# Atlassian Rovo

You need an Atlassian Cloud site with Jira, Confluence, and/or Compass, and the connecting Atlassian account must have access to the intended site and apps. Use a modern browser. Atlassian documents no paid-plan requirement for the MCP Server.

You need no Atlassian-side configuration unless your organization restricts OAuth client domains, IP addresses, third-party apps, or network egress. For OAuth-domain or IP-allowlist restrictions, sign in to Atlassian Administration with an organization-admin account and complete the applicable checks below. If app-management policy blocks authorization, ask the site admin who owns Marketplace and third-party app policy for help. For strict egress filtering, ask your network/security owner to allow the required Atlassian domain.

### Allow the Speakeasy OAuth domain
1. Open [admin.atlassian.com](https://admin.atlassian.com/).
2. If more than one organization is shown, select the organization you want to connect.
3. Select **Rovo**.
4. Select **Rovo MCP server**.
5. Check whether the allowed domains cover this hosted OAuth callback:

   ```
   https://app.getgram.ai/mcp/remote_login_callback
   ```

6. If it is not covered, select **Add domain**.
7. Enter this exact custom domain pattern:

   ```
   https://app.getgram.ai/mcp/remote_login_callback
   ```

8. Use the submission control shown in the console.

Keep **Allow Atlassian supported domains** selected. Deselecting it blocks Atlassian's supported-domain set.

If your organization uses IP allowlists, ask your network/security owner to confirm that hosted Speakeasy requests are allowed. Exact hosted outbound IP ranges are not established for this guide; do not guess them.

If your organization uses strict egress filtering, ask your network/security owner to allow the following domain in your organization's network controls so interactive Jira and Confluence widgets can render:

```
*.atlassian.net
```

<!-- screenshot: Rovo > Rovo MCP server showing the domain list and Add domain, with organization-specific domains redacted -->

If Atlassian denies the OAuth redirect during connection, return to **Rovo** > **Rovo MCP server** and verify that the client origin matches an allowed domain or pattern. If the authorization screen appears but a tool call returns an IP permission error, update the relevant organization IP allowlist.

### Add the server in Speakeasy
1. In the Speakeasy AI Control Plane sidebar, find **Connect** and select **Sources**.
2. Click **Add Source**.

If an **Atlassian Rovo** result in the catalog clearly identifies the current remote URL shown below:

1. Choose **3rd-party server**.
2. On the **MCP Catalog** page, enter `Atlassian` in **Search MCP servers...**.
3. Open that result with **View**.
4. Click **Add**.
5. In **Add to Project**, click **Add to Project**.

If no clearly current **Atlassian Rovo** result appears in the catalog, use the custom remote path:

1. Choose **Custom remote server**.
2. On **Add a custom remote MCP server**, paste this value into **Remote MCP server URL**:

   ```
   https://mcp.atlassian.com/v1/mcp/authv2
   ```

3. Click **Add server**.

Either path opens the server's **Overview** page.

<!-- screenshot: the Add Source menu open on the Sources page, or the Atlassian catalog entry if an exact entry is present -->

### Connect your credentials
1. From the server's **Overview**, open **Settings**.
2. Under **Authentication**, select **Use Discovered**.
3. In **Attach Remote Identity Provider**, confirm that the issuer/base auth URL is:

   ```
   https://auth.atlassian.com
   ```

4. Keep the automatically derived **Slug**.
5. Keep the automatically derived **Display name (optional)**.
6. Under **Endpoints**, click **Discover** so the authorization, token, and registration endpoints fill from Atlassian's discovery chain.
7. Under **Session Client**, keep **Client Type** set to **Dynamic Client Registration (DCR)**.
8. Keep the discovered **Token Endpoint Auth Method**.
9. Leave **Scope (override)** and **Audience (optional)** empty.
10. Click **Attach Identity Provider**.

You do not need to paste a **Client ID** or **Client Secret**.

When Atlassian prompts you for access:

1. Sign in with the intended Atlassian account.
2. Authorize the intended Atlassian Cloud site.
3. Enable the intended Atlassian apps.

If organization policy rejects the flow, complete [Allow the Speakeasy OAuth domain](#allow-speakeasy-domain), then retry the connection.

<!-- screenshot: Attach Remote Identity Provider after discovery, with Dynamic Client Registration (DCR) selected and no secret values visible -->

This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see [Atlassian's MCP documentation](https://support.atlassian.com/atlassian-rovo-mcp-server/docs/getting-started-with-the-atlassian-remote-mcp-server/).