jira-mcp

The project has explicitly addressed and fixed a critical security vulnerability involving a hardcoded Bearer token by moving it to an environment variable (`REGISTRY_AUTH_TOKEN`). Jira API credentials are dynamically fetched from a Project Registry per request in the serverless deployment, preventing their direct exposure. Input validation is implemented for environment variables and Jira configuration fields. Rate limiting is present to prevent API abuse. While documentation might suggest a default `REGISTRY_AUTH_TOKEN` value, the code itself reads from environment variables, which is a secure practice. Rotating this registry token is a deployment best practice.