Environment Details:
- OS: Windows 11
- MCP Client: Antigravity
- Integration: Atlassian Rovo MCP Server (Jira/Confluence)
- Auth Method: Authv2 (OAuth 2.1 PKCE via Dynamic Client Registration)
Issue Summary: I am trying to configure the Atlassian Rovo MCP server to integrate Jira and Confluence into my local AI assistant environment. However, the OAuth authentication flow consistently fails during the token exchange phase with an invalid_grant error specifically complaining about the code_verifier.
Steps to Reproduce:
- Initialize the Atlassian MCP server via the client configuration (
mcp_config.json). - The client triggers the authentication flow and opens the browser for authorization.
- I approve the access request in the browser.
- The browser redirects back to the local callback URL.
- The MCP server attempts to complete the "Just-In-Time" (JIT) OAuth token exchange using the authorization code.
- The process fails, and the connection is aborted.
Expected Behavior: The PKCE token exchange should complete successfully, returning the access tokens and establishing the connection to the Atlassian MCP server for tool execution.
Actual Behavior: The authentication fails immediately after the callback with the following error logged in the server output:
Authorization error: InvalidGrantError: Failed to verify code verifier at parseErrorResponse
Troubleshooting Performed:
- Fresh Sessions: Completely closed the IDE/Client, cleared all cached states, and retried the authentication flow from scratch to rule out stale session timeouts. The result is the same.
- Speed: Completed the browser approval step as quickly as possible to ensure the
code_verifier in the local session state doesn't expire. - Network: Verified there are no strict corporate firewalls, VPNs, or proxies intercepting the local callback traffic.
- Fallback Attempt: Attempted to bypass the standard stdio/Authv2 flow by trying to configure the
/sse endpoint, but the primary issue seems tied to how the dynamic client registration and PKCE validation are handled on Atlassian's end for this specific client implementation.
Impact: This issue completely blocks the initialization of the Atlassian MCP server, preventing access to any Jira, Confluence, or Compass tools.
Could you please help if there are known compatibility issues with certain MCP clients dropping or mismatching the code_verifier during your specific DCR/JIT OAuth flow? Any guidance or workarounds would be greatly appreciated.
