Jira MCP

Jira MCP: limit an AI agent to one project

Connect Atlassian's MCP server once. Meandr checks the project in every Jira call, allows OPS and refuses other projects before Atlassian sees the call.

Try for free Quick tour video

The setup

Keep a Jira agent in the OPS project

Example values: the allowed project key is OPS, and a request for BILL-12 should fail.

  1. 01 Connect

    Add Atlassian's MCP server with OAuth sign-in

    In Servers → Add MCP server, enter Atlassian's endpoint, pick OAuth · authorization code and sign in once.

    • An Atlassian org admin first adds Meandr's domain to the MCP server settings in Atlassian Administration
    • Sign in as the Jira user the agent acts for: the agent works with that user's projects and permissions
    MCP Security: sign-in to servers

  2. 02 Tools

    Switch on the Jira issue tools and leave the open-ended ones off

    In the Server catalog, turn on the tools that read, create, edit, comment on and transition issues.

    • Leave off the tools that run any Atlassian operation by name: they reach every project
    • Leave issue search and Rovo search off: a search can name any project
    MCP Hub: the server catalog

  3. 03 Policies

    Allow Jira calls only when the project is OPS

    Status changes in OPS wait for a person, and the first policy that matches decides each call.

    • OPS only: Allow when the issue key starts with OPS-, or a new issue goes to project OPS
    • Other Jira projects: Deny with a reason code, and a Default policy of Deny
    MCP Governance: request conditions

  4. 04 Check

    Ask for BILL-12 and watch the call get refused

    Meandr denies the request before Atlassian sees it, and the agent gets an error instead of a result.

    • Traffic shows the denied call with the Other Jira projects policy and your reason code
    • A request for OPS-7 runs as before
    AI Governance: the audit record

Questions about Jira MCP permissions

Can the Jira user still open other projects?
In Jira, yes; through Meandr, the agent's calls for other projects are denied.
Can I make Confluence read-only for the same agent?
Yes: switch on only the Confluence tools that read pages and leave the ones that write off.
Can I host an Atlassian server in Meandr instead?
Yes, the community Atlassian server from the Docker MCP catalog; it signs in with an API token and names its tools differently, so check its list in the Server catalog before adding the policies.
Can one agent work in two projects?
Yes: add a second Allow policy with the same checks for the other project key, for example SRE.
Will the agent know why a call failed?
The agent gets an error for the denied call, and Traffic shows your reason code next to it.
Do I change the agent's setup?
Claude Code, Codex, Cursor and VS Code keep one workspace connection URL and one key; the project rule lives in Meandr.

Keep your Jira agent in one project

Connect Atlassian's server once, add one Allow policy for your project key, and deny the rest.

Try for free

Questions? Email us