46
/ 100
1 month ago
glama

Jira MCP OAuth gateway

MCP server that connects AI assistants to your Jira site, supporting PAT or SSO authentication for search, read, create, update, and delete operations on issues.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
⚠️
Tests do not pass
Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 4 credentials: CONFLUENCE_API_TOKEN, CONFLUENCE_MCP_SERVER_KEY, JIRA_API_TOKEN, JIRA_MCP_SERVER_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highplaywright@1.43.0GHSA-7mvr-c777-76hp

Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretCONFLUENCE_API_TOKENCONFLUENCE_PAT or Confluence PAT; same “host config only” rule as Jira PATs.
configCONFLUENCE_BASE_URLadd_attachment_from_confluence Pull a named attachment from a Confluence page (needs and Confluence PAT or cookies) and attach it to a Jira issue.
🔐 secretCONFLUENCE_MCP_SERVER_KEYOptional; used to name the Confluence cookie file for add_attachment_from_confluence (cookies/cf-<key>.json) so it aligns with your Confluence MCP server id.
configCONFLUENCE_PATor CONFLUENCE_API_TOKEN Confluence PAT; same “host config only” rule as Jira PATs.
🔐 secretJIRA_API_TOKENJIRA_PAT or PAT or API token your site provides; sent as Authorization: Bearer. Read from the MCP host env (for example mcp.json), not from the project .env (ignored for these keys on purpose).
configJIRA_BASE_URL2. You set at least (and optionally JIRA_PAT) in that config’s env block.
configJIRA_DEFAULT_PROJECTDefault project key when create_ticket is called without project / boardName / boardId and board-based resolution is ambiguous or unavailable.
configJIRA_DESCRIPTION_FORMATauto (default: plain string for v2, ADF for v3), adf, or plain — overrides description encoding if your site differs.
configJIRA_LOGIN_POLL_MSDuring jira_login, how often to probe /rest/api/.../myself so login can finish early (default 2000 ms).
configJIRA_LOGIN_URLLogin page URL (default {JIRA_BASE_URL}/login.jsp).
configJIRA_LOGIN_WAIT_SECONDS3. Complete login in the opened browser; wait until the tool finishes (up to , default 90).
configJIRA_MAX_ATTACHMENT_BYTESMax upload size in bytes (default 10 MiB).
🔐 secretJIRA_MCP_SERVER_KEYIf several MCP entries share the same path to src/index.js, set this to that entry’s id (e.g. jira-local) so merge/PAT discovery matches the right block.
configJIRA_PAT2. You set at least JIRA_BASE_URL (and optionally ) in that config’s env block.
configJIRA_REST_API_PREFIXREST base path (default /rest/api/3). Use /rest/api/2 if your server only exposes v2.
configPREFER_SSO_COOKIESDefault on: if an SSO cookie file exists, only cookies are sent (not PAT). Set 0 / false for PAT-first. Delete the cookie file or set this to 0 to force PAT.
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/wasim-shaikh25-jira-mcp-auth-wanbes)](https://m8ven.ai/mcp/wasim-shaikh25-jira-mcp-auth-wanbes)
commit: 5c2bcc1a51bcdd12dfb3983ee71b63ba6ece76f4
code hash: 8c6f01cd08f5cec27051ed5c4811de944123bc6b43e6c0faeaf7e8f09489577e
verified: 6/21/2026, 10:13:29 AM
view raw JSON →