Atlassian MCP Server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track official product coverage and OAuth scopes as Atlassian APIs evolve

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

AI access to Jira, Confluence, JSM, Bitbucket, Compass, Loom and Teamwork Graph

What we know

Atlassian's hosted remote MCP bridge for real-time access to Atlassian Cloud products and data.

Maintenance / activity evidence

Observed Sep 15, 2026 (UTC)Merge pull request 245 from atlassian/docs/rename-atlassian-mcp-server

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Inherits Atlassian user/org permissions. Reported action classes: Create/update/delete/manage where tools allow. Complete write authority is not verified.
OAuth 2.1/API token.
Sensitive access: Enterprise project/docs/service data

Official but powerful: it can read and mutate enterprise collaboration data within user/org permissions.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

1,084 repository stars

Stars observed Oct 6, 2026.

No canonical package metric applied.

All limitations / Review context

Which Atlassian products and account scopes are supported by the current server?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Official but powerful: it can read and mutate enterprise collaboration data within user/org permissions.
Inherits Atlassian user/org permissions.
OAuth 2.1/API token.
Real-time Atlassian Cloud data over HTTPS.
Reviewed write actions: Create/update/delete/manage where tools allow
Sensitive access: Enterprise project/docs/service data
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Commercial pricing
Complete tool inventory
JSM tools require API-token authentication.
Access is bounded by Atlassian permissions/admin settings.

Original activity observations

2026-09-15T19:26:26Z: Merge pull request 245 from atlassian/docs/rename-atlassian-mcp-server

Technical identity

github.com/atlassian/atlassian-mcp-server

Exact implementation source: https://github.com/atlassian/atlassian-mcp-server ↗
Reviewed resource type: MCP Server
Repository identity: atlassian/atlassian-mcp-server
Service endpoint: https://mcp.atlassian.com/v2/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
atlassian/atlassian-mcp-server
Recorded repository material and project history.
Evidence source ↗
mcp.atlassian.com/v2/mcp
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Connect remote MCP service

Codex

Publisher instructions with a documented client setup path.

Source evidence observed Oct 12, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Connect to Atlassian official Streamable HTTP endpoint https://mcp.atlassian.com/v2/mcp and finish supported OAuth 2.1 or API-token authentication in your client. Legacy `/v1/sse` is no longer supported since June 30, 2026.
codex mcp add atlassian --url https://mcp.atlassian.com/v2/mcp
Configure / authenticate
Publisher instructions
After adding the v2 URL in the chosen client, initiate Atlassian OAuth 2.1 in a trusted browser or the officially supported API-token flow. Approve only required Jira/Confluence/JSM scopes; do not paste keys into code.
Check connection
Suggested check
In Codex inspect codex mcp list; in Claude Code run /mcp to authenticate and verify discovered Atlassian tools. A successful local entry does not prove OAuth completion. Clients with stale v1 cached IDs may need an official cache refresh.
Remove / uninstall / revoke
MCP100 setup guide
Remove the matching MCP configuration from the client. This does not uninstall the local package or revoke provider credentials. Client disconnect (codex, only if registered using the name `atlassian`): `codex mcp remove atlassian`. This unregisters the client entry; it does not uninstall packages or revoke remote service credentials.
codex mcp remove atlassian

Official Documentation & Sources

What it does

Atlassian's hosted remote MCP bridge for real-time access to Atlassian Cloud products and data.

Capability: Productivity & Collaboration
Resource type: MCP Server
Best fit: AI access to Jira, Confluence, JSM, Bitbucket, Compass, Loom and Teamwork Graph

Representative uses

Search/update Jira/Confluence
Work with JSM
Access Bitbucket/Compass/Loom
Use Projects/Goals/Teams

Limitations

JSM tools require API-token authentication.
Access is bounded by Atlassian permissions/admin settings.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: OAuth 2.1/API token.
Permissions: Inherits Atlassian user/org permissions.
Data handling: Real-time Atlassian Cloud data over HTTPS.
Cost: unknown
Risk and cautions: Official but powerful: it can read and mutate enterprise collaboration data within user/org permissions.

Access scope and cautions

Write actions: Not verified Create/update/delete/manage where tools allow
Sensitive access: Enterprise project/docs/service data
Risk level: high

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Search/update Jira/Confluence; Work with JSM; Access Bitbucket/Compass/Loom; Use Projects/Goals/Teams.

What setup and authentication are documented?

Recorded installation/entrypoint step: claude mcp add --transport http atlassian https://mcp.atlassian.com/v2/mcp. Recorded endpoint: https://mcp.atlassian.com/v2/mcp. Recorded transport: streamable_http. Prerequisites: MCP client. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: OAuth 2.1 or API token.

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: Create/update/delete/manage where tools allow. Recorded permission context: Inherits Atlassian user/org permissions.

What data-handling boundary should I consider?

Real-time Atlassian Cloud data over HTTPS. Recorded sensitive-access context: Enterprise project/docs/service data.

What limitations and risks should I check before use?

Official but powerful: it can read and mutate enterprise collaboration data within user/org permissions. JSM tools require API-token authentication. Access is bounded by Atlassian permissions/admin settings. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

Atlassian is listed as First-party MCP in MCP100’s current evidence.