Db3 Atlassian Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Db3 Atlassian Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Lightweight MCP server for Jira, Confluence, and Bitbucket — read, create, and update from your AI IDE.
Go to https://id.atlassian.com/manage-profile/security/api-tokens and create a new token.
mkdir -p ~/.db3-atlassian-mcp
cat > ~/.db3-atlassian-mcp/.env << EOF
JIRA_BASE_URL=https://yourcompany.atlassian.net
[email protected]
JIRA_API_KEY=your-api-token-here
# Optional: Bitbucket Cloud
BITBUCKET_WORKSPACE=your-workspace
[email protected]
BITBUCKET_API_TOKEN=your-bitbucket-api-token
# Optional: Enable additional Bitbucket tool tiers
# ENABLE_BITBUCKET_PR_TOOLS=true
# ENABLE_BITBUCKET_ADMIN_TOOLS=true
EOFTip: If you skip Step 2, you can put your credentials directly in theenvblock below instead of using a.envfile. Either approach works.
#### Kiro
You can ask Kiro to do this for you: "Add db3-atlassian-mcp to my MCP config using uvx with my Atlassian credentials"
Or manually open ~/.kiro/settings/mcp.json and add inside "mcpServers":
"db3.atlassian-mcp": {
"command": "uvx",
"args": ["db3-atlassian-mcp@latest"],
"disabled": false,
"autoApprove": [],
"env": {
"JIRA_BASE_URL": "https://yourcompany.atlassian.net",
"JIRA_USER": "[email protected]",
"JIRA_API_KEY": "your-api-token-here"
}
}The env block is optional if you already created a .env file in Step 2.
#### VS Code / Cursor / Windsurf
Add to .vscode/mcp.json in your workspace (or global settings):
{
"mcpServers": {
"db3.atlassian-mcp": {
"command": "uvx",
"args": ["db3-atlassian-mcp@latest"],
"env": {
"JIRA_BASE_URL": "https://yourcompany.atlassian.net",
"JIRA_USER": "[email protected]",
"JIRA_API_KEY": "your-api-token-here"
}
}
}
}#### Claude Desktop
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"db3.atlassian-mcp": {
"command": "uvx",
"args": ["db3-atlassian-mcp@latest"],
"env": {
"JIRA_BASE_URL": "https://yourcompany.atlassian.net",
"JIRA_USER": "[email protected]",
"JIRA_API_KEY": "your-api-token-here"
}
}
}
}The MCP server will appear in your sidebar as db3.atlassian-mcp.
Once connected, ask Kiro something like "Read Jira ticket PROJECT-123" to verify it's working.
ENABLE_BITBUCKET_PR_TOOLS)ENABLE_BITBUCKET_ADMIN_TOOLS)The server reads credentials from a .env file. It searches in this order:
~/.db3-atlassian-mcp/.env (recommended).env in the current working directoryYou can also pass credentials via your MCP config's env block (see Step 3 above).
By default, only core Bitbucket tools are enabled (repos, branches, PRs) to keep the tool count low. Enable additional tiers via environment variables:
| Variable | Default | Tools Added |
|---|---|---|
| (core — always on) | — | list_bitbucket_repos, get_bitbucket_repo, search_bitbucket_repos, list_bitbucket_branches, list_bitbucket_pull_requests, get_bitbucket_pull_request |
ENABLE_BITBUCKET_PR_TOOLS | false | Commits, diffs, diffstats, PR comments, inline comments, replies, activity, status, create PR (+15 tools) |
ENABLE_BITBUCKET_ADMIN_TOOLS | false | Build statuses, pipelines, resolve/reopen comments, PR tasks (+10 tools) |
Example with all tiers enabled:
"db3.atlassian-mcp": {
"command": "uvx",
"args": ["db3-atlassian-mcp@latest"],
"env": {
"JIRA_BASE_URL": "https://yourcompany.atlassian.net",
"JIRA_USER": "[email protected]",
"JIRA_API_KEY": "your-api-token-here",
"ENABLE_BITBUCKET_PR_TOOLS": "true",
"ENABLE_BITBUCKET_ADMIN_TOOLS": "true"
}
}Bitbucket support is optional. Set these values only if you want Bitbucket tools:
BITBUCKET_WORKSPACE=your-workspace
[email protected]
BITBUCKET_API_TOKEN=your-bitbucket-api-tokenBITBUCKET_WORKSPACE lets tool calls omit the workspace argument. For bitbucket.org/your-workspace/..., use:
BITBUCKET_WORKSPACE=your-workspaceUse a Bitbucket Cloud API token scoped to the operations you need. Read-only tools need repository and pull request read scopes. Pipeline status tools need pipeline read scope. Creating pull requests or comments needs write access for pull requests.
git clone https://github.com/db3net/db3-atlassian-mcp.git
cd db3-atlassian-mcp
bash install.shThe installer prompts for your credentials, sets up a Python venv, validates the connection, and configures Kiro automatically.
If using uvx with @latest, it automatically pulls the newest version each time your IDE starts. If installed from source, run the installer again.
Using @latest is convenient but means updates are applied automatically. For production or security-sensitive environments, pin to a specific version:
"args": ["db3-atlassian-mcp==1.1.0"]This way you only get updates when you explicitly change the version number. Check PyPI for available versions.
rm -rf ~/.db3-atlassian-mcpThen remove the "db3.atlassian-mcp" entry from your IDE's MCP config.
uv is installed: pip install uv or brew install uvuvx is on your PATH: which uvxpython3 --versionJIRA_USER is your email address, not your usernamecat ~/.db3-atlassian-mcp/.envJIRA_BASE_URL, JIRA_USER, JIRA_API_KEYMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.