Findings
become
tickets.

Turn what's wrong in a repo into Jira tickets, then into reviewed pull requests, without a human retyping anything in between.

repo ──scan──▶ findings ──triage──▶ tickets in Jira ──claim──▶ solver agent ──verify──▶ draft PR
                                    ▲                                                │
                                    └──────────── next run reads both ───────────────┘

01 · the one idea

Run it twice and the second run
does nothing.

A pipeline reads input and produces output: run it twice, get twice as much. That is the wrong shape for anything writing to a board other people use. This computes what should exist, observes what does, and closes the gap.

First run

jiraagents plan
  create  fpv1-6d2e2a83  github-actions-mutable-action-tag
  create  fpv1-8dc34895  github-actions-mutable-action-tag
  create  fpv1-41c6464b  github-actions-mutable-action-tag
  create  fpv1-753af644  npm-missing-minimum-release-age

4 to create · 0 unchanged · 0 provisional

Same repo, after apply

jiraagents plan
  noop    fpv1-6d2e2a83  unchanged: WP-8 already tracks this
  noop    fpv1-8dc34895  unchanged: WP-9 already tracks this
  noop    fpv1-41c6464b  unchanged: WP-10 already tracks this
  noop    fpv1-753af644  unchanged: WP-11 already tracks this

0 to create · 4 unchanged · 0 provisional
  ↳ nothing to do: this is the converged state

That third run was made with the local index file deleted, so only Jira's own label search could recognise the four tickets, and it did. A bad run is convergent, not additive: run it again after a crash and it finishes the job.

02 · what it refuses to pretend

A zero it did not measure
is never printed as zero.

The most dangerous output a security tool can produce is a reassuring number nobody earned. Every stage either carries a measurement or states the reason it has none, and that distinction is enforced by the type system, not by the renderer.

PASSsemgrep 1.174.0 via uvx

FAILsemgrep-ruleset no ruleset p-ci is cached, so scan reports zero semgrep findings until it is

WARNscanner-trivy not installed: disables scan --deep (IaC, container and secret findings)

came back within 30 days not measured: that run had a scanner error, so it under-reports

raw findings not measured: no plan run has been recorded for this repository

Its own documentation opens with “this tool's precision has never been measured on a real project.” Nobody has run that experiment, so nothing here claims a number for it.

03 · how it holds together

One finding, one ticket

A fingerprint is computed from the tool, the rule, the path and the matched code, and deliberately not the line number. Add an import at the top of a file and nothing refiles.

plan() cannot write

It is a pure function. No network, no clock, no randomness. That is not a convention. It is why plan is safe to run on a Friday afternoon against a production board.

The agent never ships

A solver runs in a disposable worktree with realpath containment, produces a local commit and a draft PR. The agent takes no irreversible action; the CLI does, after seventeen gates.

Drift is refused, not hidden

If the scanner version or ruleset no longer matches the committed lock, every finding is marked provisional, and a provisional finding can never become a ticket.

Nothing is guessed

No project key is invented, no placeholder that could be mistaken for a real one. An unknown value is null, which is the one answer that cannot be misread.

Credentials stay put

It runs on your machine or in your CI, against your repo, with your tokens. There is no service in the middle and nobody else holds your Jira. The security page lists the hosts it contacts, and what is not yet documented.

04 · try it in about a minute

Four commands need no Jira,
no credentials, no config.

scan, sarif export, explain and audit export touch nothing but local files. Point the first at any git repository with a commit in it.

npm install -g @jadex-consulting/jiraagents --ignore-scripts

Public on npm. No install-time scripts, ever: a test fails the build if one appears. The flag costs you nothing here and protects you from every transitive dependency that has one.

cd ~/src/your-repo && jiraagents scan

Runs the pinned semgrep and osv-scanner, applies the prefilter, prints what survived. Files nothing. Writes nothing into your repo.

jiraagents doctor

doctor runs seventeen checks. FAIL means it cannot do its job; WARN names exactly which one feature you lose. Four warnings and no failures is a working install, and it exits 0.

05 · what it costs

Reading is free.
Writing will need a licence.

Everything that looks runs with no key and no account, and so does everything that undoes. Two commands write outside your machine: apply files the planned Jira issues and solve opens draft pull requests. Those two are what a licence is for.

Licences are not on sale yet. Until they are, no version of the tool enforces one. The pricing page explains the model it will be sold under, what cannot be promised, and what the licence inside the package says today.

Findingsbecometickets.

Run it twice and the second rundoes nothing.