Atlassian MCP Infrastructure

Hardened, single-tenant Docker infrastructure for Jira and Confluence Cloud through Model Context Protocol clients.

This repository does not contain or fork an MCP application. It runs Docker's digest-pinned mcp/atlassian image behind a separate, authenticated, loopback-only proxy. The image is built by Docker from the MIT-licensed sooperset/mcp-atlassian project. It is not an official Atlassian product.

Security boundary

flowchart LR
    Client[Trusted local MCP client] -->|Bearer token<br/>127.0.0.1:8000/mcp| Proxy[Unprivileged NGINX proxy]
    Proxy -->|Authorization stripped<br/>internal network| MCP[mcp/atlassian]
    MCP -->|HTTPS egress| Cloud[Jira and Confluence Cloud]
    MCP --> Workspace[(Explicit attachment workspace)]
    Proxy -. only .-> MCPSecret[MCP bearer secret]
    MCP -. only .-> AtlassianSecrets[Jira and Confluence tokens]

Only the proxy publishes a host port. The backend uses an internal network for proxy traffic and a separate network for Atlassian Cloud egress. Both services run without root, Linux capabilities, writable root filesystems, or Docker socket access.

Write tools are intentionally enabled. The proxy authenticates MCP clients but does not add approvals to Jira or Confluence operations. Use a dedicated least-privilege Atlassian service account, configure project and space filters, and require consequential-tool confirmation in the MCP client.

Related MCP server: MCP Atlassian Node Server

Quick start

Requirements are Linux, OpenSSL, Docker Engine, and Docker Compose.

1. Initialize owner-only runtime files:

   scripts/bootstrap.sh

2. Edit .env. Configure Jira Cloud, Confluence Cloud, or both. At least one product needs its URL, service-account email, and matching token file:

   printf '%s' 'your-jira-api-token' >secrets/jira_api_token
   printf '%s' 'your-confluence-api-token' >secrets/confluence_api_token
   chmod 600 secrets/*_api_token

   Leave all variables and the corresponding token file empty to disable one product. Set JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER before startup whenever the service account spans more content than clients need.

3. Validate and start:

   scripts/validate-compose.sh
   docker compose up -d
   curl --fail http://127.0.0.1:8000/healthz

4. Configure a Streamable HTTP MCP client for http://127.0.0.1:8000/mcp with:

   Authorization: Bearer <contents of secrets/mcp_api_token>

   The bearer token is generated once and is never printed by bootstrap.

The attachment tools can read and write only paths within the mounted workspace/ directory. In tool arguments, use paths relative to the upstream working directory, such as workspace/report.pdf.

Operations

• Health endpoint: http://127.0.0.1:${MCP_PORT:-8000}/healthz

• MCP endpoint: http://127.0.0.1:${MCP_PORT:-8000}/mcp

• Transport: Streamable HTTP

• Tool selection: all upstream toolsets

• Write mode: enabled by default

• Public ingress: none

See the operations guide for rotation, upgrades, filtering, recovery, and read-only smoke validation. Architecture and trust decisions are in architecture, and repository checks are in testing.

Development and Jenkins

scripts/ci-bootstrap.sh
scripts/validate-static.sh
scripts/test-native.sh
scripts/validate-compose.sh

JenkinsService consumes the same static and test commands from .jenkins/pipeline.yaml, adds mandatory Gitleaks and Trivy scans, and permits network access only during locked development dependency bootstrap.

License

Repository-authored infrastructure and documentation use the PolyForm Noncommercial License 1.0.0; see LICENSE. Third-party images retain their own licenses and are not redistributed or relicensed by this repository; see THIRD_PARTY_LICENSES.md.

Atlassian, Jira, and Confluence are trademarks of Atlassian and its affiliates. This project is independent and is not endorsed by Atlassian.