Skip to content

[AI-61] feat: Add opt-in Jira write tools to bitwarden-atlassian-tools - #188

Open
SaintPatrck wants to merge 5 commits into
mainfrom
feat/jira-write-tools-mcp
Open

[AI-61] feat: Add opt-in Jira write tools to bitwarden-atlassian-tools#188
SaintPatrck wants to merge 5 commits into
mainfrom
feat/jira-write-tools-mcp

Conversation

@SaintPatrck

Copy link
Copy Markdown
Contributor

🎟️ Tracking

AI-61

📔 Objective

Adds three MCP tools to bitwarden-atlassian-tools's bundled server: create_issue and link_issues (write, opt-in) and get_create_fields (read-only, discovers a project's create-screen requirements before drafting). Both write tools default to a dry run and require an optional ATLASSIAN_JIRA_WRITE_TOKEN for a live write; installs without that token keep today's behavior for anything that writes.

`create_issue` and `link_issues` let the MCP server file and link Jira
work items; `get_create_fields` reads a project's create screen first
since Bitwarden's projects don't share a shape. Both write tools
default to a dry run and require `ATLASSIAN_JIRA_WRITE_TOKEN` for a
live write, so installs without the token stay exactly as read-only
as before.
Add the jira-software issue-scope twins Atlassian actually requires,
drop the classic write:jira-work callout and per-endpoint scope table
in favor of a flat scope table matching the read-scope sections above,
remove the classic-token mention, and add a create_issue usage example.
Correct the README/CHANGELOG/auth.ts claim that write tools are hidden
without a token — they're always listed with a working dry-run;
without ATLASSIAN_JIRA_WRITE_TOKEN only the live write refuses.
Stop presenting a hardcoded string as a literal Jira quote in
get_create_fields' 404 handling. Extract the duplicated write-token
guard text into a shared write-guard util. Have link_issues read the
outward issue back after a live link and report whether the direction
verified. Document that a leaked write token carries unused
comment/attachment scopes Atlassian requires alongside the issue scopes.
@SaintPatrck SaintPatrck added the ai-review Request a Claude code review label Aug 4, 2026
@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Re-reviewed the commits added since the previous round (eefdeb1, a0ddb48, f04b931): the extracted write-guard.ts helpers and their adoption in both write tools, the new 401 scope-hint branch, the rewritten renderField in get-create-fields.ts, the new verifyLink read-back in link-issues.ts with its JiraIssueLink type, and the metadata/README/comment alignment that removed the stale read-only claims. The write path still holds its safety properties: dryRun defaults to true in both the Zod schema and the advertised input schema, live writes are gated on hasJiraWriteToken() before any client is constructed, JiraProjectKey constrains the only user-controlled path segment, verifyLink uses a separate read-mode client and cannot turn a verification failure into a reported write failure, and handler errors are returned as text rather than thrown. Version bump (2.5.0 in marketplace.json, plugin.json, and the README catalog — no agents in this plugin) and the changelog entry are both present, and package.json changes are description/keyword only with no dependency movement.

Code Review Details

No findings. The three suggestions from the prior round were addressed in a0ddb48, and the retracted .mcp.json finding is not reopened.

Comment thread plugins/bitwarden-atlassian-tools/mcp/bitwarden-atlassian-mcp-server/src/index.ts Outdated
Stop rewriting a field's own name when it contains the word "type" in
get_create_fields' output. Hint at partial write-token scopes instead
of an unrelated field-lookup tip when create_issue/link_issues fail
with Jira's generic 401. Drop the last "read-only" claims from the
MCP server's own module comment and package metadata.
Comment thread plugins/bitwarden-atlassian-tools/.mcp.json
@SaintPatrck
SaintPatrck marked this pull request as ready for review August 4, 2026 20:12
@SaintPatrck
SaintPatrck requested a review from a team as a code owner August 4, 2026 20:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai-review Request a Claude code review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant