Atlassian MCP (Jira, Confluence)

Run the Model Context Protocol (MCP) Atlassian server in Docker, enabling integration with Jira, Confluence, and other Atlassian products. Use when you need to query Jira issues, search Confluence, or interact with Atlassian services programmatically. Requires Docker and valid Jira API credentials.

Security Scan

The skill's instructions match its stated purpose (running an MCP Atlassian Docker image) but it requires sensitive Jira credentials and pulls an unreviewed container from GHCR while the registry metadata does not declare those credentials — you should verify and limit what you run before installing.

Purpose & Capability

Name/description (run an MCP Atlassian server to access Jira/Confluence) aligns with the provided instructions and script: both pull and run ghcr.io/sooperset/mcp-atlassian:latest with JIRA_URL, JIRA_USERNAME, and JIRA_API_TOKEN.

Instruction Scope

SKILL.md instructs the agent/user to pull and run the Docker image and to provide Jira credentials. The bundled script only validates env vars and runs the container, echoing the URL and username to stdout. It does not read other system files, but the SKILL metadata does not declare the env vars even though the runtime needs them.

Install Mechanism

There is no install spec (instruction-only) and the runtime pulls a container from ghcr.io/sooperset — GHCR is a known registry, but the image contents are unreviewed. Pulling/running a remote container executes third-party code and requires trusting that image.

Credentials

The skill requires JIRA_URL, JIRA_USERNAME, and JIRA_API_TOKEN to function — these are appropriate for the stated purpose but were not declared in the skill's registry metadata (required envs/primary credential are empty). Passing a long-lived API token into an unverified container can expose credentials if the container exfiltrates data or logs envs; the script also prints the URL/username to stdout (possible log leakage).

Persistence & Privilege

The skill does not request always:true, does not modify other skills, and is instruction-only. However, running the container grants it network and runtime privileges on the host (typical for Docker) — so trust boundaries depend on how you run it (user context, network, mounts).

What to consider before installing

This skill will pull and run a third-party Docker image (ghcr.io/sooperset/mcp-atlassian:latest) and requires your Jira URL, username, and API token. That is necessary for its stated function, but the registry metadata did not declare these env vars and the image source is 'unknown' / no homepage provided. Before installing: 1) Verify the image owner and inspect the image (docker pull; docker image inspect; docker scan or a vulnerability scanner). 2) Prefer creating a least-privilege Jira API token (service account) rather than using a personal token. 3) Avoid passing long-lived secrets as plain env vars on long-lived hosts; use ephemeral tokens, docker secrets, or run in an isolated ephemeral environment. 4) Review the container's code/release if possible or run it in a network-isolated sandbox to observe behavior. 5) Be aware that the script prints JIRA_URL and JIRA_USERNAME to stdout (may go to logs). If you cannot verify the image/source or limit the token's scope, do not run this skill with sensitive credentials.

MCP Atlassian

Overview

The MCP Atlassian server provides programmatic access to Jira and other Atlassian services through the Model Context Protocol. Run it in Docker with your Jira credentials to query issues, manage projects, and interact with Atlassian tools.

Quick Start

Pull and run the container with your Jira credentials:

docker pull ghcr.io/sooperset/mcp-atlassian:latest

docker run --rm -i \
  -e JIRA_URL=https://your-company.atlassian.net \
  -e JIRA_USERNAME=[e-mail] \
  -e JIRA_API_TOKEN=your_api_token \
  ghcr.io/sooperset/mcp-atlassian:latest

With script (faster):

Run the bundled script with your API token:

JIRA_API_TOKEN=your_token bash scripts/run_mcp_atlassian.sh

Environment Variables

• JIRA_URL: Your Atlassian instance URL (e.g., https://company.atlassian.net)
• JIRA_USERNAME: Your Jira email address
• JIRA_API_TOKEN: Your Jira API token (create in Account Settings → Security)

Using MCP Atlassian with Clawdbot

Once running, the MCP server exposes Jira tools for use. Reference the container as an MCP source in your Clawdbot config to query issues, create tasks, or manage Jira directly from your agent.

Resources

scripts/

• run_mcp_atlassian.sh - Simplified runner script with credential handling