MCPoppinsLive chat ↗
Trust & security centre

Safe by default.
Explicit when actions matter.

The controls below come from the Jira and Confluence package security documents.

Read-only defaultPer-user identityAction approvalsAuditable
01

Read-only by default

Write tools require explicit enablement.

02

No TLS bypass

Certificate verification is never disabled.

03

No embedded credentials

Tokens come from environment variables only.

04

Project allowlist (Jira)

Restrict accessible Jira projects.

05

Safe CQL escaping

Sanitise Confluence search input.

06

Per-user identity

Each user supplies their own credentials.

07

Correlation IDs

Every request is traceable.

08

Request timeouts

Configurable; default 30 seconds.

Package sources

Read the controls in context.

These documents remain the source of truth as package security guidance changes.

Security Policy — @mcp-platform/jira

Security Model

This connector follows a read-only by default security posture. Write operations (create, update, transition, comment, assign, log work) are only available when explicitly enabled via JIRA_ENABLE_WRITES=true.

Authentication

  • Jira Cloud: API token with email-based Basic Auth
  • Jira Data Center/Server: Personal Access Token with Bearer auth
  • Tokens are read from environment variables — never embedded in code or config files
  • Each user must generate and manage their own credentials

Access Controls

  • Project allowlist: Set JIRA_ALLOWED_PROJECTS to restrict which projects the connector can access
  • Read-only default: Write tools are not registered unless explicitly enabled
  • Per-user identity: Each installation uses individual credentials, not shared tokens

TLS / Certificate Handling

This package does NOT disable TLS certificate verification. For environments with corporate or self-signed certificates:

  • Set NODE_EXTRA_CA_CERTS=/path/to/ca-bundle.pem in your environment
  • Or set JIRA_CA_CERT_PATH to point to your certificate file

Never set NODE_TLS_REJECT_UNAUTHORIZED=0 in production.

Vulnerability Reporting

If you discover a security vulnerability, please report it responsibly:

  1. Do NOT create a public issue
  2. Contact the maintainers directly
  3. Allow reasonable time for a fix before disclosure

Supported Versions

VersionSupported
1.0.xYes

Security Policy — @mcp-platform/confluence

Read-only by default. Write tools require CONFLUENCE_ENABLE_WRITES=true. No TLS bypass. Use NODE_EXTRA_CA_CERTS for corporate certificates. CQL input is escaped to prevent injection. Tokens from environment variables only.

Report vulnerabilities directly to maintainers.