Atlassian MCP server
Let Agent SRE read Jira and Confluence on Atlassian Cloud through Atlassian's hosted MCP server
Connecting the Atlassian MCP server to Agent SRE
Connect Atlassian Cloud's hosted Rovo MCP server (https://mcp.atlassian.com/v2/mcp) and Agent SRE reads your Jira issues and Confluence pages through the tools that server offers. The token's scopes decide what the agent can see.
Only Atlassian Cloud is supported. Atlassian's hosted server does not serve Data Center. To connect Data Center, use Confluence or Jira.
Read and search scopes only: You create the token with four scopes, all read or search: read:confluence:agent-interface, search:confluence:agent-interface, read:jira:agent-interface and search:jira:agent-interface. The agent cannot do more than these scopes allow.
Prerequisites
- An organisation admin turns on API tokens under Rovo → Rovo MCP server in Atlassian admin. Without this, Atlassian does not offer the Atlassian MCP V2 app when you create a token.
- Your Atlassian site is
https://<site>.atlassian.net, orhttps://<site>.jira.comfor older sites. - The KubeSense AI service can make outbound HTTPS requests to
mcp.atlassian.com.
Choose one of two ways to authenticate.
Service account API key (recommended)
The key belongs to the organisation, not to a person, so it keeps working when staff change.
- An organisation admin opens admin.atlassian.com → Directory → Service accounts and creates a service account, or picks an existing one.
- Choose Create credentials → API token.
- Select the app Atlassian MCP V2 and the four scopes listed above.
- Copy the key. Atlassian shows it once.
Personal API token
The token is tied to one person and stops working when that person leaves. You also enter that person's Atlassian account email.
- In KubeSense, choose Atlassian Cloud (personal token) and enter the Atlassian site URL.
- Once the URL is a valid Atlassian Cloud site, the API token field shows a Create a token in Atlassian link. It opens Atlassian's token page with the app and the four scopes already selected.
- Create the token and copy it.
Connecting
- Open Integrations and find Atlassian MCP server. Click Connect.
- Choose Atlassian Cloud service account or Atlassian Cloud (personal token).
- Fill in the form:
| Field | Service account | Personal token |
|---|---|---|
| Name | A label, for example Atlassian. Shown on the tile and part of the agent's tool names. | Same |
| Atlassian site URL | https://acme.atlassian.net | https://acme.atlassian.net |
| Atlassian account email | Not asked | The account the token belongs to |
| Service account API key / API token | The service account's API key | Your personal API token |
Keys and tokens are stored encrypted and never shown again after you save.
- Click Test connection. KubeSense opens the MCP server with your token and reports how many tools it offers.
- Click Save and enable.
A site URL that is not an Atlassian Cloud site is refused, for example a Data Center address.
What Agent SRE does with it
Agent SRE sees the tools the MCP server offers for your token. They appear as mcp__atlassian__<account>_<tool>, where <account> comes from the connection's name. It can search and read Jira issues and Confluence pages, and cites what it uses in its answer.
The agent passes your site URL to every tool, so it does not have to look it up.
Tools that change data are not available in investigations. In chat they would be offered only with your approval, but the four scopes above grant no write access.
If Confluence or Jira is also connected
If the same Atlassian Cloud site is also connected as Confluence or Jira, the agent uses the MCP server for that site. The built-in Confluence and Jira tools are not used for it. A Confluence or Jira connection to a different site, or to Data Center, keeps its built-in tools.
Switching off the MCP server on the connection (see The MCP server tab) gives the site back to the Confluence and Jira connections.
Managing connections
Clicking the tile opens the accounts page. You can pause a connection, re-run the connection test and remove it. The MCP server tab is described in The MCP server tab.
Access control
The Integrations RBAC module gates the page: Viewer sees connections, Editor can connect, edit, test and remove.
Troubleshooting
Test connection fails with HTTP 401 or 403
Atlassian refused the token. Check these in order:
- Wrong option. A personal API token pasted as a service account key is sent as a bearer token, which Atlassian refuses. Choose Atlassian Cloud (personal token) and enter your email.
- Wrong email. For a personal token, the email must belong to the account that created the token.
- Missing scopes. Create the token for the Atlassian MCP V2 app with the four scopes above.
- API tokens are off. An organisation admin turns them on under Rovo → Rovo MCP server.
"Accepted the token but offered no tools"
The token has no usable scopes. Create a new one with the four scopes above.
"Atlassian MCP V2" is not offered when you create a token
API tokens are off for the Rovo MCP server. Ask an organisation admin to turn them on under Rovo → Rovo MCP server in Atlassian admin.
The site URL is refused
Use https://<site>.atlassian.net, or https://<site>.jira.com for older sites. Data Center and other hosts are not supported.
Do I need the search:rovo:agent-interface scope?
No. It belongs to Rovo's search tool, which uses Rovo credits, and Agent SRE does not need it.