mcp-jira-cloud 2.2.0 → 3.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +280 -172
- package/LICENSE +21 -21
- package/README.md +810 -799
- package/SECURITY.md +149 -149
- package/assets/logo.svg +30 -30
- package/dist/index.js +1 -1
- package/package.json +11 -8
package/SECURITY.md
CHANGED
|
@@ -1,149 +1,149 @@
|
|
|
1
|
-
# Security Policy
|
|
2
|
-
|
|
3
|
-
## Supported Versions
|
|
4
|
-
|
|
5
|
-
We release patches for security vulnerabilities in the following versions:
|
|
6
|
-
|
|
7
|
-
| Version | Supported |
|
|
8
|
-
| ------- | ------------------ |
|
|
9
|
-
| 2.x.x | :white_check_mark: |
|
|
10
|
-
| 1.x.x | :white_check_mark: |
|
|
11
|
-
| < 1.0 | :x: |
|
|
12
|
-
|
|
13
|
-
## Reporting a Vulnerability
|
|
14
|
-
|
|
15
|
-
We take the security of `jira-mcp` seriously. If you discover a security vulnerability, please report it responsibly.
|
|
16
|
-
|
|
17
|
-
### How to Report
|
|
18
|
-
|
|
19
|
-
**Please do NOT report security vulnerabilities through public GitHub issues.**
|
|
20
|
-
|
|
21
|
-
Instead, please report them via one of the following methods:
|
|
22
|
-
|
|
23
|
-
1. **Email**: Send a detailed report to [t.raj@maxxton.com](mailto:t.raj@maxxton.com)
|
|
24
|
-
2. **GitHub Security Advisories**: [Create a private security advisory](https://github.com/tezaswi7222/jira-mcp/security/advisories/new)
|
|
25
|
-
|
|
26
|
-
### What to Include
|
|
27
|
-
|
|
28
|
-
Please include as much of the following information as possible:
|
|
29
|
-
|
|
30
|
-
- **Type of vulnerability** (e.g., credential exposure, injection, authentication bypass)
|
|
31
|
-
- **Location** of the affected source code (file path, function, line number)
|
|
32
|
-
- **Step-by-step instructions** to reproduce the issue
|
|
33
|
-
- **Proof-of-concept** or exploit code (if available)
|
|
34
|
-
- **Impact assessment** of the vulnerability
|
|
35
|
-
- **Suggested remediation** (if any)
|
|
36
|
-
|
|
37
|
-
### Response Timeline
|
|
38
|
-
|
|
39
|
-
- **Initial Response**: Within 48 hours of report submission
|
|
40
|
-
- **Status Update**: Within 7 days with assessment and remediation plan
|
|
41
|
-
- **Resolution**: Within 30 days for critical vulnerabilities
|
|
42
|
-
|
|
43
|
-
### What to Expect
|
|
44
|
-
|
|
45
|
-
1. **Acknowledgement**: We will acknowledge receipt of your report
|
|
46
|
-
2. **Communication**: We will keep you informed of our progress
|
|
47
|
-
3. **Credit**: We will credit you in our release notes (unless you prefer to remain anonymous)
|
|
48
|
-
4. **Notification**: We will notify you when the vulnerability is fixed
|
|
49
|
-
|
|
50
|
-
## Security Best Practices
|
|
51
|
-
|
|
52
|
-
When using `jira-mcp`, please follow these security best practices:
|
|
53
|
-
|
|
54
|
-
### Credential Management
|
|
55
|
-
|
|
56
|
-
- ✅ **DO**: Use environment variables for credentials
|
|
57
|
-
- ✅ **DO**: Use API tokens instead of passwords
|
|
58
|
-
- ✅ **DO**: Rotate your API tokens regularly
|
|
59
|
-
- ✅ **DO**: Use OAuth 2.0 for production environments
|
|
60
|
-
- ❌ **DON'T**: Hardcode credentials in configuration files
|
|
61
|
-
- ❌ **DON'T**: Commit `.env` files or credentials to version control
|
|
62
|
-
- ❌ **DON'T**: Share API tokens or OAuth secrets
|
|
63
|
-
|
|
64
|
-
### Environment Variables
|
|
65
|
-
|
|
66
|
-
```bash
|
|
67
|
-
# Good: Using environment variables
|
|
68
|
-
export JIRA_API_TOKEN="your-token-here"
|
|
69
|
-
|
|
70
|
-
# Bad: Hardcoding in configuration (don't do this!)
|
|
71
|
-
# "JIRA_API_TOKEN": "your-token-here" <- Never commit this!
|
|
72
|
-
```
|
|
73
|
-
|
|
74
|
-
### API Token Scopes
|
|
75
|
-
|
|
76
|
-
When creating Jira API tokens or OAuth apps, follow the principle of least privilege:
|
|
77
|
-
|
|
78
|
-
- Only request necessary OAuth scopes
|
|
79
|
-
- Use read-only tokens when possible
|
|
80
|
-
- Regularly audit token usage
|
|
81
|
-
|
|
82
|
-
### Network Security
|
|
83
|
-
|
|
84
|
-
- Use HTTPS URLs only (`https://your-domain.atlassian.net`)
|
|
85
|
-
- Verify you're connecting to legitimate Atlassian endpoints
|
|
86
|
-
- Be cautious on untrusted networks
|
|
87
|
-
|
|
88
|
-
## Security Features
|
|
89
|
-
|
|
90
|
-
`jira-mcp` includes the following security features:
|
|
91
|
-
|
|
92
|
-
### Secure Credential Storage
|
|
93
|
-
|
|
94
|
-
- Credentials are stored securely using the system keychain via [Keytar](https://github.com/atom/node-keytar)
|
|
95
|
-
- Windows: Windows Credential Manager
|
|
96
|
-
- macOS: Keychain
|
|
97
|
-
- Linux: libsecret
|
|
98
|
-
|
|
99
|
-
### OAuth 2.0 Support
|
|
100
|
-
|
|
101
|
-
- Automatic token refresh before expiration
|
|
102
|
-
- Secure token exchange flow
|
|
103
|
-
- Support for refresh tokens
|
|
104
|
-
|
|
105
|
-
### No Credential Logging
|
|
106
|
-
|
|
107
|
-
- Credentials are never logged to console or files
|
|
108
|
-
- Error messages do not expose sensitive information
|
|
109
|
-
- API tokens are masked in debug output
|
|
110
|
-
|
|
111
|
-
## Known Security Considerations
|
|
112
|
-
|
|
113
|
-
### Keytar Dependency
|
|
114
|
-
|
|
115
|
-
This package uses `keytar` for secure credential storage, which requires native bindings. If `keytar` is not available:
|
|
116
|
-
|
|
117
|
-
- Credentials are stored in memory only
|
|
118
|
-
- Credentials must be re-entered each session
|
|
119
|
-
- Consider using environment variables as an alternative
|
|
120
|
-
|
|
121
|
-
### OAuth Token Storage
|
|
122
|
-
|
|
123
|
-
When using OAuth 2.0:
|
|
124
|
-
|
|
125
|
-
- Access tokens are stored in the system keychain
|
|
126
|
-
- Refresh tokens are stored alongside access tokens
|
|
127
|
-
- Tokens can be cleared using `jira_clear_auth`
|
|
128
|
-
|
|
129
|
-
## Audit Trail
|
|
130
|
-
|
|
131
|
-
### Version 2.0.0
|
|
132
|
-
|
|
133
|
-
- Security review for bulk operations
|
|
134
|
-
- Validated file upload security (attachment uploads)
|
|
135
|
-
- Ensured dashboard access respects Jira permissions
|
|
136
|
-
- JQL validation prevents injection attacks
|
|
137
|
-
- Bulk operation limits enforced (max 1000 issues)
|
|
138
|
-
- All new endpoints use authenticated requests only
|
|
139
|
-
|
|
140
|
-
### Version 1.0.0
|
|
141
|
-
|
|
142
|
-
- Initial security review completed
|
|
143
|
-
- Implemented secure credential storage
|
|
144
|
-
- Added OAuth 2.0 support with auto-refresh
|
|
145
|
-
- Configured `.npmignore` to exclude sensitive files
|
|
146
|
-
|
|
147
|
-
---
|
|
148
|
-
|
|
149
|
-
Thank you for helping keep `jira-mcp` and its users safe!
|
|
1
|
+
# Security Policy
|
|
2
|
+
|
|
3
|
+
## Supported Versions
|
|
4
|
+
|
|
5
|
+
We release patches for security vulnerabilities in the following versions:
|
|
6
|
+
|
|
7
|
+
| Version | Supported |
|
|
8
|
+
| ------- | ------------------ |
|
|
9
|
+
| 2.x.x | :white_check_mark: |
|
|
10
|
+
| 1.x.x | :white_check_mark: |
|
|
11
|
+
| < 1.0 | :x: |
|
|
12
|
+
|
|
13
|
+
## Reporting a Vulnerability
|
|
14
|
+
|
|
15
|
+
We take the security of `jira-mcp` seriously. If you discover a security vulnerability, please report it responsibly.
|
|
16
|
+
|
|
17
|
+
### How to Report
|
|
18
|
+
|
|
19
|
+
**Please do NOT report security vulnerabilities through public GitHub issues.**
|
|
20
|
+
|
|
21
|
+
Instead, please report them via one of the following methods:
|
|
22
|
+
|
|
23
|
+
1. **Email**: Send a detailed report to [t.raj@maxxton.com](mailto:t.raj@maxxton.com)
|
|
24
|
+
2. **GitHub Security Advisories**: [Create a private security advisory](https://github.com/tezaswi7222/jira-mcp/security/advisories/new)
|
|
25
|
+
|
|
26
|
+
### What to Include
|
|
27
|
+
|
|
28
|
+
Please include as much of the following information as possible:
|
|
29
|
+
|
|
30
|
+
- **Type of vulnerability** (e.g., credential exposure, injection, authentication bypass)
|
|
31
|
+
- **Location** of the affected source code (file path, function, line number)
|
|
32
|
+
- **Step-by-step instructions** to reproduce the issue
|
|
33
|
+
- **Proof-of-concept** or exploit code (if available)
|
|
34
|
+
- **Impact assessment** of the vulnerability
|
|
35
|
+
- **Suggested remediation** (if any)
|
|
36
|
+
|
|
37
|
+
### Response Timeline
|
|
38
|
+
|
|
39
|
+
- **Initial Response**: Within 48 hours of report submission
|
|
40
|
+
- **Status Update**: Within 7 days with assessment and remediation plan
|
|
41
|
+
- **Resolution**: Within 30 days for critical vulnerabilities
|
|
42
|
+
|
|
43
|
+
### What to Expect
|
|
44
|
+
|
|
45
|
+
1. **Acknowledgement**: We will acknowledge receipt of your report
|
|
46
|
+
2. **Communication**: We will keep you informed of our progress
|
|
47
|
+
3. **Credit**: We will credit you in our release notes (unless you prefer to remain anonymous)
|
|
48
|
+
4. **Notification**: We will notify you when the vulnerability is fixed
|
|
49
|
+
|
|
50
|
+
## Security Best Practices
|
|
51
|
+
|
|
52
|
+
When using `jira-mcp`, please follow these security best practices:
|
|
53
|
+
|
|
54
|
+
### Credential Management
|
|
55
|
+
|
|
56
|
+
- ✅ **DO**: Use environment variables for credentials
|
|
57
|
+
- ✅ **DO**: Use API tokens instead of passwords
|
|
58
|
+
- ✅ **DO**: Rotate your API tokens regularly
|
|
59
|
+
- ✅ **DO**: Use OAuth 2.0 for production environments
|
|
60
|
+
- ❌ **DON'T**: Hardcode credentials in configuration files
|
|
61
|
+
- ❌ **DON'T**: Commit `.env` files or credentials to version control
|
|
62
|
+
- ❌ **DON'T**: Share API tokens or OAuth secrets
|
|
63
|
+
|
|
64
|
+
### Environment Variables
|
|
65
|
+
|
|
66
|
+
```bash
|
|
67
|
+
# Good: Using environment variables
|
|
68
|
+
export JIRA_API_TOKEN="your-token-here"
|
|
69
|
+
|
|
70
|
+
# Bad: Hardcoding in configuration (don't do this!)
|
|
71
|
+
# "JIRA_API_TOKEN": "your-token-here" <- Never commit this!
|
|
72
|
+
```
|
|
73
|
+
|
|
74
|
+
### API Token Scopes
|
|
75
|
+
|
|
76
|
+
When creating Jira API tokens or OAuth apps, follow the principle of least privilege:
|
|
77
|
+
|
|
78
|
+
- Only request necessary OAuth scopes
|
|
79
|
+
- Use read-only tokens when possible
|
|
80
|
+
- Regularly audit token usage
|
|
81
|
+
|
|
82
|
+
### Network Security
|
|
83
|
+
|
|
84
|
+
- Use HTTPS URLs only (`https://your-domain.atlassian.net`)
|
|
85
|
+
- Verify you're connecting to legitimate Atlassian endpoints
|
|
86
|
+
- Be cautious on untrusted networks
|
|
87
|
+
|
|
88
|
+
## Security Features
|
|
89
|
+
|
|
90
|
+
`jira-mcp` includes the following security features:
|
|
91
|
+
|
|
92
|
+
### Secure Credential Storage
|
|
93
|
+
|
|
94
|
+
- Credentials are stored securely using the system keychain via [Keytar](https://github.com/atom/node-keytar)
|
|
95
|
+
- Windows: Windows Credential Manager
|
|
96
|
+
- macOS: Keychain
|
|
97
|
+
- Linux: libsecret
|
|
98
|
+
|
|
99
|
+
### OAuth 2.0 Support
|
|
100
|
+
|
|
101
|
+
- Automatic token refresh before expiration
|
|
102
|
+
- Secure token exchange flow
|
|
103
|
+
- Support for refresh tokens
|
|
104
|
+
|
|
105
|
+
### No Credential Logging
|
|
106
|
+
|
|
107
|
+
- Credentials are never logged to console or files
|
|
108
|
+
- Error messages do not expose sensitive information
|
|
109
|
+
- API tokens are masked in debug output
|
|
110
|
+
|
|
111
|
+
## Known Security Considerations
|
|
112
|
+
|
|
113
|
+
### Keytar Dependency
|
|
114
|
+
|
|
115
|
+
This package uses `keytar` for secure credential storage, which requires native bindings. If `keytar` is not available:
|
|
116
|
+
|
|
117
|
+
- Credentials are stored in memory only
|
|
118
|
+
- Credentials must be re-entered each session
|
|
119
|
+
- Consider using environment variables as an alternative
|
|
120
|
+
|
|
121
|
+
### OAuth Token Storage
|
|
122
|
+
|
|
123
|
+
When using OAuth 2.0:
|
|
124
|
+
|
|
125
|
+
- Access tokens are stored in the system keychain
|
|
126
|
+
- Refresh tokens are stored alongside access tokens
|
|
127
|
+
- Tokens can be cleared using `jira_clear_auth`
|
|
128
|
+
|
|
129
|
+
## Audit Trail
|
|
130
|
+
|
|
131
|
+
### Version 2.0.0
|
|
132
|
+
|
|
133
|
+
- Security review for bulk operations
|
|
134
|
+
- Validated file upload security (attachment uploads)
|
|
135
|
+
- Ensured dashboard access respects Jira permissions
|
|
136
|
+
- JQL validation prevents injection attacks
|
|
137
|
+
- Bulk operation limits enforced (max 1000 issues)
|
|
138
|
+
- All new endpoints use authenticated requests only
|
|
139
|
+
|
|
140
|
+
### Version 1.0.0
|
|
141
|
+
|
|
142
|
+
- Initial security review completed
|
|
143
|
+
- Implemented secure credential storage
|
|
144
|
+
- Added OAuth 2.0 support with auto-refresh
|
|
145
|
+
- Configured `.npmignore` to exclude sensitive files
|
|
146
|
+
|
|
147
|
+
---
|
|
148
|
+
|
|
149
|
+
Thank you for helping keep `jira-mcp` and its users safe!
|
package/assets/logo.svg
CHANGED
|
@@ -1,30 +1,30 @@
|
|
|
1
|
-
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 120 120" width="120" height="120">
|
|
2
|
-
<defs>
|
|
3
|
-
<linearGradient id="bgGrad" x1="0%" y1="0%" x2="100%" y2="100%">
|
|
4
|
-
<stop offset="0%" style="stop-color:#0052CC;stop-opacity:1" />
|
|
5
|
-
<stop offset="100%" style="stop-color:#2684FF;stop-opacity:1" />
|
|
6
|
-
</linearGradient>
|
|
7
|
-
<linearGradient id="accentGrad" x1="0%" y1="0%" x2="100%" y2="100%">
|
|
8
|
-
<stop offset="0%" style="stop-color:#FF5630;stop-opacity:1" />
|
|
9
|
-
<stop offset="100%" style="stop-color:#FF7452;stop-opacity:1" />
|
|
10
|
-
</linearGradient>
|
|
11
|
-
</defs>
|
|
12
|
-
|
|
13
|
-
<!-- Background circle -->
|
|
14
|
-
<circle cx="60" cy="60" r="56" fill="url(#bgGrad)" />
|
|
15
|
-
|
|
16
|
-
<!-- Jira-inspired shape -->
|
|
17
|
-
<g transform="translate(30, 28)">
|
|
18
|
-
<!-- Main shape -->
|
|
19
|
-
<path d="M30 0 L60 30 L30 60 L0 30 Z" fill="white" opacity="0.95"/>
|
|
20
|
-
|
|
21
|
-
<!-- Inner diamond -->
|
|
22
|
-
<path d="M30 12 L48 30 L30 48 L12 30 Z" fill="url(#accentGrad)"/>
|
|
23
|
-
|
|
24
|
-
<!-- Center dot -->
|
|
25
|
-
<circle cx="30" cy="30" r="6" fill="white"/>
|
|
26
|
-
</g>
|
|
27
|
-
|
|
28
|
-
<!-- MCP text indicator -->
|
|
29
|
-
<text x="60" y="105" text-anchor="middle" font-family="Arial, sans-serif" font-size="12" font-weight="bold" fill="white">MCP</text>
|
|
30
|
-
</svg>
|
|
1
|
+
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 120 120" width="120" height="120">
|
|
2
|
+
<defs>
|
|
3
|
+
<linearGradient id="bgGrad" x1="0%" y1="0%" x2="100%" y2="100%">
|
|
4
|
+
<stop offset="0%" style="stop-color:#0052CC;stop-opacity:1" />
|
|
5
|
+
<stop offset="100%" style="stop-color:#2684FF;stop-opacity:1" />
|
|
6
|
+
</linearGradient>
|
|
7
|
+
<linearGradient id="accentGrad" x1="0%" y1="0%" x2="100%" y2="100%">
|
|
8
|
+
<stop offset="0%" style="stop-color:#FF5630;stop-opacity:1" />
|
|
9
|
+
<stop offset="100%" style="stop-color:#FF7452;stop-opacity:1" />
|
|
10
|
+
</linearGradient>
|
|
11
|
+
</defs>
|
|
12
|
+
|
|
13
|
+
<!-- Background circle -->
|
|
14
|
+
<circle cx="60" cy="60" r="56" fill="url(#bgGrad)" />
|
|
15
|
+
|
|
16
|
+
<!-- Jira-inspired shape -->
|
|
17
|
+
<g transform="translate(30, 28)">
|
|
18
|
+
<!-- Main shape -->
|
|
19
|
+
<path d="M30 0 L60 30 L30 60 L0 30 Z" fill="white" opacity="0.95"/>
|
|
20
|
+
|
|
21
|
+
<!-- Inner diamond -->
|
|
22
|
+
<path d="M30 12 L48 30 L30 48 L12 30 Z" fill="url(#accentGrad)"/>
|
|
23
|
+
|
|
24
|
+
<!-- Center dot -->
|
|
25
|
+
<circle cx="30" cy="30" r="6" fill="white"/>
|
|
26
|
+
</g>
|
|
27
|
+
|
|
28
|
+
<!-- MCP text indicator -->
|
|
29
|
+
<text x="60" y="105" text-anchor="middle" font-family="Arial, sans-serif" font-size="12" font-weight="bold" fill="white">MCP</text>
|
|
30
|
+
</svg>
|