TAI42 — the OS for AI tools

Connector plugin · listing tai42/connector-atlassian

Install

tai plugins install tai42/connector-atlassian --env CONNECTORS_ATLASSIAN_CLIENT_ID=... --env CONNECTORS_ATLASSIAN_CLIENT_SECRET=... --secret CONNECTORS_ATLASSIAN_CLIENT_SECRET

Permissions

Capability	Declared
Network	no
Subprocess	no
Filesystem	no

Provides

atlassian

Connector — OAuth connector for Atlassian (Jira, Confluence, Compass). Registers the atlassian connector: one Atlassian OAuth 2.0 (3LO) connection per alias, unlocking three services — Jira, Confluence, and Compass. Every service is a remote HTTP MCP endpoint hosted by Atlassian, so nothing is launched locally. The plugin is pure descriptor data; the runtime’s connector engine runs the OAuth flow, seals the tokens, and reaches Atlassian’s hosted MCP endpoint with the connection’s own token.

Install

tai plugins install tai42/connector-atlassian \
  --env CONNECTORS_ATLASSIAN_CLIENT_ID=... \
  --secret CONNECTORS_ATLASSIAN_CLIENT_SECRET

Or add it by hand to the manifest under connectors: (the descriptor block the plugin provides):

manifest.yml

connectors:
  - id: atlassian
    kind: oauth
    origin: system
    category: dev-tools
    display_name: Atlassian
    description: Connect Jira, Confluence, and Compass.
    icon_url: https://raw.githubusercontent.com/tai42ai/tai42/main/plugins/connector-atlassian/icon.png
    oauth:
      authorize: https://auth.atlassian.com/authorize
      token: https://auth.atlassian.com/oauth/token
      revoke: null
    client_id_env: CONNECTORS_ATLASSIAN_CLIENT_ID
    client_secret_env: CONNECTORS_ATLASSIAN_CLIENT_SECRET
    sub_services:
      jira:
        id: jira
        display_name: Jira
        scopes: [offline_access, read:issue:jira, write:issue:jira]
        mcp_server: {type: http, url: https://mcp.atlassian.com/v1/mcp/authv2}
    extra_authorize_params: {audience: api.atlassian.com, prompt: consent}

The manifest block above is trimmed to one sub-service and a short scope set for brevity; the plugin’s tai-plugin.yml carries the full set.

Create the Atlassian app

Create an OAuth 2.0 (3LO) app in the Atlassian developer console, enable the products you intend to offer (Jira, Confluence, Compass), and grant the app the granular scopes listed below. Add this exact callback URL, where {origin} is your deployment’s public origin (or CONNECTORS_OAUTH_BRIDGE_URL when you run a shared bridge):

{origin}/oauth-bridge.html

Then set the client credentials on the API process:

CONNECTORS_ATLASSIAN_CLIENT_ID=...
CONNECTORS_ATLASSIAN_CLIENT_SECRET=...

The engine-wide CONNECTORS_* settings — the key-encryption key (CONNECTORS_KEK), the state HMAC key (CONNECTORS_STATE_HMAC_KEY), and the redirect-URI allowlist (or CONNECTORS_OAUTH_BRIDGE_URL when you run a shared bridge) — are shared by every connector and are described in Connectors. The origin you registered with Atlassian must appear in the redirect-URI allowlist, and it must be https for anything but a local host.

Services and scopes

Atlassian refuses an app that mixes classic and granular scopes, so every scope below is granular.

Service	Scopes
`jira`	`offline_access`, `read:issue:jira`, `read:issue-meta:jira`, `read:project:jira`, `read:comment:jira`, `read:attachment:jira`, `read:issue-worklog:jira`, `read:jql:jira`, `read:board-scope:jira-software`, `read:sprint:jira-software`, `write:issue:jira`, `write:comment:jira`, `write:issue-worklog:jira`, `delete:issue:jira`, `write:sprint:jira-software`
`confluence`	`offline_access`, `read:page:confluence`, `read:hierarchical-content:confluence`, `read:comment:confluence`, `read:space:confluence`, `write:page:confluence`, `read:content-details:confluence`
`compass`	`offline_access`, `read:component:compass`, `write:component:compass`

All three services resolve to Atlassian’s hosted MCP endpoint at https://mcp.atlassian.com/v1/mcp/authv2. The authorize request adds audience=api.atlassian.com and prompt=consent. offline_access is what makes the refresh token available, so a connection survives the access token’s expiry.

Atlassian publishes no 3LO revocation endpoint, so disconnecting removes the stored token from this deployment but cannot revoke it at Atlassian. Revoke the app’s access from the Atlassian account’s connected-apps screen when that matters.

Connect an account

Each service resolves to Atlassian’s hosted MCP endpoint, authorised with the connection’s own token.

Get started

Concepts

Guides

Operate

Self-hosted

Marketplace

Integrations

Babelfish

Plugins

Atlassian

Install

Permissions

Provides

atlassian

Install

Create the Atlassian app

Services and scopes

Connect an account

See also

​Install

​Permissions

​Provides

​atlassian

​Install

​Create the Atlassian app

​Services and scopes

​Connect an account

​See also

Install

Permissions

Provides

atlassian

Install

Create the Atlassian app

Services and scopes

Connect an account

See also