jira@0.38.0

CAUTION

Publisher claims: "Community-maintained MCP server for Atlassian Jira Data Center. Not affiliated with Atlassian." Observed in sandbox: static analysis only — behavior not yet observed.

Registry npm (MCP server)Publisher atlassian-dc-mcp · joined 0 days agoInstalls 25,611Last detonated 1 h ago

Dispute verdict

Behavior trace

Queued for honeypot run · static analysis only

t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM

File type combined with upload actionsrc/__tests__/jira-upload.test.ts:58 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

Access to sensitive file pathsREADME.md:186 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

MEDIUM

File type combined with upload actionsrc/__tests__/jira-upload.test.ts:66 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packageREADME.md:44 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:39 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:10 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Access to sensitive file pathsREADME.md:128 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Access to sensitive file pathssrc/__tests__/jira-upload.test.ts:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

MEDIUM

File type combined with upload actionsrc/__tests__/jira-upload.test.ts:38 · File type combined with upload action — agent may exfiltrate local data files

AST07