aashari/mcp-server-atlassian-confluence — agentic threat model

Not certain from the listing — The MCP server itself does not bundle a specific foundation model, but the host client's LLM is highly vulnerable to indirect prompt injection embedded within Confluence wiki pages.

Acts as a direct bridge to Confluence data. Threats include data exfiltration of sensitive wiki spaces and knowledge-base poisoning if malicious actors edit Confluence pages to feed poisoned context to the agent.

Exposes tools for space/page reading and searching. Insecure tool integration could allow an LLM to be manipulated into executing overly broad search queries or accessing restricted spaces if scope controls are weak.

Requires hosting as an MCP server. Risks include exposure of Atlassian API tokens/credentials in the hosting environment and lack of sandboxing between the MCP process and the host system.

Not certain from the listing — There is no mention of built-in logging, audit trails, or guardrails to monitor which pages are accessed by the agent or to detect anomalous data harvesting.

Relies on Confluence tokens to scope space access. If a single high-privilege token is shared, the agent lacks granular authorization controls to prevent users from querying pages they shouldn't see.

Designed to plug into broader MCP-based multi-agent ecosystems. A compromised or rogue orchestrator agent could abuse this tool to silently index and exfiltrate an entire corporate wiki.