MCP server that connects AI assistants to your Jira site, supporting PAT or SSO authentication for search, read, create, update, and delete operations on issues.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate
process.env. You'll be asked to provide them before it can run.CONFLUENCE_API_TOKEN— CONFLUENCE_PAT or Confluence PAT; same “host config only” rule as Jira PATs.CONFLUENCE_BASE_URL— add_attachment_from_confluence Pull a named attachment from a Confluence page (needs and Confluence PAT or cookies) and attach it to a Jira issue.CONFLUENCE_MCP_SERVER_KEY— Optional; used to name the Confluence cookie file for add_attachment_from_confluence (cookies/cf-<key>.json) so it aligns with your Confluence MCP server id.CONFLUENCE_PAT— or CONFLUENCE_API_TOKEN Confluence PAT; same “host config only” rule as Jira PATs.JIRA_API_TOKEN— JIRA_PAT or PAT or API token your site provides; sent as Authorization: Bearer. Read from the MCP host env (for example mcp.json), not from the project .env (ignored for these keys on purpose).JIRA_BASE_URL— 2. You set at least (and optionally JIRA_PAT) in that config’s env block.JIRA_DEFAULT_PROJECT— Default project key when create_ticket is called without project / boardName / boardId and board-based resolution is ambiguous or unavailable.JIRA_DESCRIPTION_FORMAT— auto (default: plain string for v2, ADF for v3), adf, or plain — overrides description encoding if your site differs.JIRA_LOGIN_POLL_MS— During jira_login, how often to probe /rest/api/.../myself so login can finish early (default 2000 ms).JIRA_LOGIN_URL— Login page URL (default {JIRA_BASE_URL}/login.jsp).JIRA_LOGIN_WAIT_SECONDS— 3. Complete login in the opened browser; wait until the tool finishes (up to , default 90).JIRA_MAX_ATTACHMENT_BYTES— Max upload size in bytes (default 10 MiB).JIRA_MCP_SERVER_KEY— If several MCP entries share the same path to src/index.js, set this to that entry’s id (e.g. jira-local) so merge/PAT discovery matches the right block.JIRA_PAT— 2. You set at least JIRA_BASE_URL (and optionally ) in that config’s env block.JIRA_REST_API_PREFIX— REST base path (default /rest/api/3). Use /rest/api/2 if your server only exposes v2.PREFER_SSO_COOKIES— Default on: if an SSO cookie file exists, only cookies are sent (not PAT). Set 0 / false for PAT-first. Delete the cookie file or set this to 0 to force PAT.[](https://m8ven.ai/mcp/wasim-shaikh25-jira-mcp-auth-wanbes)