bob-mcp-vuln-intake

MCP server for vulnerability intake - fetches and normalizes Jira/GitHub issues for downstream vulnerability remediation workflows.

Purpose

This server serves as the intake layer for vulnerability remediation workflows. It accepts Jira JQL queries or GitHub issue queries, fetches matching issues from the source system, normalizes the returned records into a common schema, enriches them with severity and source metadata, and returns a prioritized batch for downstream analysis.

This server is read-only - it does not modify code, create branches, or transition workflow states.

Quick Start

Installation

npm install -g bob-mcp-vuln-intake

Configuration

Add to your VS Code global settings.json (Cmd+Shift+P → "Open User Settings (JSON)"):

{
  "mcpServers": {
    "bob-mcp-vuln-intake": {
      "command": "npx",
      "args": ["-y", "bob-mcp-vuln-intake"],
      "env": {
        "JIRA_BASE_URL": "https://your-company.atlassian.net",
        "JIRA_USERNAME": "[email protected]",
        "JIRA_PAT": "your-jira-pat",
        "GITHUB_BASE_URL": "https://github.your-company.com/api/v3",
        "GITHUB_TOKEN": "your-github-token"
      }
    }
  }
}

Tools

• check_setup: Validate startup configuration and connectivity
• fetch_jira_issues: Execute Jira JQL and return normalized issues
• fetch_github_issues: Execute GitHub issue search and return normalized issues
• normalize_issue_batch: Normalize mixed source issues to common schema
• prioritize_issue_batch: Sort issues by severity for review
• summarize_issue_batch: Produce batch summary by severity/source/status

Prompts

• review-vulnerability-query: Interactive vulnerability intake session
• intake-jira-vulnerabilities: Fetch and prioritize Jira issues
• intake-github-vulnerabilities: Fetch and prioritize GitHub issues

Environment Variables

Required

• JIRA_BASE_URL: Jira base URL (e.g., https://your-company.atlassian.net)
• JIRA_USERNAME: Jira username for authentication
• JIRA_PAT: Jira Personal Access Token
• GITHUB_BASE_URL: GitHub Enterprise API base URL
• GITHUB_TOKEN: GitHub Enterprise personal access token

Optional

• DEFAULT_SOURCE_PRIORITY: Comma-separated priority order (e.g., jira,github)
• DEFAULT_SEVERITY_ORDER: Comma-separated severity order (e.g., Critical,High,Medium,Low,Minor)
• REQUEST_TIMEOUT_MS: Request timeout in milliseconds
• LOG_LEVEL: Logging level

Degraded Mode

If either Jira or GitHub credentials are missing or unreachable, the server operates in degraded mode:

• Jira only: GitHub queries will fail with connection error
• GitHub only: Jira queries will fail with connection error
• Neither available: Server starts but all tool calls will fail

Use check_setup tool to diagnose connectivity issues.

IBM Bob Limitations

• IBM Bob supports stdio-based MCP servers only
• This server works with IBM Bob when configured in global settings
• Zero-argument prompts may not be fully supported in all IBM Bob versions

License

Apache-2.0