Sign in

Atlassian bundle

13 Dtwo policies across 2 apps that compose into a starting posture for Atlassian — attach the bundle to cover the surface, then tune.

On this page
  1. Included policies
  2. How bundle membership works
  3. What's intentionally not in the bundle
  4. Roadmap
  5. Included policies (13)
  6. Confluence
  7. Jira

A curated bundle of policies for Atlassian MCP servers (JIRA today; Confluence and Bitbucket planned). The goal is a sensible default posture for any organization fronting an Atlassian tool through the DTwo gateway: keep PII, credentials, and secrets from leaking out of issue and page content, and keep writes clean.

Included policies

Policy App Direction Purpose
redact-sensitive-info jira egress Redact PII, credentials, and secrets from JIRA issue-view responses (issues, JQL search, comments, worklogs, remote links). Transform-only — never denies.
deny-view-search-sensitive-projects jira ingress Deny direct views and explicit JQL searches of sensitive projects; silently filter generic searches to exclude them.
deny-write-sensitive-projects jira ingress Deny write operations (edit/transition/comment/create/move/link, etc.) on issues in sensitive projects.

Policy bodies live under apps/. This page only links to them — see the top-level README for the rationale.

How bundle membership works

Bundle membership is declared in each policy's policy.md frontmatter (the policy lists bundles: ["atlassian"]). This page is a human-readable landing page; the generated manifest.json is the machine-readable source of truth. There is intentionally no separate bundle.json artifact — one source of metadata avoids drift.

The bundle's policies are designed to compose cleanly. The redaction policy is transform-only (default allow := true) and scoped narrowly to JIRA issue-view tools, so it never denies a call and never interferes with other policies on the same egress pipeline. The deny-view-search-sensitive-projects and deny-write-sensitive-projects policies run on the ingress pipeline (a separate direction) and only act on JIRA tools — the former on read tools, the latter on write tools — so none of the three collide. Together they give read-path access control, write-path protection for the same project set, and an egress redaction backstop. The two project-restriction policies each carry their own sensitive_projects set; keep them in sync.

What's intentionally not in the bundle

  • Project / board allow-deny lists. These are tenant-specific (your project keys aren't ours) and belong in your private policy repo.
  • Identity-scoped gates. IdP claims (org_id, groups, etc.) vary by deployment. Add these as separate policies in your gateway.
  • Ingress write controls. Blocking secrets from being written into issues is a complementary concern; an ingress companion policy is planned.

Roadmap

  • Confluence equivalents (apps/confluence/redact-sensitive-info, …) once a stable Confluence MCP server lands in the catalog.
  • Bitbucket equivalents.
  • An ingress policy that blocks credentials from being pasted into new JIRA issues and comments.

Included policies (13)

Confluence

Block Secrets in Confluence Pages and Commentsingress · ConfluenceBlocks Confluence write calls whose body looks like it contains a live credential — an API key, password, token, or PEM-formatted private key — before the…Confluence: Deny Org-Wide & Public Publicationingress · ConfluenceStops a prompt-injected or erring agent from broadcasting Confluence content org-wide or to anonymous external readers.Confluence: Freeze Page & Attachment Deletioningress · ConfluenceFreezes the two irreversible Confluence deletion tools on the agent channel: confluence delete page and confluence delete attachment.Confluence: Redact PII from Page & Comment Responsesegress · ConfluenceScans the responses of Confluence page, comment, and search read tools and rewrites personally identifiable information to fixed redaction tokens before the…Fence Confluence Reads & Search to Non-Restricted Spacesingress · ConfluenceFences a configurable set of restricted Confluence spaces (placeholder keys: HR, LEGAL, SEC) out of the agent's read and search paths unless the caller's IdP…

Jira

Force Internal Visibility on JSM Commentsingress · JiraKeeps agent-drafted Jira Service Management (JSM) comments off the customer-facing portal by rewriting addCommentToJiraIssue calls to carry a restrictive…JIRA: Block Change-History Actor Spoofingingress · JiraBlocks any official Jira write call — transitionJiraIssue, editJiraIssue, or createJiraIssue — that carries a historyMetadata block, before it reaches the…JIRA: Cap Field and Result Exposure on Readsingress · JiraNarrows the breadth of JIRA read requests before they run, on the two read surfaces that can pull large amounts of issue data into model context:JIRA: Deny Sensitive Project Search and Viewingress · JiraKeeps issues that belong to a configurable set of "sensitive" JIRA projects out of read access through the JIRA MCP server.JIRA: Freeze Destructive Issue Operationsingress · JiraFreezes the three irreversible Jira operations on the agent channel: jira delete issue, jira remove issue link, and jira remove watcher.JIRA: Protect Sensitive Projects from Writesingress · JiraBlocks write operations against issues that belong to a configurable set of "sensitive" JIRA projects.JIRA: Redact Sensitive Information from Issue Viewsegress · JiraRedacts sensitive content from the responses of JIRA issue-view tools before they reach the caller.JIRA: Role-Gated Writes (Read-Only Default)ingress · JiraMakes Jira read-only by default on the MCP path.
Updated

↑↓ to navigate ↵ to open