Enterprise GitHub & Jira Hybrid MCP Server for Autonomous CI/CD Triage

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

Introduction to Autonomous CI/CD Triage

In modern software engineering, the speed at which a team can resolve CI/CD pipeline failures directly impacts their overall velocity. When a build fails, developers spend valuable time cross-referencing GitHub Actions logs with Jira tickets to understand the context, assign ownership, and track the resolution. The Model Context Protocol (MCP) revolutionizes this workflow by allowing AI agents to perform this triage autonomously.

In this comprehensive deep dive, we will build an Enterprise Hybrid MCP Server using the Python SDK. This server will seamlessly integrate GitHub and Jira, enabling Claude or Cursor to analyze CI/CD failures, search for related Jira issues, and automatically generate bug reports.

For more automation strategies, explore our comprehensive AI Workflows.

The Hybrid MCP Server Architecture

A "Hybrid" MCP server interacts with multiple disparate APIs (in this case, GitHub and Jira) and exposes unified, high-level tools to the AI agent. Instead of the AI struggling to chain low-level API calls, the Hybrid Server provides optimized functions like triage_failed_run, which abstracts the complexity of fetching logs and creating tickets.

OAuth 2.0 Token Security Guide for Enterprise

Integrating with Enterprise GitHub and Jira requires stringent security measures. Using OAuth 2.0 ensures that the MCP server acts with the correct permissions and maintains an audit trail.

1. Dual Token Management: The MCP server must manage distinct OAuth tokens for both GitHub and Jira.
2. App Installation (GitHub): For GitHub, it is highly recommended to use a GitHub App rather than a personal OAuth token. The server will authenticate using a private key to generate a short-lived installation access token.
3. Jira OAuth 2.0 (3LO): Jira Cloud supports OAuth 2.0 (3LO). The AI client should pass the user's Jira access token to the MCP server, ensuring tickets are created under the user's identity.
4. Secure Storage: Never hardcode secrets. Use environment variables or a secure secret manager (like AWS Secrets Manager or HashiCorp Vault) to inject credentials into the MCP server process at runtime.

For additional enterprise integrations, visit our MCP Directory.

Step-by-Step Implementation Guide

We will construct the Hybrid Server using the official MCP Python SDK. The server will provide two primary tools: get_failed_action_logs and create_jira_bug.

1. Project Setup

Initialize a Python project and install the dependencies:

pip install mcp pydantic httpx pyjwt cryptography python-dotenv

2. Defining the inputSchema with Pydantic (JSON/Zod equivalent)

In Python, we use Pydantic models to define our schemas. The MCP SDK automatically converts these to the required JSON Schema format.

from pydantic import BaseModel, Field

class GetLogsSchema(BaseModel):
    repo: str = Field(..., description="The repository name in format owner/repo")
    run_id: int = Field(..., description="The GitHub Actions run ID")

class CreateBugSchema(BaseModel):
    summary: str = Field(..., description="Brief summary of the CI failure")
    description: str = Field(..., description="Detailed description including log excerpts")
    project_key: str = Field(..., description="Jira project key, e.g., ENG")

3. Full Python SDK Server Code

Below is the complete implementation of the Hybrid MCP Server.

import os
import httpx
import jwt
import time
from dotenv import load_dotenv
from mcp.server.fastmcp import FastMCP

load_dotenv()

# Configuration
GITHUB_APP_ID = os.getenv("GITHUB_APP_ID")
GITHUB_PRIVATE_KEY = os.getenv("GITHUB_PRIVATE_KEY")
GITHUB_INSTALLATION_ID = os.getenv("GITHUB_INSTALLATION_ID")
JIRA_BASE_URL = os.getenv("JIRA_BASE_URL")
JIRA_USER_EMAIL = os.getenv("JIRA_USER_EMAIL")
JIRA_API_TOKEN = os.getenv("JIRA_API_TOKEN") # In a pure OAuth flow, this would be a Bearer token

# Initialize FastMCP Server
mcp = FastMCP("GitHub-Jira-Triage")

def get_github_token() -> str:
    """Generate a short-lived GitHub App Installation Token."""
    payload = {
        "iat": int(time.time()),
        "exp": int(time.time()) + (10 * 60),
        "iss": GITHUB_APP_ID
    }
    jwt_token = jwt.encode(payload, GITHUB_PRIVATE_KEY, algorithm="RS256")
    
    headers = {
        "Authorization": f"Bearer {jwt_token}",
        "Accept": "application/vnd.github.v3+json"
    }
    
    response = httpx.post(
        f"https://api.github.com/app/installations/{GITHUB_INSTALLATION_ID}/access_tokens",
        headers=headers
    )
    response.raise_for_status()
    return response.json()["token"]

@mcp.tool()
def get_failed_action_logs(repo: str, run_id: int) -> str:
    """
    Fetch the logs for a failed GitHub Actions run to analyze the root cause.
    """
    token = get_github_token()
    headers = {
        "Authorization": f"token {token}",
        "Accept": "application/vnd.github.v3+json"
    }
    
    # 1. Get jobs for the run
    jobs_url = f"https://api.github.com/repos/{repo}/actions/runs/{run_id}/jobs"
    jobs_resp = httpx.get(jobs_url, headers=headers)
    jobs_resp.raise_for_status()
    jobs = jobs_resp.json().get("jobs", [])
    
    failed_jobs = [j for j in jobs if j.get("conclusion") == "failure"]
    if not failed_jobs:
        return "No failed jobs found for this run."
        
    # 2. Get logs for the first failed job
    job_id = failed_jobs[0]["id"]
    logs_url = f"https://api.github.com/repos/{repo}/actions/jobs/{job_id}/logs"
    
    # GitHub returns a 302 redirect for logs, httpx follows it by default if follow_redirects=True
    logs_resp = httpx.get(logs_url, headers=headers, follow_redirects=True)
    
    # Truncate logs if they are too massive for the context window
    full_logs = logs_resp.text
    return full_logs[-10000:] if len(full_logs) > 10000 else full_logs

@mcp.tool()
def create_jira_bug(summary: str, description: str, project_key: str) -> str:
    """
    Create a Jira Bug ticket detailing the CI/CD failure.
    """
    auth = (JIRA_USER_EMAIL, JIRA_API_TOKEN) # Replace with OAuth Bearer token in pure OAuth setup
    headers = {
        "Accept": "application/json",
        "Content-Type": "application/json"
    }
    
    payload = {
        "fields": {
           "project": {
              "key": project_key
           },
           "summary": summary,
           "description": description,
           "issuetype": {
              "name": "Bug"
           }
       }
    }
    
    url = f"{JIRA_BASE_URL}/rest/api/2/issue"
    response = httpx.post(url, json=payload, headers=headers, auth=auth)
    response.raise_for_status()
    
    issue_key = response.json().get("key")
    return f"Successfully created Jira Bug: {issue_key} at {JIRA_BASE_URL}/browse/{issue_key}"

if __name__ == "__main__":
    # Run the server on standard input/output
    mcp.run()

4. Configuration for Claude Desktop and Cursor

To wire up this powerful triage server to your AI assistant, you need to configure the mcpServers block. This informs the client how to execute your Python script and passes the necessary environment variables securely.

mcpServers Config Block

Update your configuration file (e.g., claude_desktop_config.json):

{
  "mcpServers": {
    "github-jira-triage": {
      "command": "/path/to/your/venv/bin/python",
      "args": ["/path/to/your/project/server.py"],
      "env": {
        "GITHUB_APP_ID": "123456",
        "GITHUB_PRIVATE_KEY": "-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----",
        "GITHUB_INSTALLATION_ID": "7891011",
        "JIRA_BASE_URL": "https://yourcompany.atlassian.net",
        "JIRA_USER_EMAIL": "dev@yourcompany.com",
        "JIRA_API_TOKEN": "your_jira_api_token"
      }
    }
  }
}

Security Note: Be extremely careful with the GITHUB_PRIVATE_KEY formatting in JSON. Use proper newline escape characters ( ).

Conclusion

Building an Enterprise GitHub & Jira Hybrid MCP Server empowers AI agents to take an active role in maintaining CI/CD pipeline health. By combining the Python MCP SDK with strict OAuth 2.0 and GitHub App authentication patterns, organizations can safely delegate the tedious task of failure triage, allowing human engineers to focus on actual problem-solving rather than administrative overhead.

Discover more innovative tools and workflows in the Daily AI World MCP Directory.

Frequently Asked Questions (AEO & GEO)

Q: What is a Hybrid MCP Server and why use one? A: A Hybrid MCP Server integrates multiple external APIs (like GitHub and Jira) into a single server instance. This is highly beneficial because it allows you to expose high-level, workflow-specific tools to the AI (e.g., "Triage CI Failure") rather than forcing the AI to orchestrate complex sequences of generic API calls across different standalone servers.

Q: How do I securely handle the GitHub Private Key in the MCP configuration? A: Never hardcode private keys in your source code. When configuring the mcpServers block, you should ideally pass a path to a secure file or rely on a secrets manager within your environment. If placing it in the JSON config, ensure it is properly escaped and that the config file itself has strict file permissions restricted only to the user running the AI client.

Q: Can this server automatically resolve the Jira tickets it creates? A: Yes, the server can be extended with additional tools (e.g., transition_jira_issue). If the AI agent is given access to tools that can generate code fixes, create pull requests, and monitor subsequent CI runs, it could theoretically complete the loop by transitioning the Jira ticket to "Done" once the PR is merged and the build passes.