Skip to main content

Set up the Atlassian Rovo MCP server

Atlassian's Rovo MCP server lets AI agents work across Jira, Confluence, Compass, and Bitbucket — searching and reading content, creating and updating issues and pages, and running searches that span products. This guide covers adding MintMCP to your Atlassian organization's domain allowlist, choosing which tool groups are permitted, and approving the server in MintMCP, so your team can connect with their own Atlassian accounts.

Prerequisites​

Add MintMCP to your Atlassian allowlist​

Atlassian's Rovo MCP server uses a domain allowlist to control which AI tools can connect to your organization over OAuth. MintMCP isn't one of Atlassian's default-allowed domains, so add it yourself before approving the connector.

  1. Go to admin.atlassian.com and select your organization.
  2. Go to Atlassian Administration > Rovo > Rovo MCP server. (On older consoles this lives under Apps > AI settings > Rovo MCP server.)
  3. Under Allowed domains, click Add domain.
  4. Enter https://app.mintmcp.com/** and save.

You don't create a custom OAuth app or paste any credentials. MintMCP connects over OAuth 2.1, and allowlisting its domain is what authorizes it to request access on each user's behalf.

Choose which tool groups are permitted​

The same Rovo MCP server page has a Permissions tab that controls which tools the server exposes, grouped by intent: Read, Write, Search, Delete, and Manage. Blocking a group removes its tools from the tool list entirely — they don't appear and then fail, they simply aren't there.

Delete and Manage are not allowed by default. Leave them blocked unless you specifically want agents removing content or changing space and project configuration.

note

Each group also has a New toolsets allowed setting that decides whether tools Atlassian adds later are included automatically. If tools appear or disappear without any change on the MintMCP side, check this tab first.

Tool capabilities reference​

Over this OAuth connection, the Rovo MCP server exposes a core set of tools directly and reaches the rest of its catalog on demand — an agent calls discover to find an operation by name, then runs it through executeRead, executeWrite, or executeDestructive depending on its risk tier. A tool that isn't in the visible list is usually still reachable this way.

ProductWhat you can do
JiraSearch issues with JQL, read issue details, create and update issues, add comments and worklogs, transition issues, manage issue links and sprints
ConfluenceSearch with CQL, read and write pages, blog posts, live docs, whiteboards, databases, and folders, plus comments and attachments
CompassRead components, create components and relationships
BitbucketRead repositories, pull requests, and related activity
Cross-product searchSearch and fetch content across products through Teamwork Graph

Note: Cross-product search runs on Teamwork Graph, which is in beta and currently free to use.

Compass tools need Compass provisioned on the site. If it isn't, those tools return a ProductNotFound error rather than an empty result.

Jira Service Management tools authenticate with API tokens instead of OAuth, so they aren't reachable through this connection.

These tools don't grant access on their own. Every call runs as the signed-in user and respects their existing Jira, Confluence, and Compass permissions, so a user can only act on what they could already see in Atlassian.

Add Atlassian Rovo to MintMCP​

Atlassian Rovo is pre-listed as a recommended server in the MintMCP MCP store.

  1. In MintMCP, go to MCP store > Manage store.
  2. Find Atlassian Rovo in the recommended servers list.
  3. Click Install.

Each team member signs in with their own Atlassian account on first use, so all tool calls are tied to their individual permissions.

Security considerations​

  • Each user authenticates individually, so Jira issues, Confluence pages, and Compass components are only accessible based on that user's existing Atlassian permissions.
  • Removing MintMCP from the allowed domains list immediately revokes OAuth access for all users.
  • A tool call only succeeds when it comes from an allowlisted domain and an allowed IP. If your organization runs an IP allowlist in Atlassian, add MintMCP's egress IPs or calls will be blocked even with the domain allowlisted.

Troubleshooting​

  • Connection rejected during sign-in — the MintMCP domain isn't allowlisted. Confirm https://app.mintmcp.com/** is saved under Allowed domains, including the trailing /**.
  • Sign-in succeeds but calls fail — your organization's IP allowlist is blocking MintMCP's egress IPs. Add them in Atlassian's IP allowlist settings.
  • A product's tools return nothing — the signed-in user lacks access to that Jira project, Confluence space, or Compass component. Tools never widen a user's existing permissions.
  • Cross-product search tools are missing — these Teamwork Graph tools are in beta and may not be enabled for your organization yet.
  • Sign-in succeeds but every site-scoped call fails — no site was selected on Atlassian's consent screen, so the grant carries no site. Symptoms include an empty accessible-resources list, isn't explicitly granted by the user, or 403 The app is not installed on this instance. Disconnect the Atlassian connection in MintMCP, reconnect, and pick the site explicitly.
  • Tools fail with Insufficient scopes — the connection was authorized before Atlassian's current scope model. Disconnect and reconnect the Atlassian connection in MintMCP so the grant is reissued. Reconnecting the MCP client alone is not enough; the Atlassian grant itself has to be replaced.
  • A tool is listed but returns Tool not found — the cached tool list is broader than the current grant permits. Reconnect the connector to refresh it.

Next steps​