Agentic Pipelines now integrate with the redesigned Atlassian MCP server for Claude and Codex agents. Rovo Dev CLI agents in Agentic Pipelines currently use the original version of Atlassian MCP server and are unaffected by this update.

What benefits does this bring to you?

  • Expanded tooling and powerful workflows: The revamped MCP introduces unified tools across products which makes agentic pipelines more capable. Spot the vulnerabilities on your Pull Request, log a ticket for security review, and create a Loom video of the exploit – all with the same agent.
  • Standardized security & scoping: Integrates natively with Atlassian API Token standards and granular permissions. Use a scoped token to integrate with Jira, Confluence, and other Atlassian tools.
  • Faster updates: New tools, enhancements, and bug fixes become available faster
  • Seamless Bitbucket integration: No need to manage tokens to integrating with Bitbucket. Specify the scopes you need and Pipelines handles authentication for you

How it works

Connect to Jira, Confluence, and other products

Bitbucket tools provided by the new MCP are configured by default: if no scopes are provided, the built-in token receives read:bitbucket:agent-interface, and write operations require explicitly configured write scopes. For connecting to Jira, Confluence and other products, add a scoped API token to a user-defined variable named ATLASSIAN_MCP_API_TOKEN. The token’s scopes determine which operations the agent can perform.

To create a token:

  1. Create a personal API token with the required scopes.
  2. If necessary, click Back to select the scopes you want your API token to have.

If you only need Bitbucket access, leave ATLASSIAN_MCP_API_TOKEN unset or empty for the agent step. Pipelines will continue to authenticate the Bitbucket connection using its built-in OAuth token.

See [INSERT_SUPPORT_PAGE_LINK] for more details on this.

Control which tools agents can use

You can now configure fine-grained tool permissions in bitbucket-pipelines.yml. This is a 2 step process, configuring your provider to prompt for tool access, and then adding answers to these prompts in bitbucket-pipelines.yml.

Configure provider

You must first configure the provider to prompt for the MCP tools you desire. This allows the request to reach Bitbucket Pipelines where configuration for approval or denial of these prompts is configured.

For Claude, add the following to .claude/settings.json to prompt for write operations from the Atlassian MCP connections:

{
  "permissions": {
    "ask": [
      "mcp__atlassian_v2__executeWrite",
      "mcp__atlassian_v2-bitbucket-tools__executeWrite"
    ]
  }
}

For Codex, add the following to .codex/config.toml to prompt before executeWrite runs:

[mcp_servers.atlassian_v2.tools.executeWrite]
approval_mode = "prompt"

[mcp_servers."atlassian-v2-bitbucket-tools".tools.executeWrite]
approval_mode = "prompt"

Configure approvals in bitbucket-pipelines.yml

In the agent definition in bitbucket-pipelines.yml, configure answers to provider’s prompts using permissions.on-ask. There are 3 fields you can configure:

  • allow lists tool patterns to permit.
  • deny lists tool patterns to block.
  • default sets the fallback for requests that match neither list.

The allow and deny rules control tool availability; they do not grant API scopes.

The following example adds deny rules for executeWrite calls that create a Bitbucket pull request or match *Jira* on atlassian-v2, and allows all others:

definitions:
  agents:
    my-agent:
      provider: codex
      permissions:
        on-ask:
          default: allow # Allow MCP tools that don't match any deny rules
          deny:
            - mcp__atlassian_v2-bitbucket-tools__executeWrite(name:createBitbucketRepoPullRequest)
            - mcp__atlassian_v2__executeWrite(name:*Jira*)

See this page for more details on configuring tool permissions.

What changes for existing Agentic Pipelines users

The following tools are not currently supported by the redesigned Atlassian MCP server:

  • analyzePipelineStepFailure
  • analyzePullRequestCommitStatusFailures
  • declinePullRequest
  • getRepositoryDefaultBranch

If your workflow relies on an unsupported tool, you can switch back to the legacy MCP server by setting use-legacy-mcp to true in your agent configuration:

definitions:
  agents:
    mcp-claude:
      provider: claude
      use-legacy-mcp: true
      prompt: Report the repository name and up to five open pull requests.

⚠️ Moving away from the legacy Bitbucket MCP server
We plan to retire the use-legacy-mcp option in a future release, after the remaining gaps in tool coverage are addressed. If your Claude or Codex agent currently uses use-legacy-mcp: true, prepare to migrate by testing your workflows with use-legacy-mcp: false once the tools you need are supported.

A note for Rovo Dev CLI users

Rovo Dev CLI agents currently use the legacy Atlassian MCP server and are unaffected by this update. The redesigned MCP server configuration described above applies only to Claude and Codex agents.

Existing Jira and Confluence access

Rovo Dev already connects to a built-in Atlassian MCP that can access Jira and Confluence automatically. In most cases, no extra configuration is required. Access is determined by the USER_API_TOKEN you provide for the agent step.

If you prefer to control Jira and Confluence access with a separate token, create a user-defined variable named ATLASSIAN_MCP_API_TOKEN. This takes precedence over USER_API_TOKEN.

What’s next for Rovo Dev CLI?

As outlined in the public transition notice, Rovo Dev CLI will transition to Rovo CLI. Agentic Pipelines will continue supporting Rovo Dev CLI until we share a migration path to Rovo CLI in CY2027.

Get started

  1. Try it now: The new MCP server is already on for Claude and Codex agents in Agentic Pipelines. Run an agent that reads from Bitbucket and it will use it with no changes needed.
  2. Add Jira and Confluence: Create a scoped API token and save it as the ATLASSIAN_MCP_API_TOKEN variable. Create a token
  3. Set tool permissions: Configure your provider to prompt on tool use and add permissions.on-ask rules to your agent definition to allow or deny specific tools. View documentation
  4. Need a tool that isn’t supported yet? Set use-legacy-mcp: true on that agent and migrate later.

Questions or feedback? Share them in the Atlassian Community or contact our support team.