jira-simple-mcp

The server relies on environment variables (JIRA_URL, JIRA_EMAIL, JIRA_API_TOKEN) for authentication, which is a good practice as no secrets are hardcoded. API calls use standard Basic authentication over HTTPS. Input JQL from the AI is encoded before being sent to Jira, mitigating URL injection, but malicious or resource-intensive JQL could still be provided by a compromised AI. The server communicates via stdio, reducing direct network attack surface. No 'eval' or obvious malicious patterns found in the provided source code. The large dependency tree from '@modelcontextprotocol/sdk' always introduces transitive risks, but the direct code is clean.