[Bug]: confluence_upload_attachment fails on Confluence Server — wrong X-Atlassian-Token header value ("nocheck" vs "no-check")

[x509z]

Prerequisites

• I have searched the existing issues to make sure this bug has not already been reported.
• I have checked the README for relevant information.

Bug Description

Description

confluence_upload_attachment always returns "Failed to upload attachment" on
Confluence Server / Data Center, even after the fix from PR #1202 (PUT → POST).

The root cause is a second independent bug: the X-Atlassian-Token header is sent
with the value "nocheck" (no hyphen), but Confluence Server requires exactly "no-check"
(with a hyphen). Without this header being accepted, the server responds with
403 Forbidden and rejects the multipart upload entirely.

Affected file

src/mcp_atlassian/confluence/attachments.py (v0.21.0)

Steps to Reproduce

1. Run mcp-atlassian against a Confluence Server (self-hosted) instance
2. Call confluence_upload_attachment with any valid content_id and an existing file path
3. Observe "Failed to upload attachment" in the response despite correct parameters

Root Cause

# Line ~474 in attachments.py — WRONG value:
headers = {"X-Atlassian-Token": "nocheck"}

# Confluence Server REST API requires a hyphen:
headers = {"X-Atlassian-Token": "no-check"}

The Confluence Server REST API documentation explicitly specifies no-check (with hyphen)
as the required value to bypass the cross-site request forgery (XSRF) check for multipart
uploads. Sending nocheck (without hyphen) causes the server to treat the upload as a
potential CSRF attack and return 403 Forbidden.

Reference from Atlassian docs:

Set the header X-Atlassian-Token: no-check to bypass XSRF token validation for
multipart form-data POST requests.

See: https://developer.atlassian.com/server/confluence/confluence-rest-api-examples/#upload-an-attachment

Fix

# attachments.py
headers = {"X-Atlassian-Token": "no-check"}  # hyphen required

Relationship to Issue #1163 / PR #1202

PR #1202 fixes the HTTP verb (PUT → POST). Both fixes are required together for
attachment uploads to succeed on Confluence Server. With only one of the two fixes applied,
uploads will still fail:

Fix applied	Cloud	Server
Neither	❌	❌
POST only (PR #1202)	✅	❌ (403 from wrong token)
no-check only	❌ (405 wrong verb)	❌
Both fixes	✅	✅

Environment

• mcp-atlassian version: 0.21.0
• Confluence type: Server (self-hosted)
• Confluence version: 7.x
• Python: 3.10

Steps to Reproduce

Steps to Reproduce

Prerequisites

• mcp-atlassian v0.21.0
• Confluence Server (self-hosted, any recent 7.x/8.x version)
• A valid Confluence page ID and an image file accessible on the MCP server's filesystem

Reproduction steps

1. Configure mcp-atlassian with your Confluence Server credentials (CONFLUENCE_URL,
   CONFLUENCE_USERNAME, CONFLUENCE_API_TOKEN)

2. Call the confluence_upload_attachment tool:

   {
     "content_id": "<your_page_id>",
     "file_path": "/path/to/image.png"
   }

3. Observe the response:

   {
     "error": "Failed to upload attachment image.png to content <page_id>"
   }

4. To confirm the root cause, enable HTTP-level logging or intercept the request.
   You will see the server returning 403 Forbidden with a body similar to:

   XSRF check failed

This is because the header X-Atlassian-Token: nocheck (no hyphen) is not
recognized as a valid XSRF bypass token by Confluence Server.

Verification of the fix

1. Open site-packages/mcp_atlassian/confluence/attachments.py

2. Find the line:

   headers = {"X-Atlassian-Token": "nocheck"}

3. Change it to:

   headers = {"X-Atlassian-Token": "no-check"}

4. Restart the MCP server and repeat step 2 above — the upload now succeeds.

Note on combined fix

This fix must be applied together with PR #1202 (PUT → POST).
On Confluence Server, both bugs are present simultaneously:

• Wrong HTTP verb → 405 Method Not Allowed
• Wrong token value → 403 Forbidden

With only one fix applied, the upload still fails (different error). Both are required.

Expected Behavior

I expected the attachment to be successfully added to the page

Actual Behavior

Return message "Failed to upload attachment image.png to content "

mcp-atlassian Version

v0.21.0

Installation Method

From PyPI (pip install mcp-atlassian / uv add mcp-atlassian)

Operating System

Windows

Python Version

3.10

Atlassian Instance Type

Confluence Server / Data Center

Client Application

Claude Code

Additional Context

No response