Jira Digest Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Jira Digest Mcp (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A small MCP server that exposes one tool, get_resolved_issues, for querying resolved Jira tickets across multiple Atlassian Cloud sites using a single (email, API token) credential pair. Designed for executive summarization of dev activity across a portfolio of companies.
uv tool install jira-digest-mcpOr, from a checkout:
uv sync
uv run jira-digest-mcpJIRA_USERNAME — the email address tied to your Atlassian API token.JIRA_API_TOKEN — an API token from <https://id.atlassian.com/manage-profile/security/api-tokens>.Optional:
LOG_LEVEL — INFO (default) or DEBUG. Logs go to stderr.get_resolved_issuesget_resolved_issues(
base_url: str, # e.g. "https://example.atlassian.net"
project_key: str, # e.g. "ST"
since: str, # "2026-04-01" or "-7d", "-2w"
until: str | None, # optional, same forms
max_results: int = 100,
) -> list[dict]Each returned dict contains: key, summary, issue_type, status, resolution, resolved_date, assignee_display_name, priority, labels, components, parent_key, parent_summary, story_points.
story_points is auto-discovered per site by matching the field name "Story Points" (case-insensitive). If the field has been renamed on a given site, story points will be null for that site.
Add to your MCP client config:
{
"mcpServers": {
"jira-digest": {
"command": "uv",
"args": ["tool", "run", "jira-digest-mcp"],
"env": {
"JIRA_USERNAME": "[email protected]",
"JIRA_API_TOKEN": "..."
}
}
}
}If you installed from a checkout, see the Development section below for the equivalent MCP client config that points at your local source.
The source lives at D:\src\AI\jira-digest-mcp.
From the repo root:
uv syncuv run pytest -vTo start the stdio server directly (it will hang waiting for JSON-RPC on stdin, which is correct — interrupt with Ctrl-C when done):
$env:JIRA_USERNAME = "[email protected]"
$env:JIRA_API_TOKEN = "..."
uv run --project D:\src\AI\jira-digest-mcp jira-digest-mcpSet $env:LOG_LEVEL = "DEBUG" to see request-level logs on stderr.
Use this MCP client config block to run the server from source instead of an installed copy:
{
"mcpServers": {
"jira-digest-dev": {
"command": "uv",
"args": [
"run",
"--project",
"D:\\src\\AI\\jira-digest-mcp",
"jira-digest-mcp"
],
"env": {
"JIRA_USERNAME": "[email protected]",
"JIRA_API_TOKEN": "...",
"LOG_LEVEL": "DEBUG"
}
}
}
}After editing a source file, restart the MCP client (or use its "reload MCP servers" action) to pick up the change.
Releases publish to PyPI automatically when a v* tag is pushed. The workflow lives at .github/workflows/publish.yml and uses PyPI Trusted Publishing (OIDC) — no API token is stored in the repo.
jira-digest-mcppublish.ymlpypipypi under Settings → Environments. Optionally add a required-reviewer protection rule so a human has to approve each publish.version in pyproject.toml following semantic versioning:main. git tag v0.2.0 # must match the pyproject.toml version exactly
git push origin v0.2.0Publish to PyPI workflow runs on the tag push, builds with uv build, and uploads with uv publish. Watch it under the repo's Actions tab.The tag and pyproject.toml version must agree — uv build reads the version from pyproject.toml, so a mismatched tag will silently publish under the wrong version number.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.