Back to MCP Trust Indexm8ven
66
/ 100
1 month ago
glama

jira-mcp

MCP server for Jira Cloud tailored for ALM projects with Zephyr Scale integration, enabling issue management, sprint tracking, and test step operations.

→ nayzo/jira-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
2 flows detected: ZAPI_ACCESS_KEY. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 5 credentials: JIRA_API_TOKEN, JIRA_PROJECT_KEY, TICKET_KEY, ZAPI_ACCESS_KEY, ZAPI_SECRET_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies2 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.7.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.7.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAUTO_CREATE_TEST_TICKETS— Auto-create Test ticket when a Story has points (default: true)
configJIRA_ACCEPTANCE_CRITERIA_FIELD
configJIRA_ALTERNATE_CATEGORY_ID
configJIRA_ALTERNATE_CATEGORY_VALUE
🔐 secretJIRA_API_TOKEN— ✅ API token from [id.atlassian.com](https://id.atlassian.com/manage-profile/security/api-tokens)
configJIRA_CATEGORY_FIELD
configJIRA_CRISIS_FIELD
configJIRA_CRISIS_NO_ID
configJIRA_CRISIS_YES_ID
configJIRA_DEFAULT_ASSIGNEE_ACCOUNT_ID
configJIRA_DEFAULT_CATEGORY_ID
configJIRA_DEFAULT_CATEGORY_VALUE
configJIRA_EPIC_LINK_FIELD
configJIRA_HOST— ✅ e.g. your-company.atlassian.net
configJIRA_PRODUCT_FIELD
configJIRA_PRODUCT_ID
configJIRA_PRODUCT_VALUE
🔐 secretJIRA_PROJECT_KEY— ✅ e.g. ALM
configJIRA_STORY_POINTS_FIELD
configJIRA_STORY_READINESS_FIELD
configJIRA_STORY_READINESS_NO_ID
configJIRA_STORY_READINESS_YES_ID
configJIRA_USERNAME— ✅ Your Atlassian email
🔐 secretTICKET_KEY
configUSE_ALTERNATE_CATEGORY
🔐 secretZAPI_ACCESS_KEY
configZAPI_ACCOUNT_ID
configZAPI_BASE_URL
🔐 secretZAPI_SECRET_KEY
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/nayzo-jira-mcp-1crqrf)](https://m8ven.ai/mcp/nayzo-jira-mcp-1crqrf)
commit: ba2769cd3548b244a92c06ded56d5409d275472e
code hash: 168f442e2409df56c4acd6eaa2d64e2aded9c291c48153adefde83b9136e51bd
verified: 6/22/2026, 12:10:53 PM
view raw JSON →