mcp-atlassianSAFE
MCP server for seamless Atlassian integration (Confluence & Jira) with AI assistants
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
This is a maintained fork of [Vijay-Duke/mcp-atlassian](https://github.com/Vijay-Duke/mcp-atlassian) Why this fork exists: In January 2026, Atlassian removed the/rest/api/3/searchendpoint entirely, breaking all Jira search functionality in the original package. This fork migrates to the new/rest/api/3/search/jqlendpoint and implements the new cursor-based pagination. A PR has been submitted to upstream, but as of now there are 14+ unmerged PRs in that repo. Install this fork:npm install @efithor/mcp-atlassian --registry=https://npm.pkg.github.com
[](https://opensource.org/licenses/MIT)
A Model Context Protocol (MCP) server for integrating with Atlassian products (Confluence and Jira). This server provides tools for AI assistants to interact with Atlassian Cloud APIs, enabling document management, search, and export capabilities.
Features
Confluence Integration
- Read & Search: Access pages, spaces, and content
- Content Management: Create, update pages and comments
- Page Hierarchy: Navigate parent/child page relationships
- Export: Export pages as HTML or Markdown with embedded images
- Attachments: List, download, and upload attachments
- Labels: Manage page labels
- Users: Find and query users, track personal activity
- Personal Dashboard: View recent pages and mentions
Jira Integration
- Issues: Read and search issues, get personal tasks
- Projects: List and explore projects
- Boards & Sprints: List boards, view sprints, track active work
- Comments: Add comments to issues
- Issue Creation: Create new issues with custom fields
- User Management: Get current user details
- Personal Dashboard: View your open issues and sprint tasks
Installation
Option 1: GitHub Packages (Recommended)
First, configure
bdaed0b0d58cOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-atlassian --env ATLASSIAN_API_TOKEN=${ATLASSIAN_API_TOKEN} -- npx -y @efithor/[email protected]{
"mcpServers": {
"mcp-atlassian": {
"command": "npx",
"args": [
"-y",
"@efithor/[email protected]"
],
"env": {
"ATLASSIAN_API_TOKEN": "${ATLASSIAN_API_TOKEN}"
}
}
}
}Exposed tools (44)
36 read · 8 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Bug | read | A bug |
Task | read | A task |
add_confluence_comment | write | Adds a comment to a Confluence page. Can also be used to reply to an existing comment. |
add_confluence_page_label | write | Adds one or more labels to a Confluence page. Labels are useful for organizing and categorizing content. |
add_jira_comment | write | Adds a comment to an existing Jira issue. You can also control the visibility of the comment. |
create_confluence_page | write | Creates a new page or blog post in a Confluence space. Content can be provided in Markdown or Confluence storage format (XHTML). |
create_jira_issue | write | Creates a new issue in a Jira project. You must specify the project, issue type, and a summary. Other fields like description, priority, and assignee are optional. |
download_confluence_attachment | read | Downloads a specific Confluence attachment and returns its content as a base64-encoded string. This is useful for reading the content of files attached to a page. |
export_confluence_page | read | Exports a Confluence page to either HTML or Markdown format. All images in the page content are embedded directly into the exported file as base64 data, making it self-contained. **Use this when you want to create a portable, self-contained file of a page.** |
find_confluence_users | read | Searches for Confluence users based on various criteria. This is useful for finding user details like account IDs when you have partial information or need to perform a broader search. **Use this tool when you need to find users based on a query.** |
get_confluence_current_user | read | Get details of the authenticated Confluence user. Returns information about the current user including account ID, display name, email, and profile picture. |
get_confluence_pages_mentioning_me | read | Search for pages that mention the current user. Returns pages where you have been @mentioned. |
get_confluence_space | read | Get details of a specific Confluence space by its key. Returns space information including name, type, status, and description. |
get_confluence_user | read | Get details for a specific Confluence user by a unique identifier like username, account ID, or email. Returns user profile information. **Use this tool when you are confident you can uniquely identify a user.** |
get_jira_current_user | read | Get details of the authenticated Jira user. Returns information about the current user including account ID, display name, email, and avatar URLs. |
get_jira_user | read | Get details for a specific Jira user by username, account ID, or email. Returns user profile information. |
get_my_current_sprint_issues | read | Get all issues assigned to you in the currently active sprint(s). Useful for daily standups or checking your current sprint workload. Can filter by specific board or project. |
get_my_recent_confluence_pages | read | List pages recently created or updated by the current user. Returns pages where you are the creator or last modifier. |
get_my_unresolved_issues | read | Get all unresolved issues currently assigned to you, organized by status and priority. Perfect for checking your backlog or identifying what needs attention. |
get_page_with_attachments | read | Performs a comprehensive download of a Confluence page, including its full content, metadata, and optionally, all of its attachments. Attachments are base64-encoded. **Use this when you need the page content, metadata, and all associated attachments.** |
get_sprint_details | write | Get comprehensive details about a specific sprint including its name, start/end dates, goals, and all issues included in the sprint. |
get_user_activity_history | read | Get a stream of recent user activity, such as issue comments, status changes, and field updates. Can filter by activity type and project. |
get_user_time_tracking | read | Retrieve time tracking work logs (worklogs) for a specific user. Shows all time entries logged by the user within a date range, useful for timesheet and worklog reporting. |
list_agile_boards | read | List all accessible Agile boards (both Scrum and Kanban types). Can be filtered by project or board type to find specific boards. |
list_attachments_on_page | read | Lists all attachments for a specific Confluence page. Can be filtered by filename or media type. |
list_attachments_uploaded_by_user | read | List all attachments uploaded by a specific user, with optional filtering by space. |
list_confluence_page_ancestors | read | Retrieve the parent hierarchy of a Confluence page. Returns the full ancestry path from root to the immediate parent. |
list_confluence_page_children | read | List child pages under a given Confluence page. Returns a hierarchical list of direct child pages. |
list_confluence_page_labels | read | Retrieves all labels for a specific Confluence page. |
list_confluence_spaces | read | Lists all Confluence spaces that the user has permission to view. Can be filtered by type and status. |
list_issues_by_user_role | read | List issues where a user has a specific role (assignee, reporter, or creator). Includes date filtering for finding issues within specific time periods. |
list_jira_projects | read | Lists all Jira projects that the user has permission to view. This is useful for discovering available projects to work with. |
list_pages_created_by_user | read | List all pages created by a specific user, with optional filtering by space or time range. |
list_sprints_for_board | read | List all sprints for a specific Agile board. Can filter by sprint state (active, closed, or future) to find current or historical sprints. |
read_confluence_page | read | Retrieves the content of a Confluence page. You can specify the page by its ID or by its title and space key. The content can be returned in raw storage format (XHTML) or converted to Markdown. **Use this for quickly reading the text content of a page.** |
read_jira_issue | read | Retrieves detailed information about a specific Jira issue, including its fields, status, and transitions. Use this to get the full picture of a single issue. |
search_confluence_pages | read | Performs a search for Confluence pages using Confluence Query Language (CQL). This is useful for finding pages that match specific criteria. |
search_issues_by_user_involvement | read | Search for issues based on how a specific user is involved (assignee, reporter, creator, watcher, or any). Provides comprehensive filtering to find all issues a user is connected to. |
search_jira_issues | read | Searches for Jira issues using Jira Query Language (JQL). This is the primary way to find issues that match specific criteria. |
search_pages_by_user_involvement | read | Search pages based on a user |
test_confluence_tool | read | Test tool |
test_jira_tool | read | Test tool |
update_confluence_page | write | Updates an existing Confluence page. You must provide the page ID and its current version number to prevent conflicts. You can update the title, content, or both. |
upload_confluence_attachment | write | Upload a file attachment to a Confluence page. The file should be provided as a base64-encoded string. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (10)
.all-contributorsrc
.npmrc.github
.prettierignore
.releaserc.json
import { ConfluenceHandlers } from '../../confluence/handlers.js';import { JiraHandlers } from '../../jira/handlers.js';import { confluenceTools } from '../../confluence/tools.js';import { jiraTools } from '../../jira/tools.js';import { confluenceTools } from '../../confluence/tools.js';@modelcontextprotocol/sdk, @types/form-data, axios, dompurify, dotenv, form-data, https-proxy-agent, winston
Gates applied: no_behavioural_pass.
bdaed0b0d58cfull audit observations/trust-audit/mcp-server/vijay-duke__mcp-atlassian.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | bdaed0b0d58c | SAFE | B | 89 | first audit |
Questions
What is the mcp-atlassian MCP server?
MCP server for seamless Atlassian integration (Confluence & Jira) with AI assistants
What tools does mcp-atlassian expose?
44 in total: 36 read-only, 8 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-atlassian safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does mcp-atlassian need?
It reads ATLASSIAN_API_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does mcp-atlassian run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @efithor/mcp-atlassian at 3.0.0.
How current is this page?
The grade is for one exact copy of the source (bdaed0b0d58c), read on 2026-10-12. The repository is watched and re-audited when it changes.