Breaking mcp

Rovo MCP switched OAuth servers on May 27, 2026; clients that cache client_id or the auth discovery document may start to fail

Took effect May 27, 2026 · Rovo MCP OAuth (dynamic client registration) — auth server moved to Atlassian Identity

Reviewed against the vendor source on Sep 24, 2026 (AI-assisted review). Key facts are re-checked against the source daily.

What changes

From May 27, 2026 all requests to https://mcp.atlassian.com/v1/mcp/ use the new auth server (Atlassian Identity) for DCR OAuth. Cached client_ids and cached /.well-known/oauth-authorization-server documents aren't recognized by the new server.

Breaking: Calls fail after this date.

What to do

Don't cache DCR registrations or discovery documents across auth-server changes; key stored credentials by issuer; re-register on an issuer mismatch.

Strings to search for

mcp.atlassian.comoauth-authorization-server

Source

https://developer.atlassian.com/cloud/rovo-mcp/changelog/