Skills/Docker MCP Catalog/atlassian

atlassian@r5

CAUTION· not started

Publisher claims: "Tools for Atlassian products (Confluence and Jira). This integration supports both Atlassian Cloud and Jira Server/Data Center deployments." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher sooperset · publishing for 129 daysInstalls 180KLast detonated 10 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ATLASSIAN_OAUTH_ACCESS_TOKENATLASSIAN_OAUTH_ALLOWED_CLIENT_REDIRECT_URISATLASSIAN_OAUTH_ALLOWED_GRANT_TYPESATLASSIAN_OAUTH_CLIENT_IDATLASSIAN_OAUTH_CLIENT_SECRETATLASSIAN_OAUTH_CLOUD_IDATLASSIAN_OAUTH_ENABLEATLASSIAN_OAUTH_INSTANCE_URLATLASSIAN_OAUTH_REDIRECT_URIATLASSIAN_OAUTH_SCOPECONFLUENCE_API_TOKENCONFLUENCE_CLIENT_KEY_PASSWORDCONFLUENCE_OAUTH_CLIENT_IDCONFLUENCE_OAUTH_CLIENT_SECRETCONFLUENCE_PERSONAL_TOKENJIRA_API_TOKENJIRA_CLIENT_KEY_PASSWORDJIRA_OAUTH_CLIENT_IDJIRA_OAUTH_CLIENT_SECRETJIRA_PERSONAL_TOKEN or --oauth-setup / --client-secret / --confluence-token / --confluence-personal-token / --jira-token / --jira-personal-token / --oauth-client-secret / --oauth-access-token / --oauth-client-id / --oauth-redirect-uriConfiguration, not credentials: ATLASSIAN_PROXY_WPAD_URL, CONFLUENCE_ATTACHMENT_DOWNLOAD_USE_V1, CONFLUENCE_CLIENT_CERT, CONFLUENCE_CLIENT_KEY, CONFLUENCE_SPACES_FILTER, CONFLUENCE_SSL_VERIFY, CONFLUENCE_TIMEOUT, CONFLUENCE_URL, CONFLUENCE_USERNAME, CURL_CA_BUNDLE, DISABLE_JIRA_MARKUP_TRANSLATION, ENABLED_TOOLS, HIERARCHY_LINK_PHRASES, JIRA_CLIENT_CERT, JIRA_CLIENT_KEY, JIRA_INTERNAL_ONLY_PROJECTS, JIRA_PROJECTS_FILTER, JIRA_SLA_METRICS, JIRA_SLA_TIMEZONE, JIRA_SLA_WORKING_DAYS
Where it talks to
atlassian.com, atlassian.net (its own)Also your-company.com, chatgpt.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names your-company.com, chatgpt.com as well as its own vendor. The guard injects ATLASSIAN_OAUTH_ACCESS_TOKEN, ATLASSIAN_OAUTH_ALLOWED_CLIENT_REDIRECT_URIS, ATLASSIAN_OAUTH_ALLOWED_GRANT_TYPES, ATLASSIAN_OAUTH_CLIENT_ID, ATLASSIAN_OAUTH_CLIENT_SECRET, ATLASSIAN_OAUTH_CLOUD_ID, ATLASSIAN_OAUTH_ENABLE, ATLASSIAN_OAUTH_INSTANCE_URL, ATLASSIAN_OAUTH_REDIRECT_URI, ATLASSIAN_OAUTH_SCOPE, CONFLUENCE_API_TOKEN, CONFLUENCE_CLIENT_KEY_PASSWORD, CONFLUENCE_OAUTH_CLIENT_ID, CONFLUENCE_OAUTH_CLIENT_SECRET, CONFLUENCE_PERSONAL_TOKEN, JIRA_API_TOKEN, JIRA_CLIENT_KEY_PASSWORD, JIRA_OAUTH_CLIENT_ID, JIRA_OAUTH_CLIENT_SECRET, JIRA_PERSONAL_TOKEN only into requests to atlassian.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets ATLASSIAN_OAUTH_ACCESS_TOKEN=atlassian.com,ATLASSIAN_OAUTH_ALLOWED_CLIENT_REDIRECT_URIS=atlassian.com,ATLASSIAN_OAUTH_ALLOWED_GRANT_TYPES=atlassian.com,ATLASSIAN_OAUTH_CLIENT_ID=atlassian.com,ATLASSIAN_OAUTH_CLIENT_SECRET=atlassian.com,ATLASSIAN_OAUTH_CLOUD_ID=atlassian.com,ATLASSIAN_OAUTH_ENABLE=atlassian.com,ATLASSIAN_OAUTH_INSTANCE_URL=atlassian.com,ATLASSIAN_OAUTH_REDIRECT_URI=atlassian.com,ATLASSIAN_OAUTH_SCOPE=atlassian.com,CONFLUENCE_API_TOKEN=atlassian.com,CONFLUENCE_CLIENT_KEY_PASSWORD=atlassian.com,CONFLUENCE_OAUTH_CLIENT_ID=atlassian.com,CONFLUENCE_OAUTH_CLIENT_SECRET=atlassian.com,CONFLUENCE_PERSONAL_TOKEN=atlassian.com,JIRA_API_TOKEN=atlassian.com,JIRA_CLIENT_KEY_PASSWORD=atlassian.com,JIRA_OAUTH_CLIENT_ID=atlassian.com,JIRA_OAUTH_CLIENT_SECRET=atlassian.com,JIRA_PERSONAL_TOKEN=atlassian.com -- docker run -i --rm mcp/atlassian

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is atlassian@r5 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsscripts/generate_tool_docs.py:726 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_atlassian/__init__.py:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Read from .env via dotenv_values() since load_dotenv() hasn't run yet.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_atlassian/utils/ssl.py:302 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# PAT and OAuth sessions run with trust_env=False (so .netrc cannotFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/generate_tool_docs.py:710 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_atlassian/confluence/client.py:156 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Disable trust_env for PAT and OAuth to prevent .netrc from overridingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_atlassian/confluence/client.py:157 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# explicit credentials (#860). Basic auth can safely use .netrc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_atlassian/utils/proxy.py:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import is_env_truthyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/generate_tool_docs.py:715 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_atlassian/utils/http.py:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import (Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_atlassian/__init__.py:456 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Attempting to load environment from default .env file if it exists"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/test_with_real_data.sh:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho " 1. Start DC instances: cd tests/e2e/docker && docker compose --env-file .env.example up -d"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/test_with_real_data.sh:78 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessource .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_atlassian/utils/pagination.py:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import get_int_envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/test_with_real_data.sh:76 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "Note: .env file not found. Using defaults for DC instances (localhost:8080/8090)."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_atlassian/__init__.py:239 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"--env-file", type=click.Path(exists=True, dir_okay=False), help="Path to .env file"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/test_with_real_data.sh:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Check if .env file existsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/generate_tool_docs.py:720 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_atlassian/jira/client.py:174 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# explicit credentials (#860). Basic auth can safely use .netrc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_atlassian/servers/jira.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# set in the environment (or .env) before the server starts.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_atlassian/servers/main.py:713 · MCP server using network transport (SSE/HTTP) — data sent over networkauth_paths = frozenset({self.mcp_server_ref.get_streamable_http_path()})Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathssrc/mcp_atlassian/utils/io.py:175 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesattacks (e.g., ``../../etc/passwd``).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/test_with_real_data.sh:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ ! -f ".env" ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_atlassian/__init__.py:598 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"environment variable or in the default .env file (--env-file "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hidden zero-width characters detectedsrc/mcp_atlassian/jira/config.py:33 · Hidden zero-width characters detected — may conceal contentmap(ord, "​‌‍⁠") # ZWSP, ZWNJ, ZWJ, word-joiner, BOMFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Access to sensitive file pathssrc/mcp_atlassian/jira/client.py:173 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Disable trust_env for PAT and OAuth to prevent .netrc from overridingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsrc/mcp_atlassian/utils/lifecycle.py:52 · Process kill command — agent can terminate processes"""Swallow SIGPIPE so a closed pipe cannot kill the process."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Credential pass-through configurationtests/integration/README.md:55 · Credential pass-through configuration — agent relays sensitive credentials- **Authentication**: Proxy credentials in URLsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Access to sensitive file pathstests/e2e/docker/README.md:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…stance stays up for hours. - **Confluence** — set `CONFLUENCE_LICENSE_KEY` in `.env` (see `.env.example`). Confluence 7.9+ reads it from `ATL_LICENSE_KEY` and appl…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/e2e/docker/README.md:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…b-licenses-for-testing-server-apps/). **Tip:** set `CONFLUENCE_LICENSE_KEY` in `.env` — Confluence 7.9+ reads it from `ATL_LICENSE_KEY` at first-time setup, so this…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/e2e/docker/README.md:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp .env.example .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈35 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim sooperset: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  4. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Credential pass-through configuration≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to Docker MCP Catalog, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim soopersetPropose a patch to the maintainer