This repository packages a hosted Atlassian service
Atlassian Rovo MCP Server connects an AI client to Jira, Confluence, Jira Service Management, Bitbucket Cloud, and Compass. The client can search or read existing work and, when allowed, create or update it. Atlassian hosts the endpoint at mcp.atlassian.com; the GitHub repository contains manifests, connection metadata, skills, documentation, and tests around that service. Cloning the repository does not give you the production server that processes Atlassian data.
GitHub reported 47 files and roughly 1,392 source lines in our measured commit. Separate manifests support Agent Plugins v1, Claude Code, Cursor, Gemini extensions, and the MCP Registry while sharing the same remote endpoint. Atlassian retains control of the runtime, so hosted behavior can change separately from this checkout.
Five Atlassian products use 2 authentication paths
Jira and Confluence work with OAuth 2.1 or API tokens. Jira Service Management and Bitbucket Cloud require scoped API-token authentication, while Compass requires OAuth. The split matters for mixed-product agents because one login method does not unlock every tool family. For headless use, an organization admin must first enable API-token authentication, after which the operator creates a token containing only the scopes the automation needs.
A local MCP client can connect through mcp-remote with Node.js 18 or newer. OAuth usually opens a browser consent flow. The first eligible user authorizing a site causes the app to appear under connected third-party apps, where admins can review or revoke access. Restricted organizations should settle that policy before users connect clients.
What happened when we ran it
Our sandbox installed 2 npm packages in 4 seconds. The repository exposed no build target, so the build step was skipped rather than counted as a success or failure. Node's test runner passed all 17 tests in 9 seconds with 0 failures. Npm audit reported 0 known vulnerabilities at critical, high, moderate, and low severity in the measured dependency set.
The checkout had 0 CI workflow files, no Dockerfile, and no tests directory, despite the command finding 17 test cases. These measurements cover commit 06403d5 and its packaging logic. They do not test OAuth against a real tenant, hosted tool responses, Jira write idempotency, or large Confluence edits. The 2 MB install does not describe Atlassian's cloud runtime.
JQL search can expose 5 rows while hiding the rest
Issue 225 documents a current failure in searchJiraIssuesUsingJql: requests with maxResults set to 100 returned 5 issues, reported more matches, and provided no usable cursor. The reporter reproduced it on separate projects and compared the same JQL against Jira's REST API, which paginated through the complete set. Issue 221 describes the same 5-row behavior. Aggregate status, release scope, and velocity summaries are unsafe unless the caller reconciles retrieved rows with the reported total.
For a quick lookup, 5 results may be enough. For reporting, silently incomplete data is worse than a hard failure because the prose answer can sound finished. Until the endpoint returns a working cursor, use the direct Jira REST API for exhaustive queries or reject an MCP result whenever remainingCount is positive and no next page is available.
Confluence edits replace the entire page body
Issue 210 says updateConfluencePage requires the complete page body even for a small local change. A client must fetch, modify, and resend all content, which risks losing Atlassian-specific markup or unrelated formatting during conversion. Issue 218 adds a client-specific constraint: Confluence writes above roughly 5 KB were blocked at Anthropic's Cloudflare edge, while larger reads succeeded. That report assigns the block to the client path, not Atlassian.
Jira writes deserve similar caution. Issue 132 reports pairs of identical tickets created 4 to 20 milliseconds apart after one tool invocation in Claude. We did not reproduce that tenant and client setup, so it is a report rather than a universal result. It is enough reason to require confirmation, include a unique request marker in automation, and search for an existing issue before retrying a failed response.
Existing permissions do not remove prompt-injection risk
The server respects the connected user's permissions, supports TLS 1.2 or later, honors relevant IP allowlists, and records each tool use in the organization audit log. Admins can control allowed external AI domains for OAuth connections. A broadly privileged user still gives the agent broadly privileged tools. Issue 79 asks for an MCP-specific restriction to selected projects or spaces, which shows that finer isolation remains a user concern.
Atlassian's README directly warns about indirect prompt injection and tool poisoning. Content read from a ticket or page can contain instructions aimed at the model, and a capable client may then expose data or make an unwanted change. Start read-only, use narrow accounts or scopes, keep high-impact writes behind human confirmation, and review MCP audit events.
August activity is current, but there is no latest release
The repository was pushed on August 26, 2026 and had 994 stars plus 84 open issues and pull requests when fetched. GitHub's latest-release endpoint returned no release object. Current commits and issue updates show active work, including Agent Plugins v1 packaging at the measured commit.
For Atlassian Cloud customers, the official endpoint is the shortest supported route from an agent to company work. The 17 passing repository tests make its packaging look tidy. Production trust still depends on permissions, tenant tests, client behavior, and how the team handles incomplete reads or repeated writes. Start with search and summaries, compare JQL totals, and add write tools only after an administrator can see and reverse what the agent does.