jira-mcp
Enables issue search, creation, updates, comments, status transitions, and project listing in Jira, purpose-built for security incident management and SOC workflows.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
TocharianOU
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
jira_health_checkTest the Jira connection. Returns authenticated account info (display name, email, account ID) and Jira server version/deployment type. Run first to verify credentials and connectivity.
search_issuesSearch Jira issues using JQL (Jira Query Language). Returns key, summary, status, type, priority, assignee, reporter, created/updated dates and labels. Use for finding security incidents, open vulnerabilities, or tracking remediation tasks. Examples: `project = SEC AND status != Done`, `assignee = c…
get_issueGet full details of a single Jira issue by key (e.g. SEC-123). Returns description, all comments, status, priority, assignee, reporter, labels, and timestamps. Use after search_issues to inspect a specific issue in depth.
create_issueCreate a new Jira issue. Use to file security incidents, vulnerabilities, or remediation tasks. Returns the new issue key and URL. Common issue types: Task, Bug, Story, Incident, Security Incident (depends on project configuration).
update_issueUpdate fields of an existing Jira issue (summary, description, priority, labels). Use to enrich a security incident with investigation findings. To change status, use transition_issue instead.
add_commentAdd a comment to a Jira issue. Use to record investigation steps, evidence, findings, or remediation actions directly on the ticket. Preserves the full audit trail of the security response.
list_transitionsList all available status transitions for a Jira issue. Returns transition IDs and target status names. Use before transition_issue to find the correct transition ID (e.g. "In Progress", "Resolved", "Closed").
transition_issueMove a Jira issue to a new status using a transition ID. Use list_transitions first to discover available transition IDs. Optionally attach a comment explaining the status change (e.g. "Closed: investigation complete, no compromise confirmed").
list_projectsList all accessible Jira projects with their keys, names, and types. Use to find the correct project key before creating issues or running JQL queries scoped to a specific project.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Axios is vulnerable to DoS attack through lack of data size check
Axios: Header Injection via Prototype Pollution
JIRA_API_VERSION3 for Cloud (default), 2 for Server/Data CenterJIRA_EMAIL"": "you@company.com",JIRA_HOST"": "https://yourorg.atlassian.net",JIRA_TIMEOUTJIRA_TOKEN"": "<your-api-token>"JIRA_VERIFY_SSLtrue/false (default: true)MAX_TOKEN_CALLToken limiting — built-in guard prevents context overflowMCP_HTTP_PORTMCP_TRANSPORT=http =3002 JIRA_HOST=https://yourorg.atlassian.net JIRA_EMAIL=you@company.com JIRA_TOKEN=<token> npx @tocharianou/jira-mcpMCP_TRANSPORThttp MCP_HTTP_PORT=3002 JIRA_HOST=https://yourorg.atlassian.net JIRA_EMAIL=you@company.com JIRA_TOKEN=<token> npx @tocharianou/jira-mcpTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
9/9 tools missing one or more hints — jira_health_check (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); search_issues (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_issue (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +6 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 16 high severity in production deps — axios@1.8.4 (high), axios@1.8.4 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dependency freshness
1/8 production deps stale: https@2022-06-18 (4y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/tocharianou/jira-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check