THRONE
See report Verify server

registry / record

github.com/sooperset/mcp-atlassian

github / sealed 2026-06-12 / No. f6247a80

> throne registry github.com/sooperset/mcp-atlassian sealed
receiptsealed evidence
scan id
f6247a8062c74edc9df30b0f88bb15ce
target
https://github.com/sooperset/mcp-atlassian
sealed at
2026-06-12 06:56:41Z
evidence hash
sha256:09bed78a953fedab5e2d29751b3954d630c2f58dc0a7541edf3ef786b7b1217d
01connectPASS4.7s

initialize ok: server Atlassian MCP 2.14.5, negotiated protocolVersion 2025-11-25, capabilities ['experimental', 'prompts', 'resources', 'tasks', 'tools']

02discoverPASS12ms

supported: tools/list (0 tools), resources/list (0), prompts/list (0)

03validate_schemasPASS0ms

no tools declared; nothing to validate (pass-na)

04smoke_test_toolsPASS0ms

no tools declared; nothing to smoke test (pass-na)

05error_handlingPASS5.7s

structured error responses, connection survived — wrong_type_args: skipped (no tools declared); unknown_method: error(-32602); invalid_id: no response (silent), connection alive

06streamingPASS0ms

no streaming-capable tool declared by this server; not applicable (pass-na)

07resource_lifecyclePASS16ms

server declares resources but lists none; read skipped (pass-na)

08concurrent_callsPASS0ms

no tools declared; nothing to call concurrently (pass-na)

09reconnectPASS2.6s

transport closed and relaunched; re-handshake ok (protocolVersion 2025-11-25, first session was 2025-11-25)

01connectPASS2.1s

initialize ok: server Atlassian MCP 2.14.5, negotiated protocolVersion 2025-11-25, capabilities ['experimental', 'prompts', 'resources', 'tasks', 'tools']

02discoverPASS9ms

supported: tools/list (0 tools), resources/list (0), prompts/list (0)

03validate_schemasPASS0ms

no tools declared; nothing to validate (pass-na)

04smoke_test_toolsPASS0ms

no tools declared; nothing to smoke test (pass-na)

05error_handlingPASS5.6s

structured error responses, connection survived — wrong_type_args: skipped (no tools declared); unknown_method: error(-32602); invalid_id: no response (silent), connection alive

06streamingPASS0ms

no streaming-capable tool declared by this server; not applicable (pass-na)

07resource_lifecyclePASS10ms

server declares resources but lists none; read skipped (pass-na)

08concurrent_callsPASS0ms

no tools declared; nothing to call concurrently (pass-na)

09reconnectPASS3.0s

transport closed and relaunched; re-handshake ok (protocolVersion 2025-11-25, first session was 2025-11-25)

chatgpt desktopemulation profile pending real-traffic captureCOMING SOON
SECURITY: REVIEW / 8 finding(s) / review material, not a verdict
MEDIUMTHR-SECRET-02 / Hardcoded secrets or tokens in source

token assigned a literal value test… (26 chars) — verify it is not a live credential

mcp-atlassian-HEAD/tests/unit/auth/test_authentication.py:208
MEDIUMTHR-SECRET-02 / Hardcoded secrets or tokens in source

token assigned a literal value test… (26 chars) — verify it is not a live credential

mcp-atlassian-HEAD/tests/unit/auth/test_authentication.py:237
MEDIUMTHR-SECRET-02 / Hardcoded secrets or tokens in source

token assigned a literal value test… (19 chars) — verify it is not a live credential

mcp-atlassian-HEAD/tests/unit/confluence/test_client.py:85
MEDIUMTHR-SECRET-02 / Hardcoded secrets or tokens in source

token assigned a literal value test… (19 chars) — verify it is not a live credential

mcp-atlassian-HEAD/tests/unit/jira/test_client.py:86
MEDIUMTHR-SECRET-02 / Hardcoded secrets or tokens in source

token assigned a literal value unex… (16 chars) — verify it is not a live credential

mcp-atlassian-HEAD/tests/unit/servers/test_dependencies.py:676
MEDIUMTHR-EXEC-04 / Arbitrary command execution from tool arguments

subprocess.run() called with a dynamically built command (heuristic — review): ''

mcp-atlassian-HEAD/tests/unit/test_stdin_monitoring_fix.py:42
MEDIUMTHR-EXEC-04 / Arbitrary command execution from tool arguments

subprocess.run() called with a dynamically built command (heuristic — review): ''

mcp-atlassian-HEAD/tests/unit/test_stdio_lifecycle.py:34
LOWTHR-NET-05 / Hardcoded outbound endpoints

13 non-local endpoint host(s) referenced in code — verify each is expected for this server's purpose: api.atlassian.com (mcp-atlassian-HEAD/src/mcp_atlassian/confluence/client.py:65), auth.atlassian.com (mcp-atlassian-HEAD/src/mcp_atlassian/utils/oauth.py:29), chat.openai.com (mcp-atlassian-HEAD/src/mcp_atlassian/servers/main.py:59), chatgpt.com (mcp-atlassian-HEAD/src/mcp_atlassian/servers/main.py:58), cli.github.com (mcp-atlassian-HEAD/.devcontainer/post-create.sh:15), developer.atlassian.com (mcp-atlassian-HEAD/src/mcp_atlassian/confluence/constants.py:3), dl.yarnpkg.com (mcp-atlassian-HEAD/.devcontainer/post-create.sh:26), example.atlassian.net (mcp-atlassian-HEAD/src/mcp_atlassian/servers/confluence.py:138), jira.atlassian.com (mcp-atlassian-HEAD/src/mcp_atlassian/preprocessing/jira.py:29), jira.your-company.com (mcp-atlassian-HEAD/src/mcp_atlassian/__init__.py:180), support.atlassian.com (mcp-atlassian-HEAD/src/mcp_atlassian/jira/constants.py:3), your-company.atlassian.net (mcp-atlassian-HEAD/src/mcp_atlassian/confluence/config.py:97), your-domain.atlassian.net (mcp-atlassian-HEAD/src/mcp_atlassian/__init__.py:161)

mcp-atlassian-HEAD/.devcontainer/post-create.sh:15
VERDICT: FIT TO SHIPSANDBOXED RUN — submitted server executed in a disposable microVM — compatibility: 0 fail / 0 warn across 2 clients / security: review — 8 finding(s), 0 highsealed by THRONE / No. f6247a80 / 2026-06-12
THRONE: FIT TO SHIPwear the crown

paste this in your README. it renders the live verdict and links back to this record. if a release ever breaks the verdict, the badge says so on its own.

[![THRONE: FIT TO SHIP](https://api.usethrone.dev/api/badge/https%3A%2F%2Fgithub.com%2Fsooperset%2Fmcp-atlassian)](https://usethrone.dev/server/sooperset-mcp-atlassian)
executed in a disposable microVM, created for this scan and destroyed after it. nothing outlives a run.

maintainer of this server? challenge this record: hello@usethrone.dev. tell us what we got wrong and we re-run it in the open.

this page renders the stored record of a real run. nothing on it is asserted without the execution that proved it.