Jira MCP: Connect Claude, Cursor or VS Code to Jira Safely

A developer types “what’s blocking the checkout release?” into their editor, and the AI answers with three Jira work items, their assignees and the comment that explains the hold-up. Nobody opened Jira. That is what an MCP connection to Jira does, and why the questions after “how do I set it up?” are “what can it change?”, “what does it cost?” and “where does my data go?”.

We connected a test client to our own Jira Cloud site through Atlassian’s official server on 5 November 2026, ran read-only calls first, wrote one comment on a test work item, then revoked access and checked what still worked. The steps for each AI client are below, marked where they come from Atlassian’s documentation rather than from our test.

What MCP is, in one paragraph

The Model Context Protocol is an open standard for giving AI clients tools. An MCP server describes its tools (for example “search Jira with JQL”), the AI client shows them to the model, and the model decides when to call one. Atlassian runs the server for Jira itself; its README calls it “a cloud-hosted bridge that gives your AI tools secure, real-time access to Jira, Confluence, Jira Service Management, Bitbucket, Compass, Loom”. You install nothing on your Jira site. (Atlassian’s own desktop app, Rovo Desktop, is a different thing; our Jira desktop app guide sorts out what runs where.)

Set it up in your AI client

All steps from Atlassian’s README and support pages, read on 5 November 2026. We tested the server with our own minimal client, not by clicking through each IDE.

Claude Code. Run one command in your terminal:

claude mcp add --transport http atlassian https://mcp.atlassian.com/v2/mcp

Then type /mcp in a Claude Code session to sign in.

Claude Desktop and Claude.ai. Settings, then Extensions, Browse extensions, Plugins, and search for Atlassian.

VS Code with GitHub Copilot. Open the Extensions view, search for @mcp Atlassian and select Install. GitHub Copilot CLI is on Atlassian’s list of supported clients too; give it the same server URL.

Cursor. Open the Atlassian plugin for Cursor and select Add to Cursor. The plugin includes Atlassian’s prompts (“skills”) for common Jira tasks.

Any other client. Most clients accept a JSON entry. This is the .mcp.json file from Atlassian’s own repository:

{
  "mcpServers": {
    "atlassian": {
      "type": "http",
      "url": "https://mcp.atlassian.com/v2/mcp"
    }
  }
}

Two endpoint notes. The old Server-Sent Events URL (/v1/sse) stopped being supported after 30 June 2026; use /mcp. And Atlassian’s sign-in page still showed a banner on 5 November: “Support for legacy Atlassian MCP endpoints will be removed in March 2027.” New setups should use /v2/mcp.

What you approve when you sign in

The first tool call opens an Atlassian consent screen. Two of them, in fact, on the flow we tested:

The first screen asks which apps the client may use. We left only Jira checked. That choice is real: with Confluence unchecked, the server offered our client 20 tools: 15 for Jira work items, plus user info, the site list, search, fetch and a formatting guide, and none that read or write Confluence pages. The second screen asks for the site (one site per authorization) and showed the scopes: View jira-work, Update jira-work and View me.

The newer /v2/mcp sign-in has a clearer screen with three switches, Read, Write and Search, described as “Let AI agents view your existing work”, “create and update work on your behalf” and “search broadly across your work”:

Unchecking Write gives you a read-only agent, which is the right way to start. (Our own test client could not finish this newer flow: Atlassian answered “Incorrect request parameters” twice. Clients that Atlassian supports handle it; the v2 tool details below come from Atlassian’s docs.)

What the tools can do

Atlassian groups the tools into permission groups that an admin can allow or block. For Jira, from the Supported tools page on 5 November 2026:

Version 2 does not send all tools at once. It exposes a few “Primary” tools and a discover tool the agent uses to find the rest, plus three execution paths (executeRead, executeWrite, executeDestructive) that clients can use to ask you before anything changes. Gateways that need the full list can use https://mcp.atlassian.com/v2/mcp?tools=all.

What we saw on our own site

Our test site is a Jira Cloud site with demo projects. With Jira-only access we ran, in order:

Three findings matter for safety:

• The agent’s comment carries your name and nothing else. In Jira the comment looked exactly like one we typed ourselves. Nothing marks it as written by an AI.

• The grant is broader than the tools. Under Connected apps, Atlassian described what our authorization allowed: “Create and edit issues in Jira, post comments as the user, create worklogs, and delete issues.” The server keeps its delete tools off by default, but the permission itself includes deletion.

• Revoking takes two steps. After Remove access on the Connected apps page, every Jira call failed at once with “The app is not installed on this instance”. But the server still answered a profile call with the old token. Only after we revoked the token itself did every call return 401 Unauthorized. In a real client, also sign out or remove the server there.

Where your data goes

Atlassian’s side is encrypted (“HTTPS (TLS 1.2 or later)”) and respects your permissions and your organization’s IP allowlist. The part teams forget is the last hop: whatever a tool returns becomes part of the prompt and goes to the model provider your client uses, under that provider’s terms. That includes descriptions and comments, so a password pasted into a comment last year can reach an AI provider today. Atlassian’s troubleshooting notes add a practical twist: “Hosted AI clients can send requests from the AI provider’s outbound IP addresses rather than the user’s corporate network or VPN”, so an IP allowlist may block a hosted client even when you are on the VPN.

What it costs

From Atlassian’s pricing page and How Rovo credits work, 5 November 2026:

A 20-person Standard site gets 500 credits a month, pooled across the organization and shared with Rovo Chat and agents. An agent that searches 100 times a day can use that up in a week. Set a spending limit under Atlassian Administration, Usage, Meters, before December.

Safety checklist

1. One site, one product. On the consent screen, uncheck Confluence and Compass unless the agent needs them. They really are left out.
2. Start read-only. On the newer consent screen, uncheck Write. Add it later for the agent that needs it.
3. Keep delete and admin tools off. delete_jira and manage_jira are off by default; leave them off.
4. Confirm every write. Use a client that asks before executeWrite and executeDestructive calls, and agree on a marker for AI comments, since Jira will show only your name.
5. Treat Jira text as untrusted input. Atlassian’s README warns that prompt injection “can instruct the agent to exfiltrate data or make unintended changes”. A work item description can contain instructions.
6. Keep secrets out of Jira. Tool results go to the model provider. Find and remove keys in descriptions and comments before you connect an agent.
7. Admins: decide on domains. By default Atlassian allows its list of supported AI domains; you can block the whole list (not single entries) and add trusted domains in the Rovo MCP server settings.
8. Watch the audit log. Atlassian says every tool call is recorded under Insights, Audit log (filter “Rovo MCP User Actions”). We did not check this on our site.
9. Cap the credits. Set a spending limit before usage billing starts on 3 December 2026.
10. Revoke when done. Connected apps on the Atlassian account, and sign out in the client. Our guide to revoking OAuth access in Atlassian Cloud has the admin side.

Keep secrets out of what the agent reads

Point 6 is where our own app fits. Secret Sentinel scans Jira summaries, descriptions and comments when they are created or edited and replaces credentials in place with a masked marker, so an API key pasted into a comment is gone before any agent can read it. It runs inside Atlassian and is free for up to 10 users. Why this matters more with AI in the loop: AI coding assistants and the secret-sprawl curve and data egress in Atlassian security apps.

Sources

• Atlassian: atlassian-mcp-server README and its .mcp.json, Get started with the Atlassian MCP server, Supported tools, Understand Atlassian MCP server, read on 5 November 2026.
• Atlassian: Jira pricing compare table and How Rovo credits work.
• Our test: a minimal MCP client connected to our Jira Cloud test site on 5 November 2026 with Jira-only access through the /v1/mcp endpoint (the token issued for it was not accepted on /v2/mcp); read-only calls first, one comment on a test work item, then Remove access and token revocation. Screenshots from that session.