v1.5.0

File tools can no longer read files outside a dedicated folder. This closes GHSA-gv82-cfv8-5p3p: text in a Jira issue or Confluence page could steer an agent into publishing a local file. Update now.

Security

• File tools no longer reach files outside a dedicated folder (GHSA-gv82-cfv8-5p3p). Confluence content_file and the Jira and Confluence attachment uploads used to accept any path under the directory the MCP client started the server in, often / or your home directory. Text in a Jira issue or Confluence page could then steer an agent into publishing a local file, such as an SSH key. Now they only read files inside MCP_ATLASSIAN_FILES_DIR, by default ~/.atlassian-browser-mcp/files (created with mode 0700). The server refuses to start when that folder is a filesystem root or contains your home directory, by any spelling. Reported by @Gal3m.
• Requires mcp-atlassian 0.24.1, the first release that honours MCP_ATLASSIAN_FILES_DIR on stdio. The server refuses to start on an older upstream that still confines file tools to the working directory.
• mcp-atlassian 0.24.1 caps cryptography below 47, and 46.x has published advisories. The lock overrides the cap and keeps cryptography 50.0.2, so checkout and launcher installs are not affected. uvx and pip installs follow upstream's cap and get cryptography 46.x until upstream raises it.

Changed

• A content_file or attachment path outside the files folder, including any path relative to the launch directory, no longer works. Relative paths now resolve inside the files folder. To use files from a workspace, set MCP_ATLASSIAN_FILES_DIR to that folder. Keep this server's checkout and cookie jars out of it.
• With mcp-atlassian 0.24.1, the Cloud-only Jira tools jira_batch_get_changelogs and jira_move_issue are no longer listed for Server/Data Center URLs.

Install: https://pypi.org/project/atlassian-browser-mcp/1.5.0/

v1.4.1

atlassian-browser-mcp is on PyPI now, so uvx atlassian-browser-mcp runs it without a checkout, and it is listed in the official MCP Registry.

Added

• Published on PyPI as atlassian-browser-mcp: uvx atlassian-browser-mcp runs the server and uvx --from atlassian-browser-mcp atlassian-cli login jira saves a session, so no checkout is needed (#33).
• Listed in the official MCP Registry as io.github.GeiserX/atlassian-browser-mcp (server.json) (#33).
• Release workflow: a v* tag builds the package, publishes it to PyPI through a trusted publisher (OIDC, no stored token) and then publishes server.json to the registry (#33).

Install: https://pypi.org/project/atlassian-browser-mcp/1.4.1/

v1.4.0

The patched Jira and Confluence clients now keep upstream mcp-atlassian's own network hardening on browser-cookie sessions. Before this release they replaced upstream's HTTP session and lost its SSRF redirect check, DNS pinning, retries, rate limits, proxy and TLS settings.

Security

• The patched Jira and Confluence clients now run upstream mcp-atlassian's own constructor and add the browser cookies afterwards, so upstream's SSRF redirect check, DNS pinning, retries, rate limits, proxy and TLS settings stay in force on browser-cookie sessions (#31).
• Cookie jars keep only the cookies of their own service host and are written with mode 0600 (#31).
• After an expired session only GET, HEAD and OPTIONS requests are sent again; a write gets an AuthRequiredError instead, so it never runs twice (#31).
• The server refuses to start on any transport other than stdio (#31).
• Requires cryptography>=44.0.1, which carries the fixes for CVE-2024-26130 and CVE-2024-12797 (#31).

Added

• atlassian_auth_status tool: reports which service has a live session, so an agent can ask for a login before it fails mid-task (#31).
• Every tool carries a title and all four MCP tool hints (#31).
• Jira-only and Confluence-only setups work (#31).
• Client setup instructions for Claude Code, Claude Desktop, Cursor, VS Code and Codex in the README (#31).
• Exact dependency versions locked in uv.lock; install with uv sync --frozen (#31).
• CodeQL analysis workflow (#31).

Changed

• Seeding the automation profile from your real Chrome profile is opt-in (ATLASSIAN_SEED_FROM_CHROME_PROFILE) (#31).
• On macOS the background session reuse from installed Chromium-family browsers says on stderr that it reads the browser's Keychain key, and can be turned off (#31).
• Requires mcp-atlassian 0.23.1 or newer, so Confluence page operations keep working (#18, #21).
• License metadata reads GPL-3.0-or-later (#27).

CI

• The test suite runs on every pull request on Python 3.11, 3.12 and 3.13 (#22).
• The upstream tracker issue reports Dependabot status correctly (#23), and the stale job keeps its state between runs (#26).

Upgrade: pull the tag, then UV_PROJECT_ENVIRONMENT=.venv-atlassian-browser uv sync --frozen.

Full changelog: v1.2.1...v1.4.0

v1.2.1 — Security: require mcp-atlassian 0.22.1

Security: require mcp-atlassian ≥ 0.22.1

Bumps the upstream pin floor to require mcp-atlassian 0.22.1, which carries two security fixes. No wrapper behavior changes — a dependency-floor bump so every install picks up the upstream fixes.

Upstream security fixes (mcp-atlassian 0.22.1)

• Jira JQL injection — caller-supplied filter values could inject JQL operators to escape the configured project allowlist. Values are now quoted as literals and generated project clauses are explicitly grouped.
• SSRF — caller-controlled destinations stay on the direct DNS-pinned path when deployment proxies are configured (proxy-side DNS can't bypass the rebinding defense); relative/scheme-relative redirects are resolved against the response URL before SSRF validation.

Compatibility

Signature-compatible — no monkey-patch changes needed. Verified against 0.22.1: assert_upstream_compatibility() passes (all four patched signatures bind) and the server module imports cleanly.

Full Changelog: v1.2.0...v1.2.1

v1.2.0

Multi-browser cookie harvesting

Auth now reuses a live Jira/Confluence session from whichever Chromium-family browser (Arc, Chrome, Brave, Edge, Chromium, …) actually has one — instead of seeding from a single hardcoded browser. This fixes intermittent login failures when the user's session lived in a browser other than Chrome.

Highlights

• cookie_harvest.py — decrypt v10 cookies from any Chromium browser via its macOS Keychain " Safe Storage" key. Reads from a temp copy (no lock on a running browser); skips Chrome 127+ app-bound v20 cookies gracefully.
• cookie_autoauth.py — scan installed browsers, probe the REST API with a bounded, redirect-free request, use the first browser with a live session, and save the per-service cookie jar.
• Harvest-first in the auth flow and the 401-retry path. Bounded and window-less, so the MCP server self-heals silently while preserving the two-process rule (server never opens a browser). Interactive Chrome SSO is the last resort.
• preflight.sh self-heals via harvest before reporting RED.
• Configurable via ATLASSIAN_COOKIE_SOURCE_BROWSERS and ATLASSIAN_COOKIE_HARVEST; default channel is real Chrome.

Tests

50 unit/scenario tests (decryption, browser registry, live/expired/app-bound/locked-DB/network-failure/order).

v1.1.1

v1.1.1: decouple auth (CLI) from serving (read-only MCP) — server no …

v1.1.0

v1.1.0: reusable browser profile (seeding + no self-wipe), per-servic…

v1.0.0

Initial Release

Browser-backed MCP server wrapping upstream mcp-atlassian with Playwright SSO authentication for Atlassian Server/Data Center instances behind corporate SSO.

Features

• Playwright-based interactive SSO/MFA login with persistent cookie session
• Automatic SSO redirect detection and transparent re-authentication
• Full upstream tool surface (72 tools + atlassian_login helper)
• Monkey-patching of JiraClient/ConfluenceClient for zero-config integration
• Configurable SSO markers, browser channel, timeouts, and user-agent
• Storage state security (0o600 file permissions, 0o700 directories)
• Thread-safe login with lock-based concurrency control

Requirements

• Python 3.11+
• uv for dependency management
• Graphical display (macOS, X11, or Wayland) for interactive login