Atlassian MCP Server: Setup, Rovo Permissions and Security (Oct 2026)

Q: How do I add the Atlassian MCP server to Claude Code?

Run claude mcp add --transport http atlassian https://mcp.atlassian.com/v2/mcp, start a session, run /mcp and finish the OAuth sign-in in your browser. If your admin allows only API tokens, you'll need the header setup described above.

On this page

Atlassian MCP Server: Setup, Rovo Permissions and Security (Oct 2026)

The Atlassian MCP server (Rovo MCP server) is Atlassian's official hosted server for Jira, Confluence, Compass and more. TrustedMCP grades it A. Connect to https://mcp.atlassian.com/v2/mcp with OAuth 2.1. It acts with your own Atlassian permissions, and admins decide which risky tools and auth methods are allowed.

What it connects

The atlassian-mcp-server repo lists these products: Jira, Confluence, Jira Service Management, Bitbucket Cloud, Compass, Loom, Goals, Projects, Teams, Focus, Talent, and Atlassian platform data (Teamwork Graph).

Tools sit in permission groups by product and intent: read, write, search, delete or manage. For Jira that's read_jira, write_jira and search_jira, plus two admin-enabled groups, delete_jira and manage_jira.

There's no server for you to install or update. Atlassian runs it, and the repo holds the README, plugin packaging and skills rather than the server code.

Setup

Claude Code (from the README):

claude mcp add --transport http atlassian https://mcp.atlassian.com/v2/mcp

Then run /mcp in a session to authenticate.

Cursor: install the Atlassian plugin for Cursor from the Cursor marketplace and choose Add to Cursor. The README's one-click button does the same thing.

VS Code / GitHub Copilot: in the Extensions view, search @mcp Atlassian and select Install.

Any other MCP client: use the server URL https://mcp.atlassian.com/v2/mcp. Local clients that can't connect directly can go through the mcp-remote proxy, which needs Node.js v18 or later.

If you set up a custom client a while ago, check its URL. The README says the legacy SSE endpoint, https://mcp.atlassian.com/v1/sse, is no longer supported after 30 June 2026. The v1 /mcp endpoints still work, but v2 is recommended.

OAuth 2.1, API tokens and your permissions

OAuth 2.1 is the default. Atlassian's admin docs say: "By default, users connect AI tools to Atlassian MCP using OAuth 2.1." You sign in through a browser consent screen. Compass tools work only with OAuth.

It acts as you. Atlassian's overview says access "is scoped to the user's existing permissions in Atlassian," and the README adds that "all actions respect existing project or space-level roles." Your agent can't see a project you can't see. It can also edit anything you can edit.

API tokens are opt-in, and only an admin can turn them on. For headless setups the README documents two headers:

Mechanism	Header
Personal API token (Basic auth)	`Authorization: Basic <base64(email:api_token)>`
Service account API key (Bearer token)	`Authorization: Bearer <api_key>`

An organization admin must first enable API token authentication under Atlassian Administration → Rovo → Rovo MCP server → Authentication. Jira Service Management tools work only with API tokens, so they need that setting too. Give the token only the scopes your tools need, and keep it out of your config file as described in MCP authentication.

Admin controls

If you administer an Atlassian organization, these are the controls Atlassian documents:

Delete and manage tools are off by default. The README says delete_jira and manage_jira "are disabled by default and must be enabled by an admin before they can be used."
Permission groups. Admins grant or revoke access per permission group, and each tool inherits its group's access.
Domain controls. Atlassian-supported AI tool domains are allowed by default. You can add trusted domains or block supported ones. Domain controls apply to OAuth connections only, not API tokens.
IP allowlists. Your existing Atlassian Cloud IP allowlists also apply to MCP tool calls. Hosted AI clients may connect from the provider's IP addresses, not your VPN, so an allowed VPN may not be enough.
Audit log. Every tool call is recorded. Find them under Insights → Audit log in Atlassian Administration (filter for Rovo MCP User Actions or search MCP).

Users can also revoke their own app authorization from their profile settings.

The other "MCP Atlassian": sooperset/mcp-atlassian

Search for "MCP Atlassian" and you'll also find sooperset/mcp-atlassian, a popular community Python server that you run yourself. It isn't made by Atlassian, and it usually runs with a Jira or Confluence API token stored on your machine or server.

Every CVE below affects sooperset/mcp-atlassian, not Atlassian's Rovo MCP server. Its GitHub security advisories list 36 advisories in 2026:

February 2026, fixed in 0.17.0: CVE-2026-27825 (critical), an arbitrary file write through confluence_download_attachment that can lead to code execution, and CVE-2026-27826 (high), an SSRF through the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers.
July 2026, fixed in 0.22.0: 33 advisories, including CVE-2026-77244 (critical), where the HTTP transport accepted any non-empty token and fell back to the operator's own credentials, and CVE-2026-77254 (critical), where requests with no Authorization header could use the global Jira and Confluence credentials. Most of the rest are file reads through the attachment upload tools and incomplete SSRF fixes.
August 2026, fixed in 0.23.1: GHSA-5j8j-256g-vvp5 (critical, no CVE ID listed), unauthenticated tool execution when the server runs with --transport sse.

If you run sooperset/mcp-atlassian, upgrade to 0.23.1 or later, don't expose its HTTP port to a network, and rotate the API tokens it held. If you only use the official server at mcp.atlassian.com, none of these apply to you.

Prompt injection: other people's text reaches your model

Jira tickets, comments and Confluence pages are written by your colleagues, customers, and sometimes anyone who can file a ticket. When your agent reads them, that text goes straight into the model. A ticket can contain instructions aimed at your agent. Atlassian's own README warns that LLMs "are vulnerable to prompt injection" and that these attacks "can instruct the agent to exfiltrate data or make unintended changes."

What to do:

Keep tool approval on for write tools, and don't auto-approve them.
Leave delete_jira and manage_jira off unless you have a clear need.
Be careful in sessions where the agent can read Jira and also post to Slack, push code or send email. That's how injected text gets data out.

See the 5-minute safety check for the general process.

Why it grades A

Atlassian runs it over HTTPS with OAuth 2.1 by default. It acts only with your own permissions, and admins get real controls: tool groups, API tokens that are off until enabled, delete and manage tools that are off by default, domain rules, IP allowlists and a full audit log. Maintenance is active and no advisories are on record for this server. The main deduction is that the server code is closed source, so we can't review it ourselves.

Full breakdown on the Atlassian listing.

Frequently asked questions

How do I add the Atlassian MCP server to Claude Code?

Run claude mcp add --transport http atlassian https://mcp.atlassian.com/v2/mcp, start a session, run /mcp and finish the OAuth sign-in in your browser. If your admin allows only API tokens, you'll need the header setup described above.

How do I set up Atlassian MCP in Cursor?

Install the Atlassian plugin from the Cursor marketplace and choose Add to Cursor, then sign in when prompted. The plugin also bundles Atlassian's Cursor skills.

Is Atlassian MCP down? Where's the status page?

Atlassian publishes service status at status.atlassian.com. It lists Rovo, Jira, Confluence and other products, and you can subscribe by email, text or RSS. We didn't see a separate MCP entry, so watch Rovo and the product you're calling. If every call times out at once, check there before changing your config, then see MCP tool call timeouts.

Why do I get "You don't have permission to connect from this IP address"?

Your organization's IP allowlist is blocking the request. Hosted AI clients can call from the provider's IP ranges, so ask your admin to review them. A 403 after a successful sign-in can also mean missing scopes or app permissions.

Atlassian MCP vs Linear MCP?

Both are official hosted servers with OAuth. See the Linear MCP server guide if your team tracks work in Linear.

More: MCP authentication · MCP server security risks