Atlassian MCP server and Dome

1. 01

   Add the Atlassian MCP server

   The tools=all endpoint lists every tool by name, so rules can name them. Credentials are per user, through OAuth.

   $ dome tools add --name atlassian \
     --url "https://mcp.atlassian.com/v2/mcp?tools=all" \
     --auth-method oauth --credential-type per-user \
     --oauth-authorize-url https://auth.atlassian.com/authorize \
     --oauth-token-url https://auth.atlassian.com/oauth/token \
     --oauth-registration-url https://auth.atlassian.com/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3/dcr/register \
     --oauth-default-scope offline_access \
     --oauth-default-scope read:jira:agent-interface \
     --oauth-default-scope write:jira:agent-interface \
     --oauth-default-scope search:jira:agent-interface \
     --oauth-default-scope read:confluence:agent-interface \
     --oauth-default-scope search:confluence:agent-interface \
     --gateway eng-gateway

2. 02

   Sync the catalog

   The sync lists tools with your own Atlassian sign-in. Without it, agents see “tool not available in this gateway”.

   $ dome tools catalog sync atlassian

3. 03

   Apply the rules

   Start with one agent. Simulate a call against another cloudId and check it's refused before you deploy.

   $ dome rules apply atlassian-args.cedar \
     --agent incident-scribe --name atlassian-per-site

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Atlassian itself, see Atlassian's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when { resource.connection_name == "atlassian" };
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "atlassian" &&
  resource has arguments && resource.arguments has cloudId &&
  resource.arguments.cloudId != "7f6c3e2a-1d4b-4c8e-9a0f-2b5d8e1c4a9f"
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "atlassian" &&
  ["createConfluenceContent", "updateConfluenceContent"].contains(resource.tool_name)
};