atlassian@r4

VERIFIED· not started

Publisher claims: "Tools for Atlassian products (Confluence and Jira). This integration supports both Atlassian Cloud and Jira Server/Data Center deployments." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher sooperset · publishing for 129 daysInstalls 180KLast detonated 40 h ago

$docker run -i --rm mcp/atlassian

Watch Report an issue

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: ATLASSIAN_OAUTH_ACCESS_TOKENATLASSIAN_OAUTH_ALLOWED_CLIENT_REDIRECT_URISATLASSIAN_OAUTH_ALLOWED_GRANT_TYPESATLASSIAN_OAUTH_CLIENT_IDATLASSIAN_OAUTH_CLIENT_SECRETATLASSIAN_OAUTH_CLOUD_IDATLASSIAN_OAUTH_ENABLEATLASSIAN_OAUTH_INSTANCE_URLATLASSIAN_OAUTH_REDIRECT_URIATLASSIAN_OAUTH_SCOPECONFLUENCE_API_TOKENCONFLUENCE_CLIENT_KEY_PASSWORDCONFLUENCE_OAUTH_CLIENT_IDCONFLUENCE_OAUTH_CLIENT_SECRETCONFLUENCE_PERSONAL_TOKENJIRA_API_TOKENJIRA_CLIENT_KEY_PASSWORDJIRA_OAUTH_CLIENT_IDJIRA_OAUTH_CLIENT_SECRETJIRA_PERSONAL_TOKEN or --oauth-setup / --client-secret / --confluence-token / --confluence-personal-token / --jira-token / --jira-personal-token / --oauth-client-secret / --oauth-access-token / --oauth-client-id / --oauth-redirect-uriConfiguration, not credentials: ATLASSIAN_PROXY_WPAD_URL, CONFLUENCE_ATTACHMENT_DOWNLOAD_USE_V1, CONFLUENCE_CLIENT_CERT, CONFLUENCE_CLIENT_KEY, CONFLUENCE_SPACES_FILTER, CONFLUENCE_SSL_VERIFY, CONFLUENCE_TIMEOUT, CONFLUENCE_URL, CONFLUENCE_USERNAME, CURL_CA_BUNDLE, DISABLE_JIRA_MARKUP_TRANSLATION, ENABLED_TOOLS, HIERARCHY_LINK_PHRASES, JIRA_CLIENT_CERT, JIRA_CLIENT_KEY, JIRA_INTERNAL_ONLY_PROJECTS, JIRA_PROJECTS_FILTER, JIRA_SLA_METRICS, JIRA_SLA_TIMEZONE, JIRA_SLA_WORKING_DAYS
Where it talks to: atlassian.com, atlassian.net (its own)Also your-company.com, chatgpt.com — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names your-company.com, chatgpt.com as well as its own vendor. The guard injects ATLASSIAN_OAUTH_ACCESS_TOKEN, ATLASSIAN_OAUTH_ALLOWED_CLIENT_REDIRECT_URIS, ATLASSIAN_OAUTH_ALLOWED_GRANT_TYPES, ATLASSIAN_OAUTH_CLIENT_ID, ATLASSIAN_OAUTH_CLIENT_SECRET, ATLASSIAN_OAUTH_CLOUD_ID, ATLASSIAN_OAUTH_ENABLE, ATLASSIAN_OAUTH_INSTANCE_URL, ATLASSIAN_OAUTH_REDIRECT_URI, ATLASSIAN_OAUTH_SCOPE, CONFLUENCE_API_TOKEN, CONFLUENCE_CLIENT_KEY_PASSWORD, CONFLUENCE_OAUTH_CLIENT_ID, CONFLUENCE_OAUTH_CLIENT_SECRET, CONFLUENCE_PERSONAL_TOKEN, JIRA_API_TOKEN, JIRA_CLIENT_KEY_PASSWORD, JIRA_OAUTH_CLIENT_ID, JIRA_OAUTH_CLIENT_SECRET, JIRA_PERSONAL_TOKEN only into requests to atlassian.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets ATLASSIAN_OAUTH_ACCESS_TOKEN=atlassian.com,ATLASSIAN_OAUTH_ALLOWED_CLIENT_REDIRECT_URIS=atlassian.com,ATLASSIAN_OAUTH_ALLOWED_GRANT_TYPES=atlassian.com,ATLASSIAN_OAUTH_CLIENT_ID=atlassian.com,ATLASSIAN_OAUTH_CLIENT_SECRET=atlassian.com,ATLASSIAN_OAUTH_CLOUD_ID=atlassian.com,ATLASSIAN_OAUTH_ENABLE=atlassian.com,ATLASSIAN_OAUTH_INSTANCE_URL=atlassian.com,ATLASSIAN_OAUTH_REDIRECT_URI=atlassian.com,ATLASSIAN_OAUTH_SCOPE=atlassian.com,CONFLUENCE_API_TOKEN=atlassian.com,CONFLUENCE_CLIENT_KEY_PASSWORD=atlassian.com,CONFLUENCE_OAUTH_CLIENT_ID=atlassian.com,CONFLUENCE_OAUTH_CLIENT_SECRET=atlassian.com,CONFLUENCE_PERSONAL_TOKEN=atlassian.com,JIRA_API_TOKEN=atlassian.com,JIRA_CLIENT_KEY_PASSWORD=atlassian.com,JIRA_OAUTH_CLIENT_ID=atlassian.com,JIRA_OAUTH_CLIENT_SECRET=atlassian.com,JIRA_PERSONAL_TOKEN=atlassian.com -- docker run -i --rm mcp/atlassian

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is atlassian@r4 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-12 and scored it 80/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1 ·

0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed

0.1sprocessscript backend runs setup only

0.1sprocessno install scripts to re-run

Static findings

HIGH

Access to sensitive file pathsscripts/generate_tool_docs.py:710 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/test_with_real_data.sh:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho " 1. Start DC instances: cd tests/e2e/docker && docker compose --env-file .env.example up -d"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/test_with_real_data.sh:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Check if .env file existsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/generate_tool_docs.py:726 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathssrc/mcp_atlassian/__init__.py:429 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Attempting to load environment from default .env file if it exists"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathssrc/mcp_atlassian/__init__.py:571 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"environment variable or in the default .env file (--env-file "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/generate_tool_docs.py:720 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/test_with_real_data.sh:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ ! -f ".env" ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/test_with_real_data.sh:76 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "Note: .env file not found. Using defaults for DC instances (localhost:8080/8090)."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathssrc/mcp_atlassian/confluence/client.py:157 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# explicit credentials (#860). Basic auth can safely use .netrc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathssrc/mcp_atlassian/__init__.py:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Read from .env via dotenv_values() since load_dotenv() hasn't run yet.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathssrc/mcp_atlassian/confluence/client.py:156 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Disable trust_env for PAT and OAuth to prevent .netrc from overridingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/generate_tool_docs.py:715 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathssrc/mcp_atlassian/__init__.py:212 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"--env-file", type=click.Path(exists=True, dir_okay=False), help="Path to .env file"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/test_with_real_data.sh:78 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessource .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathssrc/mcp_atlassian/jira/client.py:173 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Disable trust_env for PAT and OAuth to prevent .netrc from overridingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Credential pass-through configurationtests/integration/README.md:55 · Credential pass-through configuration — agent relays sensitive credentials- **Authentication**: Proxy credentials in URLsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST02

HIGH

Access to sensitive file pathssrc/mcp_atlassian/utils/proxy.py:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import is_env_truthyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathssrc/mcp_atlassian/utils/ssl.py:302 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# PAT and OAuth sessions run with trust_env=False (so .netrc cannotFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathssrc/mcp_atlassian/utils/pagination.py:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import get_int_envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathssrc/mcp_atlassian/servers/jira.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# set in the environment (or .env) before the server starts.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstests/e2e/docker/README.md:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp .env.example .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathssrc/mcp_atlassian/jira/client.py:174 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# explicit credentials (#860). Basic auth can safely use .netrc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstests/e2e/docker/README.md:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…b-licenses-for-testing-server-apps/). **Tip:** set `CONFLUENCE_LICENSE_KEY` in `.env` — Confluence 7.9+ reads it from `ATL_LICENSE_KEY` at first-time setup, so this…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstests/e2e/docker/README.md:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…stance stays up for hours. - **Confluence** — set `CONFLUENCE_LICENSE_KEY` in `.env` (see `.env.example`). Confluence 7.9+ reads it from `ATL_LICENSE_KEY` and appl…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)src/mcp_atlassian/servers/main.py:695 · MCP server using network transport (SSE/HTTP) — data sent over networkauth_paths = frozenset({self.mcp_server_ref.get_streamable_http_path()})Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

HIGH

Access to sensitive file pathssrc/mcp_atlassian/utils/http.py:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import (Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Hidden zero-width characters detectedsrc/mcp_atlassian/jira/config.py:33 · Hidden zero-width characters detected — may conceal contentmap(ord, "‌‍⁠") # ZWSP, ZWNJ, ZWJ, word-joiner, BOMFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Access to sensitive file pathssrc/mcp_atlassian/utils/io.py:175 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesattacks (e.g., ``../../etc/passwd``).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

Cost to the agent

Instructions loaded

≈35 tok

1 file · 81 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.