MCP, MCP server
Ultra Jira Mcp
A token-efficient Jira MCP server and CLI for Claude, ChatGPT, Cursor, Cline, and any other Model Context Protocol (MCP) client.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_LIFECYCLE_HOOK
Why this grade
- INSTALL_LIFECYCLE_HOOK Medium
A package install hook (preinstall, install, postinstall or prepare) runs a script.
package.json, line 22
prepare
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/agents/src/tools/git-tools.ts, line 15
* If you find yourself reaching for `child_process.execSync` here, stop:
src/core/attachments.ts, line 204
await fs.rm(ref.absolutePath, { force: true });
Install and update
Concern
runs a script at install time.
INSTALL_LIFECYCLE_HOOK
package.json, line 22
prepare
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
scripts/benchmark.ts, line 263
const socket = net.connect(target as never);
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
CLAUDE.md, line 95
npm run benchmark # measures tool-list + per-call bytes; needs .env.local
scripts/benchmark.ts, line 13
// Requires .env.local (or shell env) with JIRA_HOST / JIRA_EMAIL /
scripts/benchmark.ts, line 43
// The MCP server itself loads .env.local via dotenv at startup.
Show more
scripts/benchmark.ts, line 48
const file = path.resolve(here, "..", ".env.local");
scripts/benchmark.ts, line 77
`Missing required env vars: ${missing.join(", ")}. Set them in .env.local or your shell.`,
scripts/benchmark.ts, line 83
JIRA_API_TOKEN: process.env.JIRA_API_TOKEN!,
scripts/benchmark.ts, line 127
...env,
scripts/agents/src/config.ts, line 7
// Load .env.local from agents directory first, then fall back to root
scripts/agents/src/config.ts, line 8
config({ path: resolve(__dirname, '../.env.local') });
scripts/agents/src/config.ts, line 43
const googleApiKey = process.env.GOOGLE_API_KEY;
scripts/agents/src/config.ts, line 44
const groqApiKey = process.env.GROQ_API_KEY;
scripts/agents/src/config.ts, line 45
const openaiApiKey = process.env.OPENAI_API_KEY;
scripts/agents/src/config.ts, line 46
const anthropicApiKey = process.env.ANTHROPIC_API_KEY;
scripts/agents/src/config.ts, line 47
const mistralApiKey = process.env.MISTRAL_API_KEY;
scripts/agents/src/config.ts, line 48
const perplexityApiKey = process.env.PERPLEXITY_API_KEY;
scripts/agents/src/config.ts, line 49
const deepseekApiKey = process.env.DEEPSEEK_API_KEY;
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit a7d9675dbcdd. can delete files. runs a script at install time. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: a7d9675dbcdd916e2e2f785736103f27f1c89126
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.