Jira Attachment Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Jira Attachment Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A tiny local MCP server that fetches Jira attachments and returns them to an MCP client such as Claude Code.
model can see them directly.
~/.cache/jira-attachment-mcp/ and the local path is returned.
It runs over stdio and exposes a single tool, jira_get_attachment, which takes a numeric Jira attachment ID.
npm install
node setup.jssetup.js prompts for your Atlassian email, API token, and Jira base URL (e.g. https://your-company.atlassian.net), then writes them to ~/.config/jira-attachment-mcp/config.json with 0600 permissions.
Then register the server with Claude Code (use the absolute path to index.js):
claude mcp add --transport stdio jira-attach -- node /absolute/path/to/index.jsRestart Claude Code (or reload MCP servers) so the new server is picked up.
Your credentials never leave your machine and are never committed: they live only in ~/.config/jira-attachment-mcp/config.json (mode 0600). The token is used solely to build the HTTP Basic auth header for requests to your own Jira instance.
MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.