Content
# Confluence MCP Server - Enterprise Edition
An enterprise-grade Model Context Protocol (MCP) server for Atlassian Confluence, designed for secure deployment in corporate environments.
## Features
- **Per-User Authentication** - Each user authenticates with their own credentials (PAT or OAuth)
- **Permission Enforcement** - Respects Confluence's native permissions; users can only access content they're authorized for
- **Audit Logging** - SIEM-compatible JSON Lines format for compliance and security monitoring
- **Multi-Language Support** - Full i18n support for English and Turkish
- **Enterprise Deployment** - Docker, Kubernetes, and NGINX configurations included
- **Sensitive Content Detection** - Detects and optionally redacts PII, financial data, and credentials
- **On-Premise Support** - Works with Confluence Server/Data Center (6.0+) and Cloud
## Quick Start
### Using Docker
```bash
# Clone the repository
git clone https://github.com/your-org/ConfluenceMCPServer4Enterprise.git
cd ConfluenceMCPServer4Enterprise
# Create environment file
cp .env.example .env
# Edit .env with your Confluence credentials
# Run with Docker Compose
cd deployment/docker
docker-compose up -d
```
### Using Python
```bash
# Install from source
pip install -e .
# Run the server
confluence-mcp --transport sse --port 9000 \
--confluence-url https://confluence.example.com \
--confluence-personal-token YOUR_PAT
```
## Configuration
### Environment Variables
| Variable | Description | Default |
|----------|-------------|---------|
| `CONFLUENCE_URL` | Confluence base URL | Required |
| `CONFLUENCE_PERSONAL_TOKEN` | Personal Access Token (Server/DC) | - |
| `CONFLUENCE_USERNAME` | Username for Cloud | - |
| `CONFLUENCE_API_TOKEN` | API Token for Cloud | - |
| `CONFLUENCE_SSL_VERIFY` | Verify SSL certificates | `true` |
| `CONFLUENCE_SPACES_FILTER` | Comma-separated allowed spaces | All |
| `READ_ONLY_MODE` | Disable write operations | `false` |
| `MCP_LOCALE` | Language (`en` or `tr`) | `en` |
| `AUDIT_ENABLED` | Enable audit logging | `true` |
See [.env.example](.env.example) for all options.
### Command Line Options
```bash
confluence-mcp --help
Options:
--transport [stdio|sse|streamable-http]
--port INTEGER
--host TEXT
--confluence-url TEXT
--confluence-personal-token TEXT
--read-only
--locale [en|tr]
-v, --verbose
```
## Available Tools
### Read Operations
| Tool | Description |
|------|-------------|
| `confluence_search` | Search content using CQL or simple text |
| `confluence_get_page` | Get page content by ID or title |
| `confluence_get_page_children` | List child pages |
| `confluence_get_comments` | Get page comments |
| `confluence_get_labels` | Get page labels |
| `confluence_check_permission` | Check user permissions |
### Write Operations
| Tool | Description |
|------|-------------|
| `confluence_create_page` | Create a new page |
| `confluence_update_page` | Update existing page |
| `confluence_delete_page` | Delete a page |
| `confluence_add_comment` | Add a comment |
| `confluence_add_label` | Add a label |
## Security
### Per-User Authentication
Every request to the MCP server requires user authentication. The server does not share credentials between users.
**Personal Access Token (PAT)** - For Server/Data Center:
```
Authorization: Token YOUR_PERSONAL_ACCESS_TOKEN
```
**OAuth Bearer Token** - For Cloud:
```
Authorization: Bearer YOUR_OAUTH_TOKEN
```
### Permission Enforcement
1. **Confluence Native** - The server uses the user's token for all API calls, so Confluence enforces permissions automatically
2. **Pre-Check (Optional)** - Explicit permission validation before operations
3. **Space Filtering** - Restrict access to specific spaces via `CONFLUENCE_SPACES_FILTER`
4. **Read-Only Mode** - Disable all write operations via `READ_ONLY_MODE=true`
### Audit Logging
All operations are logged in JSON Lines format:
```json
{
"timestamp": "2025-01-15T10:30:45.123Z",
"request_id": "req_abc123",
"user_id": "user123",
"action": "page_read",
"status": "success",
"resource_type": "page",
"resource_id": "123456",
"space_key": "DEV",
"duration_ms": 234
}
```
### Sensitive Content Detection
The server can detect and flag:
- National IDs (TCKN, SSN)
- Credit card numbers
- IBAN numbers
- API keys and tokens
- Passwords in text
- Email addresses
- Confidentiality markers
## Deployment
### Docker Compose
```bash
cd deployment/docker
docker-compose up -d
```
### Kubernetes
```bash
# Create namespace
kubectl create namespace mcp
# Apply configurations
kubectl apply -f deployment/kubernetes/configmap.yaml
kubectl apply -f deployment/kubernetes/deployment.yaml
kubectl apply -f deployment/kubernetes/ingress.yaml
```
### Architecture
```
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ MCP Client │────►│ NGINX/Ingress │────►│ MCP Server │
│ (Claude, etc.) │ TLS │ (TLS, Rate │ │ (This Server) │
└─────────────────┘ │ Limiting) │ └────────┬────────┘
└─────────────────┘ │
│ User's PAT
▼
┌─────────────────┐
│ Confluence │
│ Server/Cloud │
└─────────────────┘
```
## Multi-Language Support
The server supports English and Turkish for all user-facing messages.
Set the language:
```bash
# Via environment
export MCP_LOCALE=tr
# Via command line
confluence-mcp --locale tr
# Via HTTP header
Accept-Language: tr
```
## Development
### Prerequisites
- Python 3.11+
- Docker (optional)
### Setup
```bash
# Clone
git clone https://github.com/your-org/ConfluenceMCPServer4Enterprise.git
cd ConfluenceMCPServer4Enterprise
# Create virtual environment
python -m venv venv
source venv/bin/activate # or `venv\Scripts\activate` on Windows
# Install with dev dependencies
pip install -e ".[dev]"
# Run tests
pytest
# Run linter
ruff check src/
```
### Project Structure
```
ConfluenceMCPServer4Enterprise/
├── src/confluence_mcp/
│ ├── __init__.py # Entry point
│ ├── server/ # MCP server and tools
│ ├── confluence/ # Confluence API client
│ ├── security/ # Permission, audit, sensitive detection
│ ├── i18n/ # Internationalization
│ └── utils/ # Utilities
├── deployment/
│ ├── docker/ # Docker configurations
│ ├── kubernetes/ # K8s manifests
│ └── nginx/ # NGINX config
├── docs/ # Documentation
└── tests/ # Test suite
```
## Contributing
1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Run tests and linting
5. Submit a pull request
## License
MIT License - see [LICENSE](LICENSE) for details.
## Acknowledgments
This project is based on [mcp-atlassian](https://github.com/sooperset/mcp-atlassian) with significant modifications for enterprise use cases.
