Rovo MCP Confluence CQL tool returns inconsistent tool-not-found, 403, and success responses

Nishith P

Summary

We are seeing inconsistent results from Atlassian Rovo MCP calls to the Confluence CQL search tool through https://mcp.atlassian.com/v1/mcp.

For the same visible tools/call request pattern using searchConfluenceUsingCql, the MCP endpoint has returned different outcomes across attempts:

• MCP error -32602: Tool searchConfluenceUsingCql not found

• 403 Forbidden with message Current user not permitted to use Confluence

• A later successful Confluence response containing page/search results

This creates reliability and idempotency problems for an application that depends on Rovo MCP to retrieve Confluence context. Retries can alternate between tool-discovery failure, authorization failure, and success, which makes it difficult to determine whether the root cause is configuration, permissions, token/session state, or transient MCP behavior.

Environment

• Atlassian Cloud site: deepwatch.atlassian.net

• MCP endpoint: https://mcp.atlassian.com/v1/mcp

• MCP method: tools/call

• MCP tool: searchConfluenceUsingCql

• Client used for manual reproduction: Postman / MCP-compatible HTTP client

• Example CQL shape: id = <known_confluence_page_id> AND type = page

• Observed behavior date: 2026-08-11

Reproduction Pattern

1. Initialize or use an authenticated Rovo MCP session.

2. Call tools/call for searchConfluenceUsingCql.

3. Pass the Atlassian Cloud site identifier and a CQL query for a known Confluence page that the account should be able to read.

4. Repeat the same visible request shape several times.

5. Observe that responses are not stable across attempts.

Observed Results

Across repeated attempts, the same visible request shape returned:

1. 403 Forbidden with Current user not permitted to use Confluence.

2. MCP error -32602: Tool searchConfluenceUsingCql not found.

3. A successful Confluence result payload for the same CQL query.

Application traces also showed multiple sequential Confluence CQL calls during one workflow. Because errors and successes can occur in the same overall run, retry behavior may hide hard authorization or tool-discovery failures.

Expected Behavior

For a connected and authorized Rovo MCP session, the result should be stable for the same request:

• If the account lacks Confluence product or CQL search permission, the endpoint should consistently return an authorization error.

• If searchConfluenceUsingCql is unavailable for the tenant/session, the endpoint should consistently return a tool-discovery error.

• If the account is authorized and the tool is available, repeated calls should consistently return search results for the same CQL query.

Actual Behavior

The same visible request pattern alternates between:

• tool-not-found

• Confluence permission denied

• successful Confluence search result

Impact

• Applications using Rovo MCP cannot reliably distinguish permission/configuration errors from transient MCP failures.

• Retrying requests can produce inconsistent outcomes for the same logical operation.

• Downstream workflows may receive incomplete Confluence context when some MCP calls fail and later calls succeed.

• It is difficult to validate whether the issue is caused by cloud ID format, token/session state, tenant authorization, Confluence product access, or MCP tool discovery.

Requested Atlassian Support Review

Please help confirm:

1. Whether searchConfluenceUsingCql is expected to be available for this tenant through https://mcp.atlassian.com/v1/mcp.

2. Whether the cloudId argument should be the Atlassian site URL or the UUID cloud ID for this tool.

3. Whether the connected account has Confluence product access and CQL/search authorization through Rovo MCP.

4. Why the same visible request can return tool not found, 403 Current user not permitted to use Confluence, and later success.

5. Whether MCP tool discovery or session initialization can vary between calls or be affected by stale/partial session state.

6. What endpoint, token/header format, OAuth scopes, and initialization sequence Atlassian recommends for stable Confluence CQL tool calls.

Requested Outcome

We need a clear determination of whether this is:

• expected behavior caused by missing permissions or unsupported tool access,

• a client-side configuration issue,

• a tenant/account authorization issue, or

• an Atlassian MCP/Rovo service-side consistency issue.

Success Criteria

• Atlassian confirms the correct endpoint, authentication/header format, scope requirements, and cloud ID format for searchConfluenceUsingCql.

• Atlassian confirms whether the account is authorized for Confluence CQL search through Rovo MCP.

• Repeated calls to the same CQL query produce either stable results or stable errors.

• The application can reliably classify hard auth/tool-discovery failures separately from retryable transient failures.

 

Tomislav Tobijas

Hi @Nishith P ,

I'm just going to move this to the Rovo Q&A forum group so someone can potentially chime in. There's also a dedicated MCP discussion group Atlassian Rovo MCP Server where you can ask these questions.

I'm OOO and away from my laptop but if you don't sort this out until next week, I could maybe take a look when I'm back. But hopefully, someone will chime in in the meantime. 👀

Cheers,
Tobi