Krosoft Wiki
Auto Light Dark
Krosoft Wiki
Auto Light Dark
Breadcrumbs

Developer and technical integration

For developers and technical users connecting an MCP client or integrating directly. The plugin runs inside Confluence and performs operations as the authenticated caller.

Connection contract

  • Endpoint: <confluence-base-url>/rest/native-mcp/1.0/mcp, including the Confluence context path.

  • Transport: remote Streamable HTTP with JSON responses and per-request streaming responses when negotiated.

  • Authentication: Confluence Data Center credentials, normally Authorization: Bearer <PAT>. Native Basic or session authentication depends on the client and site configuration.

  • MCP protocol versions: 2025-03-26, 2025-06-18 and 2025-11-25. Initialization, ping, tool discovery and tool calls are implemented.

There is no local stdio server or standalone SSE-stream endpoint. The app provides OAuth discovery and consent when an administrator enables OAuth for MCP. Client connection support is summarized in Unverified MCP client guidance.

Configure MCP behind a reverse proxy

Use your existing HTTPS Confluence proxy. Match Confluence's base URL to the public hostname and context path.

  • Connect the client to https://your-host/confluence/rest/native-mcp/1.0/mcp, replacing the hostname and context path.

  • Preserve Authorization, request bodies, response codes and authentication/rate-limit headers. Do not cache MCP responses or redirect API requests to a login page.

  • For streaming, disable response buffering and allow sufficient idle time. Use node affinity for uploads and continuation cursors on clustered sites.

OAuth only: additional settings

Enable OAuth and register the client in Confluence administration → MCP policies. If the client requires host-root discovery, add these internal proxy mappings:

Incoming path

Forward to

/.well-known/oauth-authorization-server/confluence/rest/native-mcp/1.0/oauth

/confluence/rest/native-mcp/1.0/oauth/.well-known/oauth-authorization-server

/.well-known/oauth-protected-resource/confluence/rest/native-mcp/1.0/mcp

/confluence/rest/native-mcp/1.0/oauth/protected-resource

Replace or omit /confluence to match your context path. Keep public issuer/resource URLs unchanged and normal browser login/consent enabled.

Confidential clients can use client_secret_post or client_secret_basic, with PKCE. Token/revocation POSTs need Content-Length of at most 192 KiB; unknown-length forms receive 411. Keep normal Confluence upload limits separate. PAT clients do not need OAuth mappings.

Check: connect your client and list tools. Check the public URL and forwarded credentials if authentication fails; check buffering and idle timeouts if progress is delayed. See Troubleshooting.

Tools and behavior

The app provides search, page reading, account identity, page creation and updates, comments, labels, history, attachments and section editing. Use tool discovery to check which operations your account can access. See Compatibility and limitations for deployment requirements. The AI client prepares tool calls; the app executes them as the caller, enforcing native permissions and optional space policy.

Tools is the reference for arguments, output fields, query constraints and errors. Safe editing and storage format covers complete-body replacement, truncation and version conflicts.

Use Connect your MCP client for user setup, Security and permissions for the access model, Compatibility and limitations for deployment scope, and Troubleshooting for failures.

Additional workflows

The app supports navigation, file transfers and page lifecycle operations. Operations follow your Confluence permissions and administrator policies.

Use the Tools reference for arguments and limits. For multi-step operations, follow the returned continuation instructions. After an error or timeout, check what was saved before retrying.

Developers implementing a client can consult the API contract.

For illustrated setup, see Connect using OAuth.