Atlassian
MCP server for Atlassian tools (Confluence, Jira)
Project links
How to use it
- Open the listing page and read the server's documentation.
- Copy the configuration or command into your MCP client.
- Restart the client and try one of the server's tools.
Copy setup details
Use these instructions in your own environment. Copying text here does not run it.
MCP configuration 1
Copy into a client that accepts mcpServers JSON. Other clients may use a different configuration format.
{
"mcpServers": {
"mcp-atlassian": {
"command": "uvx",
"args": [
"mcp-atlassian"
],
"env": {
"JIRA_URL": "https://your-company.atlassian.net",
"JIRA_USERNAME": "[email protected]",
"JIRA_API_TOKEN": "your_api_token",
"CONFLUENCE_URL": "https://your-company.atlassian.net/wiki",
"CONFLUENCE_USERNAME": "[email protected]",
"CONFLUENCE_API_TOKEN": "your_api_token"
}
}
}
}MCP configuration 2
Copy into a client that accepts mcpServers JSON. Other clients may use a different configuration format.
{
"mcpServers": {
"mcp-atlassian": {
"command": "uvx",
"args": [
"mcp-atlassian"
],
"env": {
"JIRA_URL": "https://your-company.atlassian.net",
"JIRA_USERNAME": "[email protected]",
"JIRA_API_TOKEN": "your_api_token",
"CONFLUENCE_URL": "https://your-company.atlassian.net/wiki",
"CONFLUENCE_USERNAME": "[email protected]",
"CONFLUENCE_API_TOKEN": "your_api_token"
}
}
}
}Security checks
Automated checks, last run Nov 2, 2026. They can miss problems and do not guarantee a listing is safe. Read the source and what you are asked to run before you use it.
- NoteKnown vulnerabilities in the packageLayer 2
OSV.dev lists advisories for some versions of this package. Make sure you install a release that fixes them.
Evidence (8)
- mcp-atlassian (any version): GHSA-2xj6-xx86-cwwc
- MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue
- mcp-atlassian (any version): GHSA-3r68-hf9h-887v
- MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
- mcp-atlassian (any version): GHSA-4596-2p6p-28cv
- MCP Atlassian: Insecure File Permissions on OAuth Token Storage
- mcp-atlassian (any version): GHSA-489g-7rxv-6c8q
- MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
- mcp-atlassian (any version): GHSA-49xv-9743-pw8w
- MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
- mcp-atlassian (any version): GHSA-5wf4-jqxh-8gm3
- mcp-atlassian has an incomplete SSRF remediation
- mcp-atlassian (any version): GHSA-6529-c226-h328
- MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
- mcp-atlassian (any version): GHSA-6cr4-ccf3-x7h4
- MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials
Source: OSV.dev
- PassedSetup commands and descriptionLayer 1
No blocking patterns. Notes are listed in the evidence.
Evidence (1)
- note: unpinned-package
- mcp-atlassian: uvx runs "mcp-atlassian" without a pinned version, so whoever owns that package name can change what runs
Source: AIWantsThis screening rules
- PassedSource repositoryLayer 2
The repository is public, not archived and has recent activity.
Evidence (3)
- Last push
- 2026-09-19
- Archived
- no
- License
- MIT
Source: GitHub