Jira Api Mcp Wrapper — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Jira Api Mcp Wrapper (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 6 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 6 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server (stdio) that talks directly to Jira Cloud REST API v3 using static credentials (no OAuth flow) and exposes a small set of deterministic tools for:
customfield_* IDsaccountId for user picker fieldsUnit and Contract Tests (default, no network):
npm testThis runs all unit tests and contract tests without making any network calls. These tests use mocked HTTP clients and are deterministic.
Integration Tests (requires Jira credentials):
Integration tests make real HTTP calls to Jira Cloud. They are split into read-only (smoke) and write tests.
Read-only smoke tests:
npm run test:integration:smokeRequires:
JIRA_BASE_URL (or JIRA_URL)JIRA_EMAIL and JIRA_API_TOKEN, OR JIRA_BEARER_TOKENOptional variables:
JIRA_TEST_USER_QUERY: User search queryJIRA_TEST_JQL: JQL query for search testJIRA_TEST_ISSUE_KEY: Issue key for get/transitions testsWrite tests (creates real data):
JIRA_INTEGRATION_WRITE_TESTS=1 npm run test:integration:writeRequires:
JIRA_TEST_PROJECT_KEY: Project key for creating test issuesJIRA_TEST_TRANSITION_ID (optional): Transition ID for transition test⚠️ Warning: Write tests create real issues and comments in your Jira instance. They use the tag [mcp-wrapper-test] in summaries for easy identification and cleanup.
All integration tests:
npm run test:integrationtests/unit/: Unit tests for individual components (no network)tests/contract/: Contract tests for MCP tool handlers (no network, uses fake Jira client)tests/integration/smoke.test.js: Read-only integration teststests/integration/write.test.js: Write integration tests (guarded by env var)Set environment variables (pick one auth method):
ga-jira/mcp.jsonJIRA_URL → `JIRA_BASE_URL` (same value)JIRA_EMAIL → JIRA_EMAILJIRA_API_TOKEN → JIRA_API_TOKENJIRA_BASE_URL (example: https://your-domain.atlassian.net)JIRA_EMAIL (example: [email protected])JIRA_API_TOKEN (create in Atlassian account settings)JIRA_BASE_URLJIRA_BEARER_TOKENAdd to your Cursor MCP config (typically ~/.cursor/mcp.json):
{
"mcpServers": {
"jira-api-mcp-wrapper": {
"command": "node",
"args": [
"/path/to/jira-api-mcp-wrapper/dist/index.js"
],
"env": {
"JIRA_BASE_URL": "https://your-domain.atlassian.net",
"JIRA_EMAIL": "[email protected]",
"JIRA_API_TOKEN": "your_api_token"
}
}
}
}jira_list_fieldsLists Jira fields (including customfield_*) via /rest/api/3/field.
jira_search_issues_jqlSearch issues using JQL via /rest/api/3/search.
jira_create_issueCreate an issue via /rest/api/3/issue (provide fields including project + issuetype + summary, plus any customfield_*).
jira_search_usersSearches users and returns accountId candidates via /rest/api/3/user/search.
jira_resolve_user_account_idResolves a best-match user and returns the chosen accountId (useful for user picker custom fields).
jira_get_issueFetches an issue via /rest/api/3/issue/{key}.
jira_update_issue_fieldsUpdates issue fields via /rest/api/3/issue/{key} PUT.
customfield_* updatesdescription and some multi-line custom fields)notifyUsersoverrideScreenSecurityoverrideEditableFlagvalidateAdf (default true)jira_add_commentAdd a comment via /rest/api/3/issue/{key}/comment (wrapper accepts plain text or ADF doc).
jira_get_transitionsList available transitions via /rest/api/3/issue/{key}/transitions.
jira_transition_issueApply a transition via /rest/api/3/issue/{key}/transitions (use jira_get_transitions to find transitionId).
jira_bulk_create_issuesBulk create issues via POST /rest/api/3/issue/bulk.
Input is an array of issueUpdates entries, each with:
fields: issue creation fields (must include project, issuetype, summary, etc.)update (optional): Jira update objectjira_bulk_get_editable_fieldsGet the bulk-editable field IDs for a set of issues via GET /rest/api/3/bulk/issues/fields.
Use the returned field IDs as selectedActions for jira_bulk_edit_issues.
jira_bulk_edit_issuesBulk edit issues via POST /rest/api/3/bulk/issues/fields.
Requires:
selectedIssueIdsOrKeys: issue IDs or keys to editselectedActions: field IDs to edit (use jira_bulk_get_editable_fields)editedFieldsInput: object containing values to apply (must align with selectedActions)customfield_10246)1) Resolve accountId:
jira_resolve_user_account_id with query="[email protected]"2) Update the issue:
jira_update_issue_fields with:issueKey="WOR-2367"fields={ "customfield_10246": { "accountId": "<accountId>" } }If your local record already stores ADF JSON, send it directly as the field value (must include type:"doc", version, and content).
accountId (not email).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.