mcp-atlassian ignores `Authorization: Token` header; how to pass a PAT via headers?

Question

I'm running mcp-atlassian behind a streamable HTTP endpoint and passing a Jira PAT as Authorization: Token ... in the client config (langchain-mcp-adapter 0.1.7). The token works when set as a container env var, but header auth fails: the server logs show a 307 redirect from /mcp to /mcp/ and the redirected request has AuthHeader='Not Provided'. Is there a supported way to pass the PAT via headers, or a working workaround?

Originally asked on GitHub: https://github.com/sooperset/mcp-atlassian/issues/590

AgentArmor team · Accepted Answer

Still an open issue as of this thread. The logs show the root cause: the first POST to /mcp returns 307 Temporary Redirect to /mcp/, and the redirected request arrives with AuthHeader='Not Provided', so the PAT header is never applied to the actual MCP call. Setting the PAT as a container env var works because mcp-atlassian's auth checks read environment variables, not request headers.

Workaround that worked for at least one user (comment 5): start the container with both JIRA_URL and JIRA_PERSONAL_TOKEN=true, and keep the Authorization: Token <PAT> header in the client config:

bash

docker run -d --name mcp-atlassian \
  -p 8080:8080 \
  -e JIRA_URL="https://jira.oci.myorg.com/" \
  -e JIRA_PERSONAL_TOKEN=true \
  ghcr.io/sooperset/mcp-atlassian:latest \
  --transport streamable-http --port 8080 -vvv

Client config (Cline, streamableHttp transport):

json

{
  "mcpServers": {
    "mcp-server": {
      "type": "streamableHttp",
      "url": "http://localhost:8080/mcp",
      "headers": {
        "Authorization": "Token <YOUR_JIRA_PERSONAL_TOKEN>"
      }
    }
  }
}

This workaround is not universal: comment 2 and comment 4 report Auth type: None. Token present: False or "Total tools after filtering: 0" even with JIRA_PERSONAL_TOKEN=true. Comment 3 proposes a code change in main.py dispatch() that reads JIRA_URL, JIRA_PERSONAL_TOKEN, CONFLUENCE_URL, and CONFLUENCE_PERSONAL_TOKEN from request headers and sets them into the environment; that is a proposal and not confirmed in the thread.

General advice: treat your PAT as a secret and avoid printing it in configs or logs.

AgentArmor team · Answer

**What a GitHub user tried on GitHub** (Didn't work)

Passed the Jira PAT via `Authorization: Token MT...` in a langchain-mcp-adapter 0.1.7 config with `streamable_http`. The server received the header on the first POST, but a 307 redirect to `/mcp/` followed and the second request had no Authorization header.

Source: https://github.com/sooperset/mcp-atlassian/issues/590

AgentArmor team · Answer

**What @matthieugauthier tried on GitHub** (Worked)

Added `JIRA_PERSONAL_TOKEN: true` as an environment variable. The commenter said this made it work, explaining that mcp-atlassian's config checks read env vars and request headers are not available where those checks happen.

Source: https://github.com/sooperset/mcp-atlassian/issues/590#issuecomment-3022693610

AgentArmor team · Answer

**What @bmanikantareddy tried on GitHub** (Worked)

Ran Docker with `-e JIRA_URL=... -e JIRA_PERSONAL_TOKEN=true` and used a Cline streamableHttp config with `Authorization: Token <PAT>`. The server connected and the integration worked.

Source: https://github.com/sooperset/mcp-atlassian/issues/590#issuecomment-3888474010

AgentArmor team · Answer

**What @hghew tried on GitHub** (Didn't work)

Tried `JIRA_PERSONAL_TOKEN=true` as suggested, but still got auth errors: `User auth type: None ... Token present: False`.

Source: https://github.com/sooperset/mcp-atlassian/issues/590#issuecomment-3025865696

AgentArmor team · Answer

**What @saranyababu2005 tried on GitHub** (Didn't work)

Set `JIRA_PERSONAL_TOKEN=true` with valid credentials; Jira tools were still excluded with "configuration/authentication is incomplete" and "Total tools after filtering: 0".

Source: https://github.com/sooperset/mcp-atlassian/issues/590#issuecomment-3367813825

mcp-atlassian ignores `Authorization: Token` header; how to pass a PAT via headers?

6 answers

Add your answer or comment

mcp-atlassian ignores `Authorization: Token` header; how to pass a PAT via headers?

6 answers

Add your answer or comment

Related questions