Skip to main content

How to Connect Atlassian

🔧 Tools · MCP

The Atlassian Rovo MCP Server at https://mcp.atlassian.com/v1/mcp/authv2 exposes Jira (read/write issues, search), Confluence (pages, comments, spaces, search), and Compass. Every tool call runs with the connecting user's own Atlassian permissions.

Atlassian does not accept pre-registered OAuth apps for this server — there is no app to create. The platform registers its OAuth client automatically via Dynamic Client Registration (RFC 7591) on first connect. Instead, Atlassian identifies MCP clients by the domain of their redirect URI, and an organization admin controls which domains may connect.

1. Allow the Platform Domain in Atlassian Administration​

An organization admin of the Atlassian Cloud organization that owns the Jira/Confluence data must:

  1. Go to admin.atlassian.com and select the organization.
  2. Open Rovo → Rovo MCP server and make sure the MCP server is enabled for the organization.
  3. Select Add domain and add the platform API host as a URL pattern, e.g. https://api.zeta-alpha.com/** (see The Platform Callback URL for the host of your tenant).

See Control Atlassian Rovo MCP server settings for the full admin reference.

2. Add the Server to the Agent​

In Platform Admin, open the agent's Configuration and add this entry to mcp_tools_provider_configuration.servers (see Connecting MCP Servers):

{
  "transport": "streamable-http",
  "transport_config": {
    "streamable_http": {
      "url": "https://mcp.atlassian.com/v1/mcp/authv2",
      "name": "atlassian",
      "timeout": 30,
      "oauth_client": {
        "server_url": "https://mcp.atlassian.com/v1/mcp/authv2",
        "client_metadata": {
          "client_name": "Zeta Alpha MCP",
          "grant_types": ["authorization_code", "refresh_token"],
          "response_types": ["code"],
          "token_endpoint_auth_method": "client_secret_post",
          "redirect_uris": [
            "https://api.zeta-alpha.com/v0/service/mcp/oauth/callback"
          ]
        }
      },
      "terminate_on_close": true
    }
  }
}

Leave client_id and client_secret out: with no client_id configured, the platform performs Dynamic Client Registration against Atlassian and caches the resulting client per tenant.

The first connect performs endpoint discovery plus the client registration inside the MCP initialize call, which takes longer than the default 2-second setup timeout. Raise it at the provider level (sibling of servers):

{
  "mcp_tools_provider_configuration": {
    "enabled": true,
    "client_session_timeout_seconds": 15,
    "servers": [ ... ]
  }
}

3. Connect from the Navigator​

Open a new chat, select the agent, and ask it for something that needs Atlassian (e.g. "Find the Confluence page about onboarding"). Follow the Authorize atlassian link, sign in to Atlassian, and approve the requested scopes — see Connecting from the Navigator for the full walkthrough.

Troubleshooting​

SymptomCause
Atlassian login shows "Access to this domain is restricted"The redirect domain is not on the organization's allowed-domains list (step 1). If it was just added and the error persists, delete the entry and re-add it — see Atlassian's KB.
Logs show Request 'initialize' timed out and no Authorize link appearsclient_session_timeout_seconds is too low for the discovery + registration handshake (step 2).
Authorization succeeds but tools return permission errorsTokens carry the end user's own Atlassian permissions; the user lacks access to the requested project/space.