Menu
Use when the user wants to connect to Jira, Confluence, or Compass — search issues with JQL, read or create issues and pages, link content across products, or set up Atlassian auth. The connector — not security tradecraft.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
| name | atlassian |
| description | Use when the user wants to connect to Jira, Confluence, or Compass — search issues with JQL, read or create issues and pages, link content across products, or set up Atlassian auth. The connector — not security tradecraft. |
Connector for Atlassian Cloud via the official Rovo remote MCP — one server, three products. The agent sees the tool surface once it loads — this skill covers auth, the per-product query languages, and the idioms. Security triage methodology — dedup, severity, SLA, owner inference — is deliberately out of scope; pair this with whichever triage capability your workflow uses.
Native HTTP MCP with OAuth 2.1 + DCR; the runtime drives the flow, no
mcp-remote bridge. Atlassian doesn't publish an RFC 9728 protected-resource
document, so discovery resolves through the authorization-server metadata on
mcp.atlassian.com, which points at cf.mcp.atlassian.com for
authorize/token/register. Nothing to configure — but if you're debugging a failed
connect, that's the chain to walk, and it's why the .well-known/ oauth-protected-resource probes you'd try first come back 404.
On first connect, atlassian shows in Services as needs authentication. Click
Authenticate → browser → sign in and grant the Rovo scopes; tokens persist to
~/.dreadnode/mcp-auth.json (mode 0600) and refresh silently. Access respects your
existing Jira / Confluence / Compass roles. Switch sites / revoke via Services →
atlassian → Re-authenticate. SSH/headless: DREADNODE_HEADLESS=1 logs the URL.
First install on a new site needs a site admin to complete consent once; until then other users see "Your site admin must authorize this app." That's Atlassian-side, not us.
For unattended use, just set one secret — no manifest edit. The server entry
carries an optional Authorization header bound to ATLASSIAN_BASIC: set it and
Basic auth wins, leave it unset and OAuth (A) stays default.
email:token, base64). Interpolation can't
base64 for you — compute it and store the result as ATLASSIAN_BASIC:
printf '%s:%s' you@example.com ATATT… | base64 | tr -d '\n'; echo
Basic to Bearer
in the manifest header and bind ${ATLASSIAN_API_KEY}.)If the admin hasn't enabled token auth this path 401s with a clear error — unset the secret and reload to fall back to OAuth. Token-auth agents bypass OAuth domain allowlists and are governed by IP allowlist + token scopes instead. Don't paste tokens into chat.
Read vs write is enforced by the user's project / space roles (or the token's scopes on path B) — there's no protocol-level read-only mode.
project = "ENG" AND status = "Open" AND assignee = currentUser() ORDER BY priority DESC.
https://support.atlassian.com/jira-service-management-cloud/docs/use-advanced-search-with-jira-query-language-jql/space = "ENG" AND type = page AND title ~ "release".
https://developer.atlassian.com/cloud/confluence/cql-fields/Prefer JQL / CQL with the search tool over post-filtering large lists. ENG-123 is
the canonical Jira key — use it directly when the user has it. Always scope queries
(project = …) — instance-wide ones are slow and rate-limited.
{summary, description, …} records, then create per record.currentUser() in JQL is the OAuth user, not the agent — with a service
account, "assigned to me" means the service account.Pre-engagement reconnaissance workflow using HackerOne MCP tools to enumerate program scope, study prior disclosures, and identify high-value targets. Use when starting a new HackerOne program engagement, building an asset inventory, or planning target selection before active testing.
Pre-submission eligibility check for bug bounty findings. Catches ineligible patterns, AI/scanner false positives, and generates impact justification for borderline lows. Use before writing a report or when assessing whether a finding is worth reporting.
Static code analysis for DOM-based vulnerabilities in client-side JavaScript -- source/sink enumeration via grep and AST tools, data flow tracing, sanitization assessment, and framework-specific sink detection. Use when performing pre-commit reviews, auditing large codebases without dynamic execution, or triaging minified code for XSS issues.
Create custom jxscout analyzers (regex, derived, or script-based) and retrigger analysis. Use when the user wants to find specific code patterns across all project files, add new match kinds, or extend jxscout's static analysis capabilities.
Use when the user wants to connect to Azure DevOps — query Boards work items with WIQL, read PRs, inspect pipeline runs, create or update work items and wiki pages, or set up ADO auth. The connector — not security tradecraft.
Use when the user wants to connect to GitHub, search or read issues / PRs / code, create or update issues and PRs, inspect Actions runs, or review Dependabot / code-scanning alerts. The connector — not security tradecraft.