Organizations are experimenting with Model Context Protocol (MCP) to connect AI agents with their data and tools. Atlassian even released a Remote MCP Server in May 2025 to provide a trusted environment for customers to safely experiment with this new technology. However, as promising as MCP is, it’s important to be aware of the security implications. New risks are emerging as the industry explores this tool, and organizations should take precautions before deploying AI agents via MCP with their Atlassian data. While not exhaustive, the measures discussed below can help reduce your security risks.
MCP stands for Model Context Protocol. It’s an open standard that provides a universal method for linking large language models (LLMs) with various data sources and external tools. In simpler terms, MCP acts as a bridge that allows AI systems to access and interact with different applications or databases. This approach promises faster development cycles, better scalability, and more interoperable workflows by standardizing how AI integrates with other software.
For clarity, here are some key terms related to MCP:
MCP (Model Context Protocol): The open standard protocol that connects AI (LLMs) to data sources and tools in a uniform way.
MCP Client: A program (such as a desktop AI assistant or an IDE plugin) that uses MCP to request data or perform actions.
MCP Server: A lightweight service that exposes specific capabilities through MCP for the AI to use. It acts as the intermediary, providing the AI agent access to certain functions or data.
Tools: External systems or services (often accessible via APIs) that MCP servers can connect to on behalf of the AI agent.
Organizations are drawn to MCP because it can make AI agents far more useful. By using MCP clients, an AI agent could interact with many different tools and datasets to get work done more effectively. However, giving AI agents the ability to act on your behalf through MCP also introduces inherent risks that need to be considered.
Even though MCP is exciting and new, its security implications are still being explored. Some of the key risks identified so far include:
Prompt Injection: AI models can be vulnerable to hidden or unexpected instructions. If an attacker embeds malicious commands into data that the AI reads (for example, a poisoned document or web page), the model might be tricked into executing those commands as if they were legitimate user instructions. This could lead the AI to perform actions it shouldn’t, without the user realizing it.
Malicious MCP Server Instructions: MCP servers provide the tools and instructions that an AI agent uses to carry out tasks. A threat actor could compromise a genuine MCP server or set up a fake one. By doing so, they could supply harmful or misleading instructions to the AI agent under the guise of normal operations, potentially causing the AI to misuse its access or perform unintended actions.
The "Rug Pull" (Tool Redefinition): A third-party MCP server might appear safe at first but could later turn malicious if it’s controlled by a bad actor. In a so-called “rug pull” scenario, an attacker maintains a seemingly trustworthy MCP server or tool integration and later injects malicious changes or redefines how a tool works. The AI agent, trusting the once-safe server, would then carry out destructive or unwanted actions after the server’s silent switch to evil.
Naming Collisions and Impersonation: AI agents rely on names to select the correct tools or resources. Attackers can exploit this by creating malicious resources with names that are nearly identical to legitimate ones. For example, an agent might see a tool called "Safe Operations Guide" (malicious) and mistake it for the authentic "Safe Operation Guide." Such slight naming variations can confuse the AI into using the wrong resource, potentially leading to harmful unintended actions.
Before you let AI agents using MCP loose on your Atlassian data, it’s critical to assess the risks and put appropriate safeguards in place. Consider the following best practices to enhance security:
Least privilege: Grant the AI agent only the minimum access permissions and tools it absolutely needs to perform its tasks. By limiting what the AI can reach or do, you reduce the potential damage if something goes wrong.
Human review: Keep a human in the loop, especially for any action that can change important data or system state. Use clear, easy-to-understand prompts for the AI, and require a person’s approval before the AI executes any high-impact operation (such as modifying data, creating issues/pages, or making configuration changes).
Supply-chain controls: Treat your AI’s tool integrations like a software supply chain. Use only trusted, vetted sources for MCP servers and tools. “Pin” each tool or integration to a specific, verified version, and regularly check for any unexpected changes or updates. This helps ensure a malicious update or look-alike tool doesn’t slip in unnoticed.
Audit and monitoring: Log all actions taken by the AI agent and continuously monitor those logs for anomalies. Just as you would with any critical service or user account, set up alerts for unusual behavior. If the AI starts doing something out of the ordinary, you’ll catch it early and can intervene before it causes harm.
AI and emerging technologies like MCP offer tremendous potential to boost productivity and innovation. Yet, security should remain a top priority as you embrace these tools. By understanding the risks outlined above and implementing appropriate safeguards, organizations can confidently explore AI-driven integrations with Atlassian products while keeping their data and systems safe. Always take the time to assess any risks unique to your specific use case and ensure you have protections in place before letting an AI agent act on your behalf.