MCP OAuth: Atlassian auth fails - RFC 8414 issuer mismatch (Atlassian server bug, confirmed)

[stephen-meehan-lrn]

Description

Running opencode mcp auth and selecting the Atlassian remote MCP server fails during OAuth discovery with:

✗ atlassian-mcp (not authenticated)
Authentication failed
Version negotiation probe failed: Issuer mismatch in authorization server metadata (RFC 8414 §3.3): expected "https://auth.atlassian.com/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3", received "https://auth.atlassian.com"

Config

"atlassian-mcp": {
  "oauth": {},
  "type": "remote",
  "url": "https://mcp.atlassian.com/v1/mcp/authv2"
}

This is the current official Atlassian Rovo MCP endpoint per their docs: https://support.atlassian.com/atlassian-rovo-mcp-server/docs/getting-started-with-the-atlassian-remote-mcp-server/

Confirmed root cause (verified against live Atlassian endpoints)

1. Protected resource metadata correctly points to a tenant-specific authorization server:

$ curl -s https://mcp.atlassian.com/.well-known/oauth-protected-resource/v1/mcp/authv2
{
  "resource": "https://mcp.atlassian.com/v1/mcp/authv2",
  "authorization_servers": [
    "https://auth.atlassian.com/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3"
  ],
  ...
}

2. Fetching OAuth server metadata at that tenant-specific path succeeds (200 OK):

$ curl -s https://auth.atlassian.com/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3/.well-known/oauth-authorization-server
{
  "issuer": "https://auth.atlassian.com",
  "authorization_endpoint": "https://auth.atlassian.com/authorize",
  ...
}

3. Per RFC 8414 §3.3, the issuer field in this document MUST exactly equal the URL used to retrieve it (minus the .well-known suffix), i.e. it should be https://auth.atlassian.com/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3. Instead Atlassian returns the bare shared issuer https://auth.atlassian.com.

This is an Atlassian-side RFC 8414 spec-compliance bug, not an opencode bug — opencode's strict issuer validation is correctly catching a real non-compliant metadata response. However, it fully blocks OAuth login to Atlassian's currently-documented MCP endpoint from opencode.

Impact

All OAuth-based connections to the Atlassian Rovo MCP server (https://mcp.atlassian.com/v1/mcp/authv2) fail during the auth flow for any opencode user with strict RFC 8414 validation enabled.

Suggested opencode-side mitigation (until Atlassian fixes their metadata)

Since Atlassian's non-compliance appears to be a known type of issue with multi-tenant OAuth providers, consider:

• A documented per-server opt-out/relaxed-mode config flag to skip issuer validation for specific known providers, or
• Falling back to matching on scheme+host only when the metadata issuer is a strict prefix/superset relationship of the requested authorization server URL.

Workaround

Atlassian also supports non-interactive API-token-based auth as an alternative to OAuth: https://support.atlassian.com/atlassian-rovo-mcp-server/docs/configuring-authentication-via-api-token/

Environment

• opencode via opencode.json MCP config, type: "remote", Atlassian Rovo MCP server
• macOS (darwin)
• Date observed: 2026-07-28

[wstuckey]

yeah i can confirm that this is an issue for me and my team too

[rekram1-node]

we downgraded the sdk and released the fix, latest mcp sdk had some bugs in it so we were forced to downgrade