "$1" >&2
+  exit 1
+}
+
+trim() {
+  # MWRAPPER-139:
+  #   Trims trailing and leading whitespace, carriage returns, tabs, and linefeeds.
+  #   Needed for removing poorly interpreted newline sequences when running in more
+  #   exotic environments such as mingw bash on Windows.
+  printf "%s" "${1}" | tr -d '[:space:]'
+}
+
+# parse distributionUrl and optional distributionSha256Sum, requires .mvn/wrapper/maven-wrapper.properties
+while IFS="=" read -r key value; do
+  case "${key-}" in
+  distributionUrl) distributionUrl=$(trim "${value-}") ;;
+  distributionSha256Sum) distributionSha256Sum=$(trim "${value-}") ;;
+  esac
+done <"${0%/*}/.mvn/wrapper/maven-wrapper.properties"
+[ -n "${distributionUrl-}" ] || die "cannot read distributionUrl property in ${0%/*}/.mvn/wrapper/maven-wrapper.properties"
+
+case "${distributionUrl##*/}" in
+maven-mvnd-*bin.*)
+  MVN_CMD=mvnd.sh _MVNW_REPO_PATTERN=/maven/mvnd/
+  case "${PROCESSOR_ARCHITECTURE-}${PROCESSOR_ARCHITEW6432-}:$(uname -a)" in
+  *AMD64:CYGWIN* | *AMD64:MINGW*) distributionPlatform=windows-amd64 ;;
+  :Darwin*x86_64) distributionPlatform=darwin-amd64 ;;
+  :Darwin*arm64) distributionPlatform=darwin-aarch64 ;;
+  :Linux*x86_64*) distributionPlatform=linux-amd64 ;;
+  *)
+    echo "Cannot detect native platform for mvnd on $(uname)-$(uname -m), use pure java version" >&2
+    distributionPlatform=linux-amd64
+    ;;
+  esac
+  distributionUrl="${distributionUrl%-bin.*}-$distributionPlatform.zip"
+  ;;
+maven-mvnd-*) MVN_CMD=mvnd.sh _MVNW_REPO_PATTERN=/maven/mvnd/ ;;
+*) MVN_CMD="mvn${0##*/mvnw}" _MVNW_REPO_PATTERN=/org/apache/maven/ ;;
+esac
+
+# apply MVNW_REPOURL and calculate MAVEN_HOME
+# maven home pattern: ~/.m2/wrapper/dists/{apache-maven-<version>,maven-mvnd-<version>-<platform>}/<hash>
+[ -z "${MVNW_REPOURL-}" ] || distributionUrl="$MVNW_REPOURL$_MVNW_REPO_PATTERN${distributionUrl#*"$_MVNW_REPO_PATTERN"}"
+distributionUrlName="${distributionUrl##*/}"
+distributionUrlNameMain="${distributionUrlName%.*}"
+distributionUrlNameMain="${distributionUrlNameMain%-bin}"
+MAVEN_USER_HOME="${MAVEN_USER_HOME:-${HOME}/.m2}"
+MAVEN_HOME="${MAVEN_USER_HOME}/wrapper/dists/${distributionUrlNameMain-}/$(hash_string "$distributionUrl")"
+
+exec_maven() {
+  unset MVNW_VERBOSE MVNW_USERNAME MVNW_PASSWORD MVNW_REPOURL || :
+  exec "$MAVEN_HOME/bin/$MVN_CMD" "$@" || die "cannot exec $MAVEN_HOME/bin/$MVN_CMD"
+}
+
+if [ -d "$MAVEN_HOME" ]; then
+  verbose "found existing MAVEN_HOME at $MAVEN_HOME"
+  exec_maven "$@"
+fi
+
+case "${distributionUrl-}" in
+*?-bin.zip | *?maven-mvnd-?*-?*.zip) ;;
+*) die "distributionUrl is not valid, must match *-bin.zip or maven-mvnd-*.zip, but found '${distributionUrl-}'" ;;
+esac
+
+# prepare tmp dir
+if TMP_DOWNLOAD_DIR="$(mktemp -d)" && [ -d "$TMP_DOWNLOAD_DIR" ]; then
+  clean() { rm -rf -- "$TMP_DOWNLOAD_DIR"; }
+  trap clean HUP INT TERM EXIT
+else
+  die "cannot create temp dir"
+fi
+
+mkdir -p -- "${MAVEN_HOME%/*}"
+
+# Download and Install Apache Maven
+verbose "Couldn't find MAVEN_HOME, downloading and installing it ..."
+verbose "Downloading from: $distributionUrl"
+verbose "Downloading to: $TMP_DOWNLOAD_DIR/$distributionUrlName"
+
+# select .zip or .tar.gz
+if ! command -v unzip >/dev/null; then
+  distributionUrl="${distributionUrl%.zip}.tar.gz"
+  distributionUrlName="${distributionUrl##*/}"
+fi
+
+# verbose opt
+__MVNW_QUIET_WGET=--quiet __MVNW_QUIET_CURL=--silent __MVNW_QUIET_UNZIP=-q __MVNW_QUIET_TAR=''
+[ "${MVNW_VERBOSE-}" != true ] || __MVNW_QUIET_WGET='' __MVNW_QUIET_CURL='' __MVNW_QUIET_UNZIP='' __MVNW_QUIET_TAR=v
+
+# normalize http auth
+case "${MVNW_PASSWORD:+has-password}" in
+'') MVNW_USERNAME='' MVNW_PASSWORD='' ;;
+has-password) [ -n "${MVNW_USERNAME-}" ] || MVNW_USERNAME='' MVNW_PASSWORD='' ;;
+esac
+
+if [ -z "${MVNW_USERNAME-}" ] && command -v wget >/dev/null; then
+  verbose "Found wget ... using wget"
+  wget ${__MVNW_QUIET_WGET:+"$__MVNW_QUIET_WGET"} "$distributionUrl" -O "$TMP_DOWNLOAD_DIR/$distributionUrlName" || die "wget: Failed to fetch $distributionUrl"
+elif [ -z "${MVNW_USERNAME-}" ] && command -v curl >/dev/null; then
+  verbose "Found curl ... using curl"
+  curl ${__MVNW_QUIET_CURL:+"$__MVNW_QUIET_CURL"} -f -L -o "$TMP_DOWNLOAD_DIR/$distributionUrlName" "$distributionUrl" || die "curl: Failed to fetch $distributionUrl"
+elif set_java_home; then
+  verbose "Falling back to use Java to download"
+  javaSource="$TMP_DOWNLOAD_DIR/Downloader.java"
+  targetZip="$TMP_DOWNLOAD_DIR/$distributionUrlName"
+  cat >"$javaSource" <<-END
+	public class Downloader extends java.net.Authenticator
+	{
+	  protected java.net.PasswordAuthentication getPasswordAuthentication()
+	  {
+	    return new java.net.PasswordAuthentication( System.getenv( "MVNW_USERNAME" ), System.getenv( "MVNW_PASSWORD" ).toCharArray() );
+	  }
+	  public static void main( String[] args ) throws Exception
+	  {
+	    setDefault( new Downloader() );
+	    java.nio.file.Files.copy( java.net.URI.create( args[0] ).toURL().openStream(), java.nio.file.Paths.get( args[1] ).toAbsolutePath().normalize() );
+	  }
+	}
+	END
+  # For Cygwin/MinGW, switch paths to Windows format before running javac and java
+  verbose " - Compiling Downloader.java ..."
+  "$(native_path "$JAVACCMD")" "$(native_path "$javaSource")" || die "Failed to compile Downloader.java"
+  verbose " - Running Downloader.java ..."
+  "$(native_path "$JAVACMD")" -cp "$(native_path "$TMP_DOWNLOAD_DIR")" Downloader "$distributionUrl" "$(native_path "$targetZip")"
+fi
+
+# If specified, validate the SHA-256 sum of the Maven distribution zip file
+if [ -n "${distributionSha256Sum-}" ]; then
+  distributionSha256Result=false
+  if [ "$MVN_CMD" = mvnd.sh ]; then
+    echo "Checksum validation is not supported for maven-mvnd." >&2
+    echo "Please disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties." >&2
+    exit 1
+  elif command -v sha256sum >/dev/null; then
+    if echo "$distributionSha256Sum  $TMP_DOWNLOAD_DIR/$distributionUrlName" | sha256sum -c >/dev/null 2>&1; then
+      distributionSha256Result=true
+    fi
+  elif command -v shasum >/dev/null; then
+    if echo "$distributionSha256Sum  $TMP_DOWNLOAD_DIR/$distributionUrlName" | shasum -a 256 -c >/dev/null 2>&1; then
+      distributionSha256Result=true
+    fi
+  else
+    echo "Checksum validation was requested but neither 'sha256sum' or 'shasum' are available." >&2
+    echo "Please install either command, or disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties." >&2
+    exit 1
+  fi
+  if [ $distributionSha256Result = false ]; then
+    echo "Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised." >&2
+    echo "If you updated your Maven version, you need to update the specified distributionSha256Sum property." >&2
+    exit 1
+  fi
+fi
+
+# unzip and move
+if command -v unzip >/dev/null; then
+  unzip ${__MVNW_QUIET_UNZIP:+"$__MVNW_QUIET_UNZIP"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -d "$TMP_DOWNLOAD_DIR" || die "failed to unzip"
+else
+  tar xzf${__MVNW_QUIET_TAR:+"$__MVNW_QUIET_TAR"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -C "$TMP_DOWNLOAD_DIR" || die "failed to untar"
+fi
+printf %s\\n "$distributionUrl" >"$TMP_DOWNLOAD_DIR/$distributionUrlNameMain/mvnw.url"
+mv -- "$TMP_DOWNLOAD_DIR/$distributionUrlNameMain" "$MAVEN_HOME" || [ -d "$MAVEN_HOME" ] || die "fail to move MAVEN_HOME"
+
+clean || :
+exec_maven "$@"
diff --git a/mvnw.cmd b/mvnw.cmd
new file mode 100644
index 00000000..249bdf38
--- /dev/null
+++ b/mvnw.cmd
@@ -0,0 +1,149 @@
+<# : batch portion
+@REM ----------------------------------------------------------------------------
+@REM Licensed to the Apache Software Foundation (ASF) under one
+@REM or more contributor license agreements.  See the NOTICE file
+@REM distributed with this work for additional information
+@REM regarding copyright ownership.  The ASF licenses this file
+@REM to you under the Apache License, Version 2.0 (the
+@REM "License"); you may not use this file except in compliance
+@REM with the License.  You may obtain a copy of the License at
+@REM
+@REM    http://www.apache.org/licenses/LICENSE-2.0
+@REM
+@REM Unless required by applicable law or agreed to in writing,
+@REM software distributed under the License is distributed on an
+@REM "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+@REM KIND, either express or implied.  See the License for the
+@REM specific language governing permissions and limitations
+@REM under the License.
+@REM ----------------------------------------------------------------------------
+
+@REM ----------------------------------------------------------------------------
+@REM Apache Maven Wrapper startup batch script, version 3.3.2
+@REM
+@REM Optional ENV vars
+@REM   MVNW_REPOURL - repo url base for downloading maven distribution
+@REM   MVNW_USERNAME/MVNW_PASSWORD - user and password for downloading maven
+@REM   MVNW_VERBOSE - true: enable verbose log; others: silence the output
+@REM ----------------------------------------------------------------------------
+
+@IF "%__MVNW_ARG0_NAME__%"=="" (SET __MVNW_ARG0_NAME__=%~nx0)
+@SET __MVNW_CMD__=
+@SET __MVNW_ERROR__=
+@SET __MVNW_PSMODULEP_SAVE=%PSModulePath%
+@SET PSModulePath=
+@FOR /F "usebackq tokens=1* delims==" %%A IN (`powershell -noprofile "& {$scriptDir='%~dp0'; $script='%__MVNW_ARG0_NAME__%'; icm -ScriptBlock ([Scriptblock]::Create((Get-Content -Raw '%~f0'))) -NoNewScope}"`) DO @(
+  IF "%%A"=="MVN_CMD" (set __MVNW_CMD__=%%B) ELSE IF "%%B"=="" (echo %%A) ELSE (echo %%A=%%B)
+)
+@SET PSModulePath=%__MVNW_PSMODULEP_SAVE%
+@SET __MVNW_PSMODULEP_SAVE=
+@SET __MVNW_ARG0_NAME__=
+@SET MVNW_USERNAME=
+@SET MVNW_PASSWORD=
+@IF NOT "%__MVNW_CMD__%"=="" (%__MVNW_CMD__% %*)
+@echo Cannot start maven from wrapper >&2 && exit /b 1
+@GOTO :EOF
+: end batch / begin powershell #>
+
+$ErrorActionPreference = "Stop"
+if ($env:MVNW_VERBOSE -eq "true") {
+  $VerbosePreference = "Continue"
+}
+
+# calculate distributionUrl, requires .mvn/wrapper/maven-wrapper.properties
+$distributionUrl = (Get-Content -Raw "$scriptDir/.mvn/wrapper/maven-wrapper.properties" | ConvertFrom-StringData).distributionUrl
+if (!$distributionUrl) {
+  Write-Error "cannot read distributionUrl property in $scriptDir/.mvn/wrapper/maven-wrapper.properties"
+}
+
+switch -wildcard -casesensitive ( $($distributionUrl -replace '^.*/','') ) {
+  "maven-mvnd-*" {
+    $USE_MVND = $true
+    $distributionUrl = $distributionUrl -replace '-bin\.[^.]*$',"-windows-amd64.zip"
+    $MVN_CMD = "mvnd.cmd"
+    break
+  }
+  default {
+    $USE_MVND = $false
+    $MVN_CMD = $script -replace '^mvnw','mvn'
+    break
+  }
+}
+
+# apply MVNW_REPOURL and calculate MAVEN_HOME
+# maven home pattern: ~/.m2/wrapper/dists/{apache-maven-<version>,maven-mvnd-<version>-<platform>}/<hash>
+if ($env:MVNW_REPOURL) {
+  $MVNW_REPO_PATTERN = if ($USE_MVND) { "/org/apache/maven/" } else { "/maven/mvnd/" }
+  $distributionUrl = "$env:MVNW_REPOURL$MVNW_REPO_PATTERN$($distributionUrl -replace '^.*'+$MVNW_REPO_PATTERN,'')"
+}
+$distributionUrlName = $distributionUrl -replace '^.*/',''
+$distributionUrlNameMain = $distributionUrlName -replace '\.[^.]*$','' -replace '-bin$',''
+$MAVEN_HOME_PARENT = "$HOME/.m2/wrapper/dists/$distributionUrlNameMain"
+if ($env:MAVEN_USER_HOME) {
+  $MAVEN_HOME_PARENT = "$env:MAVEN_USER_HOME/wrapper/dists/$distributionUrlNameMain"
+}
+$MAVEN_HOME_NAME = ([System.Security.Cryptography.MD5]::Create().ComputeHash([byte[]][char[]]$distributionUrl) | ForEach-Object {$_.ToString("x2")}) -join ''
+$MAVEN_HOME = "$MAVEN_HOME_PARENT/$MAVEN_HOME_NAME"
+
+if (Test-Path -Path "$MAVEN_HOME" -PathType Container) {
+  Write-Verbose "found existing MAVEN_HOME at $MAVEN_HOME"
+  Write-Output "MVN_CMD=$MAVEN_HOME/bin/$MVN_CMD"
+  exit $?
+}
+
+if (! $distributionUrlNameMain -or ($distributionUrlName -eq $distributionUrlNameMain)) {
+  Write-Error "distributionUrl is not valid, must end with *-bin.zip, but found $distributionUrl"
+}
+
+# prepare tmp dir
+$TMP_DOWNLOAD_DIR_HOLDER = New-TemporaryFile
+$TMP_DOWNLOAD_DIR = New-Item -Itemtype Directory -Path "$TMP_DOWNLOAD_DIR_HOLDER.dir"
+$TMP_DOWNLOAD_DIR_HOLDER.Delete() | Out-Null
+trap {
+  if ($TMP_DOWNLOAD_DIR.Exists) {
+    try { Remove-Item $TMP_DOWNLOAD_DIR -Recurse -Force | Out-Null }
+    catch { Write-Warning "Cannot remove $TMP_DOWNLOAD_DIR" }
+  }
+}
+
+New-Item -Itemtype Directory -Path "$MAVEN_HOME_PARENT" -Force | Out-Null
+
+# Download and Install Apache Maven
+Write-Verbose "Couldn't find MAVEN_HOME, downloading and installing it ..."
+Write-Verbose "Downloading from: $distributionUrl"
+Write-Verbose "Downloading to: $TMP_DOWNLOAD_DIR/$distributionUrlName"
+
+$webclient = New-Object System.Net.WebClient
+if ($env:MVNW_USERNAME -and $env:MVNW_PASSWORD) {
+  $webclient.Credentials = New-Object System.Net.NetworkCredential($env:MVNW_USERNAME, $env:MVNW_PASSWORD)
+}
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+$webclient.DownloadFile($distributionUrl, "$TMP_DOWNLOAD_DIR/$distributionUrlName") | Out-Null
+
+# If specified, validate the SHA-256 sum of the Maven distribution zip file
+$distributionSha256Sum = (Get-Content -Raw "$scriptDir/.mvn/wrapper/maven-wrapper.properties" | ConvertFrom-StringData).distributionSha256Sum
+if ($distributionSha256Sum) {
+  if ($USE_MVND) {
+    Write-Error "Checksum validation is not supported for maven-mvnd. `nPlease disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties."
+  }
+  Import-Module $PSHOME\Modules\Microsoft.PowerShell.Utility -Function Get-FileHash
+  if ((Get-FileHash "$TMP_DOWNLOAD_DIR/$distributionUrlName" -Algorithm SHA256).Hash.ToLower() -ne $distributionSha256Sum) {
+    Write-Error "Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised. If you updated your Maven version, you need to update the specified distributionSha256Sum property."
+  }
+}
+
+# unzip and move
+Expand-Archive "$TMP_DOWNLOAD_DIR/$distributionUrlName" -DestinationPath "$TMP_DOWNLOAD_DIR" | Out-Null
+Rename-Item -Path "$TMP_DOWNLOAD_DIR/$distributionUrlNameMain" -NewName $MAVEN_HOME_NAME | Out-Null
+try {
+  Move-Item -Path "$TMP_DOWNLOAD_DIR/$MAVEN_HOME_NAME" -Destination $MAVEN_HOME_PARENT | Out-Null
+} catch {
+  if (! (Test-Path -Path "$MAVEN_HOME" -PathType Container)) {
+    Write-Error "fail to move MAVEN_HOME"
+  }
+} finally {
+  try { Remove-Item $TMP_DOWNLOAD_DIR -Recurse -Force | Out-Null }
+  catch { Write-Warning "Cannot remove $TMP_DOWNLOAD_DIR" }
+}
+
+Write-Output "MVN_CMD=$MAVEN_HOME/bin/$MVN_CMD"