XenJira
Turn Jira tickets or plain prompts into reviewed code changes inside VS Code — with a human in the loop and nothing written to your project until you approve it.
A Developer agent writes the change, an AI reviewer checks it against the acceptance criteria and edge cases, a Security agent and a local rule scanner look for vulnerabilities, and the change is tested in an isolated sandbox copy of your project. You then approve (all or some files), request changes, or decline in one review panel.
Free trial, then $9 for 30 days. You use your own AI API key, so AI usage is billed by your provider at cost.
How a run works
- Ticket or prompt — pick a Jira ticket, or type what you want in the sidebar's Run a prompt box (no Jira needed).
- Predicted cost — low / expected / high price before anything runs; it learns from your past runs.
- Agents — Developer → AI review (criteria + edge cases) → AI security review, with live logs, tokens and cost.
- Sandbox — the proposed files are applied to a temporary copy of your project. Syntax checks run for every changed file, and your test command runs there (XenJira asks first, because AI-written code executes in that copy).
- Security & EU compliance scan — local, deterministic: secrets, injection, XSS, TLS, weak crypto, unsafe deserialisation, personal data in logs, and dependency (SBOM) changes.
- Your review — diff per file (also Open diff in VS Code's diff editor), check results, findings. Choose which files to apply.
- Apply only on approval — originals are backed up (Undo any time), files you edited meanwhile are never silently overwritten, and an optional commit includes only the applied files with an
AI-Assisted-By trailer.
Decline or Request changes never touch your workspace; the sandbox is deleted.
EU rules support
| Rule |
What XenJira does |
| AI Act — human oversight, Art. 50 transparency |
Nothing is applied without a human decision; changes are labelled AI-generated (review panel, audit log, optional commit trailer). |
| Cyber Resilience Act — Annex I (secure by design, no known exploitable vulnerabilities, SBOM) |
Rule-based scan of every added line (CWE-mapped); high/critical findings require a written reason to approve; dependency changes listed for your SBOM. |
| GDPR — data minimisation (Art. 5, 25) |
.env/key files are never sent; secrets inside files are redacted before code leaves your machine, and those files are read-only for the AI. |
| Record-keeping |
Every approve / decline / change request is written to a hash-chained audit log. XenJira: Export Audit Log produces a Markdown + JSONL report and shows whether the chain is intact. |
These features support compliance work; they are not legal advice or a certification.
Requirements
- VS Code 1.85+
- An AI API key — Anthropic Claude recommended (also OpenAI, Gemini, Groq, DeepSeek)
- Optional: Jira Cloud / Server with an API token (prompt mode works without Jira)
Getting started
- Click the ⚡ XenJira icon in the Activity Bar and sign in (your free trial starts on first sign-in).
- Open ⚙ Setup, add your AI key (stored in your OS keychain), pick a model, and optionally connect Jira.
- Type a prompt, or click ▶ on a ticket.
Why it is cheap
- Prompt caching: agent rules and your project context form a stable prefix — cached explicitly on Claude and implicitly on Gemini / OpenAI, and cache hits are shown and billed at the lower rate.
- Model routing: the strong model writes the change; a fast model does the review and security pass, and only the final attempt is reviewed.
- Targeted edits: large files are changed with search/replace blocks instead of being rewritten.
- Ranked context: only the most relevant files are sent, within a fixed budget.
- Thinking kept low on Gemini 2.5/3.x and Claude effort tuned for code edits; out-of-scope answers are not retried.
- Calibrated estimates from your own recent runs.
Commands
| Command |
|
| XenJira: Run a Prompt |
Free-text request, full review flow |
| XenJira: Start AI Pipeline |
Run a Jira ticket by key |
| XenJira: Open Review Panel |
Re-open the run waiting for your decision |
| XenJira: Undo Last Applied AI Change |
Restore the files from the backup |
| XenJira: Export Audit Log |
Evidence report (AI Act / CRA) |
| XenJira: Manage Subscription |
Open your account in the browser |
| XenJira: Show Runtime Logs |
Open the log output |
Settings
| Setting |
Default |
|
jiraAiAgent.runTestsInSandbox |
ask |
ask / always / never run your test command in the sandbox |
jiraAiAgent.testCommand |
npm test |
Test command used in the sandbox |
jiraAiAgent.testTimeoutSeconds |
180 |
Stop sandbox tests after this time |
jiraAiAgent.commitOnApprove |
false |
Commit only the applied files with an AI trailer |
jiraAiAgent.confirmCostBeforeRun |
true |
Ask before spending tokens |
jiraAiAgent.enableSecurityReview |
true |
Run the AI Security agent |
jiraAiAgent.maxRetries |
3 |
Developer retries when confidence is low |
jiraAiAgent.generateClaudeMd |
true |
Draft a CLAUDE.md once per repo (included in the review, never written directly) |
Privacy
Your Jira token and AI key stay in the OS keychain and are sent only over HTTPS to the XenJira server for the duration of a run; they are not stored there. Secret files are never sent, secrets inside files are redacted, and the sandbox never copies secret files.
© Xen Engineering — xenjira.xenengineering.com
| |
