MCP server · Audited from source

Atlassian Integration MCP server

by sooperset/mcp-atlassianMIT licenceAudited 21 Sep 2026 · source a8c91de74d0a

PyPI mcp-atlassianssestdiostreamable-http★ 5,926

✕BLOCKGrade D · 69/100 · 21 Sep 2026 · a8c91de

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade D (69/100). It exposes 4 tools: 4 read, 0 write and 0 destructive. The audit recorded 42 findings (0 critical, 3 high, 7 medium, 32 low). Maintainer's description: MCP server for Atlassian tools (Confluence, Jira)

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Atlassian Integration MCP server (sooperset/mcp-atlassian)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/sooperset/atlassian-integration

Why this is BLOCK. The audit found 0 critical and 3 high findings; the most severe is Network egress at src/mcp_atlassian/utils/urls.py:124. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

2 MCP servers are called Atlassian Integration. You are viewing sooperset/mcp-atlassian. Compare all 2 →

phuc-nt/mcp-atlassian-server★ 52!CAUTION
sooperset/mcp-atlassian★ 5,926✕BLOCK

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score69/100✕BLOCK D

0 critical3 high7 medium32 low0 info

42 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemNone observedNothing seen in the source
NetworkDeclared13 observations
ShellNone observedNothing seen in the source
DependenciesPinnedNothing floats
SecretsFoundSee the findings

Findings (42)

Sorted by severity · the 25 most severe of 42 are listed

HIGHNetwork egressnet.metadata_ip · src/mcp_atlassian/utils/urls.py:124

F-04 Network egressCWE-200 · CWE-319Layer L1

blocked_hostnames = {"localhost", "metadata.google.internal"}

Why: cloud metadata endpoint: the classic SSRF credential grab
Fix: —

HIGHNetwork egressnet.tls_off · src/mcp_atlassian/utils/ssl.py:164

F-04 Network egressCWE-200 · CWE-319Layer L1

super().cert_verify(conn, url, verify=False, cert=cert)

Why: certificate verification is disabled
Fix: leave verification on

HIGHNetwork egressnet.tls_off · src/mcp_atlassian/utils/ssl.py:193

F-04 Network egressCWE-200 · CWE-319Layer L1

verify=False,  # Always disable SSL verification for this adapter

Why: certificate verification is disabled
Fix: leave verification on

MEDIUMInformation disclosuredisclose.log_secret · src/mcp_atlassian/utils/toolsets.py:231

F-12 Information disclosureCWE-209 · CWE-532Layer L1

logger.warning(f"TOOLSETS: unknown toolset name '{token}' — ignoring.")

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.beacon_words · src/mcp_atlassian/servers/dependencies.py:1020

F-04 Network egressCWE-200 · CWE-319Layer L1

"exfiltration."

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · .env.example:70

F-04 Network egressCWE-200 · CWE-319Layer L1

#ATLASSIAN_OAUTH_ALLOWED_CLIENT_REDIRECT_URIS=http://localhost:*,http://127.0.0.1:*,https://chatgpt.com/connector_platform_oauth_redirect

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · src/mcp_atlassian/servers/main.py:56

F-04 Network egressCWE-200 · CWE-319Layer L1

"http://127.0.0.1:*",

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.zero_width · src/mcp_atlassian/jira/config.py:33

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

map(ord, "")  # ZWSP, ZWNJ, ZWJ, word-joiner, BOM

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · tests/unit/auth/test_authentication.py:208

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · tests/unit/auth/test_authentication.py:237

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · .mintignore

F-13 Inventory / provenanceCWE-1104Layer L0

.mintignore

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .pre-commit-config.yaml

F-13 Inventory / provenanceCWE-1104Layer L0

.pre-commit-config.yaml

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .worktreeinclude

F-13 Inventory / provenanceCWE-1104Layer L0

.worktreeinclude

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWCode injectioncode.deserialize · tests/unit/test_exceptions.py:150

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

unpickled_error = pickle.loads(pickled_data)

Why: deserialises untrusted bytes into live objects
Fix: use json or yaml.safe_load

LOWFilesystem / pathfs.traversal · tests/unit/confluence/test_attachments.py:1775

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"https://example.com/file", "../../../etc/passwd"

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · tests/unit/jira/test_attachments.py:1402

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"../../../etc/passwd",

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · tests/unit/jira/test_attachments.py:1403

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"normal/../../../etc/shadow",

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · tests/unit/jira/test_comments.py:1083

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"CC-1/../../PROJ-2",

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · tests/unit/utils/test_io.py:109

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

validate_safe_path("../../etc/passwd", base_dir=tmp_path)

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.beacon_words · tests/unit/confluence/test_attachments.py:1807

F-04 Network egressCWE-200 · CWE-319Layer L1

secret.write_bytes(b"SECRET-EXFIL")

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.beacon_words · tests/unit/jira/test_attachments.py:1538

F-04 Network egressCWE-200 · CWE-319Layer L1

secret.write_bytes(b"SECRET-EXFIL")

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.beacon_words · tests/unit/jira/test_attachments.py:1556

F-04 Network egressCWE-200 · CWE-319Layer L1

secret.write_bytes(b"SECRET-EXFIL")

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.beacon_words · tests/unit/servers/test_confluence_server.py:1209

F-04 Network egressCWE-200 · CWE-319Layer L1

secret.write_text("SECRET-EXFIL", encoding="utf-8")

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.metadata_ip · tests/unit/jira/test_client.py:124

F-04 Network egressCWE-200 · CWE-319Layer L1

internal_redirect.headers = {"Location": "http://169.254.169.254/latest/meta-data/"}

Why: cloud metadata endpoint: the classic SSRF credential grab
Fix: —

LOWNetwork egressnet.metadata_ip · tests/unit/servers/test_dependencies.py:2447

F-04 Network egressCWE-200 · CWE-319Layer L1

result = validate_url_for_ssrf("http://169.254.169.254")

Why: cloud metadata endpoint: the classic SSRF credential grab
Fix: —

Tools it exposes

4 declared in source · 0 destructive

4 read0 write0 destructive

Tool	What it does	Risk
`empty`	test	read
`legacy_outer`	return	read
`no_props`	test	read
`test_tool`	test	read

Safer alternatives

All project management servers →

mcp-atlassian✓SAFE

Vijay-Duke/mcp-atlassian

MCP server for seamless Atlassian integration (Confluence & Jira) with AI assistants

8 writeGrade B

Atlassian Rovo✓SAFE

atlassian/atlassian-mcp-server

Official remote MCP server for Atlassian. Securely connect Jira, Confluence, Jira Service Management, Bitbucket, and Compass to Claude, ChatGPT, Cursor, VS Code, and other AI tools using OAuth 2.1 or API tokens.

Grade B

Atlassian Confluence✓SAFE

aashari/mcp-server-atlassian-confluence

Node.js/TypeScript MCP server for Atlassian Confluence. Provides tools enabling AI systems (LLMs) to list/get spaces & pages (content formatted as Markdown) and search via CQL. Connects AI seamlessly to Confluence knowledge bases using the standard MCP interface.

1 destructiveGrade B

Audit history

2026-09-21
✕BLOCK D 69 / 100
Source changed, verdict held · a8c91de74d0a
2026-09-15
✕BLOCK D 69 / 100
First audit · 1c8f08d9a884

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Atlassian Integration MCP server

What is the Atlassian Integration MCP server?

MCP server for Atlassian tools (Confluence, Jira)

What tools does Atlassian Integration expose?

4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Atlassian Integration safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Atlassian Integration need?

It reads ATLASSIAN_OAUTH_ACCESS_TOKEN, ATLASSIAN_OAUTH_ALLOWED_CLIENT_REDIRECT_URIS, ATLASSIAN_OAUTH_ALLOWED_GRANT_TYPES, ATLASSIAN_OAUTH_CLIENT_ID, ATLASSIAN_OAUTH_CLIENT_SECRET, ATLASSIAN_OAUTH_CLOUD_ID, ATLASSIAN_OAUTH_ENABLE, ATLASSIAN_OAUTH_INSTANCE_URL, ATLASSIAN_OAUTH_REDIRECT_URI, ATLASSIAN_OAUTH_SCOPE, CLOUD_E2E_API_TOKEN and CLOUD_E2E_JSM_ISSUE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Atlassian Integration run?

It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as mcp-atlassian.

How current is this page?

The grade is for one exact copy of the source (a8c91de74d0a), read on 2026-09-21. The repository is watched and re-audited when it changes.

Which Atlassian Integration MCP server is the right one?

phuc-nt/mcp-atlassian-server. 2 servers share the name; see the side-by-side comparison.

I already installed Atlassian Integration. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

sooperset/mcp-atlassian on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — BLOCK verdict for commit a8c91de74d0aObserved · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Atlassian Integration MCP server?
GChatGPT CClaude PPerplexity
What tools does Atlassian Integration expose?
GChatGPT CClaude PPerplexity
Is Atlassian Integration safe to connect to an agent?
GChatGPT CClaude PPerplexity