Atlas / MCP servers / vijay-duke / mcp-atlassian

mcp-atlassianSAFE

mcp/vijay-duke/mcp-atlassian

MCP server for seamless Atlassian integration (Confluence & Jira) with AI assistants

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
44 36r · 8w · 0d
Transport
stdio
License
MIT
Stars
2
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

This is a maintained fork of [Vijay-Duke/mcp-atlassian](https://github.com/Vijay-Duke/mcp-atlassian) Why this fork exists: In January 2026, Atlassian removed the /rest/api/3/search endpoint entirely, breaking all Jira search functionality in the original package. This fork migrates to the new /rest/api/3/search/jql endpoint and implements the new cursor-based pagination. A PR has been submitted to upstream, but as of now there are 14+ unmerged PRs in that repo. Install this fork: npm install @efithor/mcp-atlassian --registry=https://npm.pkg.github.com

[](https://opensource.org/licenses/MIT)

A Model Context Protocol (MCP) server for integrating with Atlassian products (Confluence and Jira). This server provides tools for AI assistants to interact with Atlassian Cloud APIs, enabling document management, search, and export capabilities.

Features

Confluence Integration

  • Read & Search: Access pages, spaces, and content
  • Content Management: Create, update pages and comments
  • Page Hierarchy: Navigate parent/child page relationships
  • Export: Export pages as HTML or Markdown with embedded images
  • Attachments: List, download, and upload attachments
  • Labels: Manage page labels
  • Users: Find and query users, track personal activity
  • Personal Dashboard: View recent pages and mentions

Jira Integration

  • Issues: Read and search issues, get personal tasks
  • Projects: List and explore projects
  • Boards & Sprints: List boards, view sprints, track active work
  • Comments: Add comments to issues
  • Issue Creation: Create new issues with custom fields
  • User Management: Get current user details
  • Personal Dashboard: View your open issues and sprint tasks

Installation

Option 1: GitHub Packages (Recommended)

First, configure

Read from source at commit bdaed0b0d58cOBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add mcp-atlassian --env ATLASSIAN_API_TOKEN=${ATLASSIAN_API_TOKEN} -- npx -y @efithor/[email protected]
claude-desktop
{
  "mcpServers": {
    "mcp-atlassian": {
      "command": "npx",
      "args": [
        "-y",
        "@efithor/[email protected]"
      ],
      "env": {
        "ATLASSIAN_API_TOKEN": "${ATLASSIAN_API_TOKEN}"
      }
    }
  }
}
03

Exposed tools (44)

36 read · 8 write · 0 destructive.

ToolRiskDescription
BugreadA bug
TaskreadA task
add_confluence_commentwriteAdds a comment to a Confluence page. Can also be used to reply to an existing comment.
add_confluence_page_labelwriteAdds one or more labels to a Confluence page. Labels are useful for organizing and categorizing content.
add_jira_commentwriteAdds a comment to an existing Jira issue. You can also control the visibility of the comment.
create_confluence_pagewriteCreates a new page or blog post in a Confluence space. Content can be provided in Markdown or Confluence storage format (XHTML).
create_jira_issuewriteCreates a new issue in a Jira project. You must specify the project, issue type, and a summary. Other fields like description, priority, and assignee are optional.
download_confluence_attachmentreadDownloads a specific Confluence attachment and returns its content as a base64-encoded string. This is useful for reading the content of files attached to a page.
export_confluence_pagereadExports a Confluence page to either HTML or Markdown format. All images in the page content are embedded directly into the exported file as base64 data, making it self-contained. **Use this when you want to create a portable, self-contained file of a page.**
find_confluence_usersreadSearches for Confluence users based on various criteria. This is useful for finding user details like account IDs when you have partial information or need to perform a broader search. **Use this tool when you need to find users based on a query.**
get_confluence_current_userreadGet details of the authenticated Confluence user. Returns information about the current user including account ID, display name, email, and profile picture.
get_confluence_pages_mentioning_mereadSearch for pages that mention the current user. Returns pages where you have been @mentioned.
get_confluence_spacereadGet details of a specific Confluence space by its key. Returns space information including name, type, status, and description.
get_confluence_userreadGet details for a specific Confluence user by a unique identifier like username, account ID, or email. Returns user profile information. **Use this tool when you are confident you can uniquely identify a user.**
get_jira_current_userreadGet details of the authenticated Jira user. Returns information about the current user including account ID, display name, email, and avatar URLs.
get_jira_userreadGet details for a specific Jira user by username, account ID, or email. Returns user profile information.
get_my_current_sprint_issuesreadGet all issues assigned to you in the currently active sprint(s). Useful for daily standups or checking your current sprint workload. Can filter by specific board or project.
get_my_recent_confluence_pagesreadList pages recently created or updated by the current user. Returns pages where you are the creator or last modifier.
get_my_unresolved_issuesreadGet all unresolved issues currently assigned to you, organized by status and priority. Perfect for checking your backlog or identifying what needs attention.
get_page_with_attachmentsreadPerforms a comprehensive download of a Confluence page, including its full content, metadata, and optionally, all of its attachments. Attachments are base64-encoded. **Use this when you need the page content, metadata, and all associated attachments.**
get_sprint_detailswriteGet comprehensive details about a specific sprint including its name, start/end dates, goals, and all issues included in the sprint.
get_user_activity_historyreadGet a stream of recent user activity, such as issue comments, status changes, and field updates. Can filter by activity type and project.
get_user_time_trackingreadRetrieve time tracking work logs (worklogs) for a specific user. Shows all time entries logged by the user within a date range, useful for timesheet and worklog reporting.
list_agile_boardsreadList all accessible Agile boards (both Scrum and Kanban types). Can be filtered by project or board type to find specific boards.
list_attachments_on_pagereadLists all attachments for a specific Confluence page. Can be filtered by filename or media type.
list_attachments_uploaded_by_userreadList all attachments uploaded by a specific user, with optional filtering by space.
list_confluence_page_ancestorsreadRetrieve the parent hierarchy of a Confluence page. Returns the full ancestry path from root to the immediate parent.
list_confluence_page_childrenreadList child pages under a given Confluence page. Returns a hierarchical list of direct child pages.
list_confluence_page_labelsreadRetrieves all labels for a specific Confluence page.
list_confluence_spacesreadLists all Confluence spaces that the user has permission to view. Can be filtered by type and status.
list_issues_by_user_rolereadList issues where a user has a specific role (assignee, reporter, or creator). Includes date filtering for finding issues within specific time periods.
list_jira_projectsreadLists all Jira projects that the user has permission to view. This is useful for discovering available projects to work with.
list_pages_created_by_userreadList all pages created by a specific user, with optional filtering by space or time range.
list_sprints_for_boardreadList all sprints for a specific Agile board. Can filter by sprint state (active, closed, or future) to find current or historical sprints.
read_confluence_pagereadRetrieves the content of a Confluence page. You can specify the page by its ID or by its title and space key. The content can be returned in raw storage format (XHTML) or converted to Markdown. **Use this for quickly reading the text content of a page.**
read_jira_issuereadRetrieves detailed information about a specific Jira issue, including its fields, status, and transitions. Use this to get the full picture of a single issue.
search_confluence_pagesreadPerforms a search for Confluence pages using Confluence Query Language (CQL). This is useful for finding pages that match specific criteria.
search_issues_by_user_involvementreadSearch for issues based on how a specific user is involved (assignee, reporter, creator, watcher, or any). Provides comprehensive filtering to find all issues a user is connected to.
search_jira_issuesreadSearches for Jira issues using Jira Query Language (JQL). This is the primary way to find issues that match specific criteria.
search_pages_by_user_involvementreadSearch pages based on a user
test_confluence_toolreadTest tool
test_jira_toolreadTest tool
update_confluence_pagewriteUpdates an existing Confluence page. You must provide the page ID and its current version number to prevent conflicts. You can update the title, content, or both.
upload_confluence_attachmentwriteUpload a file attachment to a Confluence page. The file should be provided as a base64-encoded string.
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (10)

LOWInventory / provenance · inv.hidden_file · CWE-1104
.all-contributorsrc
.all-contributorsrc
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.npmrc.github
.npmrc.github
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.releaserc.json
.releaserc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/__tests__/confluence/handlers.test.ts:3
import { ConfluenceHandlers } from '../../confluence/handlers.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/__tests__/jira/handlers.test.ts:3
import { JiraHandlers } from '../../jira/handlers.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/__tests__/tools/confluence-tools.test.ts:2
import { confluenceTools } from '../../confluence/tools.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/__tests__/tools/jira-tools.test.ts:2
import { jiraTools } from '../../jira/tools.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/__tests__/tools/tool-integration.test.ts:2
import { confluenceTools } from '../../confluence/tools.js';
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, @types/form-data, axios, dompurify, dotenv, form-data, https-proxy-agent, winston
Why it matters. 23 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha bdaed0b0d58cfull audit observations/trust-audit/mcp-server/vijay-duke__mcp-atlassian.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12bdaed0b0d58cSAFEB89first audit
06

Questions

What is the mcp-atlassian MCP server?

MCP server for seamless Atlassian integration (Confluence & Jira) with AI assistants

What tools does mcp-atlassian expose?

44 in total: 36 read-only, 8 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is mcp-atlassian safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does mcp-atlassian need?

It reads ATLASSIAN_API_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does mcp-atlassian run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @efithor/mcp-atlassian at 3.0.0.

How current is this page?

The grade is for one exact copy of the source (bdaed0b0d58c), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement