{"id":"efe2d86c-8fcb-4419-a99c-78af6e4d1299","slug":"flowgent-labs-confluence-mcp","kind":"mcp","name":"confluence-mcp","summary":"An enhanced Enterprise-grade Confluence MCP server.","owner":"flowgent-labs","repoUrl":"https://github.com/flowgent-labs/confluence-mcp","license":"Apache-2.0","licenseTier":"permissive","trust":"community","stars":1,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-07-15T15:24:48.000Z","addedAt":"2026-10-21T21:32:56.517Z","logoUrl":"https://avatars.githubusercontent.com/u/281867050?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["cloud-infra"],"tags":[],"runtime":"go","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-26T09:13:22.295Z","sample":false,"url":"https://conduits.dev/tools/flowgent-labs-confluence-mcp","language":"Shell","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"<!-- Generated by https://github.com/flowgent-labs/mcpfather -->\n\n# confluence-mcp\n\n[![Go](https://img.shields.io/badge/go-1.26.0+-00ADD8?logo=go)](https://go.dev/)\n[![MCP](https://img.shields.io/badge/protocol-MCP-blue)](https://modelcontextprotocol.io/)\n[![Prometheus](https://img.shields.io/badge/metrics-Prometheus-E6522C?logo=prometheus)](https://prometheus.io/)\n[![OpenTelemetry](https://img.shields.io/badge/tracing-OTel-5C4EE5?logo=opentelemetry)](https://opentelemetry.io/)\n[![OIDC](https://img.shields.io/badge/auth-OIDC-CB3837?logo=openid)](https://openid.net/connect/)\n[![Helm](https://img.shields.io/badge/deploy-Helm-0F1689?logo=helm)](https://helm.sh/)\n\n> The Enterprise-grade MCP server generated by [mcpfather](https://github.com/flowgent-labs/mcpfather), specifically designed for AI to call Confluence Data Center APIs, generated from MCPFather — exposes **176 native tools**. Each API operation becomes an AI-callable tool with typed schemas and customized aggregate virtual tools, auth forwarding, and observability built-in, and even use as regular CLI.\n\n## Quick Start\n\n```sh\nmake\n\n# Or with OpenTelemetry distributed tracing (gRPC or HTTP)\nmake build-with-otel-grpc   # OTLP gRPC exporter\nmake build-with-otel-http   # OTLP HTTP/protobuf exporter\n```\n\n### Start in `HTTP` mode (example)\n\n```sh\n# Configure your upstream API\nexport MCP__UPSTREAM__DEFAULT__ENDPOINT=https://api.example.com\nexport MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN=your-token\n\n./bin/confluence-mcp --transport http --port 8080 &\n```\n\n- Inspection MCP Server Authentication (OAuth2.1).\n\n```bash\nexport MCP__SERVER__AUTH__OIDC__ENABLED=true\nexport MCP__SERVER__AUTH__OIDC__ISSUER=\"https://keycloak.example.com/realms/master\"\nexport MCP__SERVER__AUTH__OIDC__AUDIENCE=\"confluence-mcp\"\n./bin/confluence-mcp -v 10 --transport http --port 8080\n\n# Obtain the OAuth2.1 metadata.\ncurl -s https://iam.example.com/realms/master/.well-known/openid-configuration\n\ncurl -s localhost:8080/.well-known/oauth-protected-resource\n#{\"resource\":\"confluence-mcp\",\"authorization_servers\":[\"https://keycloak.example.com/realms/master\"],\"bearer_methods_supported\":[\"header\"]}\n```\n\n### Run in `CLI` mode (example)\n\n```sh\n./bin/confluence-mcp -v 1 -t cli list\n./bin/confluence-mcp -v 1 -t cli <tool-name> [OPTIONS]\n```\n\n#### Request body (`--body`)\n\nUse `--body` to send a JSON request body to the upstream API. Query/path\nparameters are passed as regular `--key value` flags.\n\n```sh\n# JSON body\n./bin/confluence-mcp -v 1 -t cli uploadScanReport --scanId 12345 \\\n  --body '{\"note\":\"quarterly\"}'\n```\n\n#### File uploads (fileRef URL)\n\nFor file upload tools, pass file fields as normal tool arguments. Values starting\nwith `@file:///`, `@https://`, or `@http://` are fileRef URLs: the server downloads\nthe file to the TFS temp cache and forwards it to upstream. Other multipart\nfields are passed as regular `--key value` flags.\n\n```sh\n# Local file, for the conventional multipart field named \"file\"\n./bin/confluence-mcp -v 1 -t cli uploadScanReport --scanId 12345 \\\n  --file /tmp/report.pdf\n\n# Remote URL (server downloads, then forwards to upstream)\n./bin/confluence-mcp -v 1 -t cli uploadScanReport --scanId 12345 \\\n  --file @https://cdn.example.com/reports/q1.pdf\n\n# Named file field\n./bin/confluence-mcp -v 1 -t cli configSaml \\\n  --identityProviderXml @file:///tmp/idp.xml \\\n  --samlConfiguration '{\"enabled\":true}'\n```\n\nThe same flag syntax works in HTTP mode via `mcpclient.sh`:\n\n```sh\n./mcpclient.sh call uploadScanReport --scanId 12345 \\\n  --file /tmp/report.pdf\n```\n\n## Options\n\n| Flag | Default | Description |\n|------|---------|-------------|\n| `-t, --transport` | `stdio` | `stdio` / `http` / `cli` |\n| `-p, --port` | `8080` | HTTP server port |\n| `--metrics-port` | `0` | Override mgmt port (0 = use config) |\n| `-v, --verbose` | `0` | Log verbosity (0–10) |\n| `-V, --version` | — | Print version and exit |\n| `--print-default-config` | — | Print default config.yaml to stdout |\n\n## Authentication\n\nAuth is split into two independent layers — neither shares credentials with the other:\n\n| Layer | Config YAML path | Env var prefix | Role |\n|---|---|---|---|\n| **Server** | `server.auth.oidc` | `MCP__SERVER__AUTH__OIDC__*` | Validates AI agent bearer tokens (inbound) |\n| **Upstream OIDC** | `upstream.default.auth.oidc` | `MCP__UPSTREAM__DEFAULT__AUTH__OIDC__*` | Server's own OIDC client_credentials for upstream APIs |\n| **Upstream Static** | `upstream.default.auth.static` | `MCP__UPSTREAM__DEFAULT__AUTH__STATIC__*` | Server's own static token/cookie for upstream APIs |\n\n**Server (inbound)** — validates bearer tokens presented by AI agents (MCP clients).\nOnly applies to `--transport http`; stdio has no network boundary. Standard OIDC JWT\nbearer validation per RFC 9728 / MCP Authorization spec.\n\n**Upstream (outbound)** — credentials the MCP server uses to call upstream APIs.\nToken priority (first available wins):\n\n1. **OIDC** client_credentials grant (`upstream.default.auth.oidc.*`)\n2. **Static** web token (`upstream.default.auth.static.web_token`)\n\nThe AI agent's inbound token is **never** forwarded upstream (MCP spec: Token Passthrough Prohibition).\nCookie-based auth is also available via `upstream.default.auth.static.cookie_token`.\n\n## Configuration\n\nCreate `~/.confluence-mcp/config.yaml` (run `--print-default-config` for a full template):\n\n```yaml\n# ---- Server (inbound) ----\n# Validates bearer tokens presented by MCP clients (AI agents).\n# Resource Server role per RFC 9728 / MCP Authorization spec.\n# Only enforced on the http transport; stdio has no network boundary.\nserver:\n  # HTTP server timeouts in seconds. 0 = disabled.\n  # write_timeout_seconds must be 0 for SSE (Streamable HTTP) transport.\n  read_timeout_seconds: 30\n  write_timeout_seconds: 0\n  idle_timeout_seconds: 120\n  auth:\n    oidc:\n      enabled: false\n      issuer: \"\"            # e.g. https://idp.example.com/realms/myrealm\n      jwks_uri: \"\"          # optional override (auto-discovered from issuer if empty)\n      audience: \"\"          # expected JWT \"aud\" claim; also published as the RFC 9728 protected-resource identifier\n      # When true, validated JWT claims (sub, email) are forwarded upstream\n      # as X-MCP-Client-Token-Sub and X-MCP-Client-Token-Email headers.\n      enable_client_token_claim_forward: true\n      # Additional JWT claims to forward as X-MCP-Client-Token-<Header-Name> headers.\n      # e.g. [\"given_name\", \"family_name\", \"preferred_username\"]\n      # additional_client_token_claim_forward: []\n  # ---- Temporary File System (TFS) Data Plane ----\n  # Built-in REST API for binary file transfer, separate from the\n  # JSON-RPC 2.0 control plane at /mcp.\n  # Files stored under ~/.<service-name>/tfs/{download,upload}/\n  tfs:\n    enabled: true\n    # Empty means auto-detect from the inbound /mcp request Host/X-Forwarded-* headers.\n    base_uri: \"\"\n    # Download URLs are one-shot: after a successful GET from /_/tfs/download/{id},\n    # the temporary file is immediately removed. Files that are never downloaded\n    # are removed by the background clean job after this TTL.\n    clean-job-ttl-seconds: \"5m\"\n\nlogging:\n  level: 0\n  auth_verbose: false\n\n# ---- Upstream (outbound) ----\n# Credentials the server uses to call upstream APIs.\n# The two auth layers are independent — the inbound token is never reused outbound\n# (see MCP Authorization spec: Token Passthrough Prohibition).\nupstream:\n  default:\n    endpoint: \"\"               # upstream API base URL (e.g. https://api.example.com)\n    enable_mcp_session_forward: true\n    auth:\n      oidc:\n        enabled: true\n        issuer: https://idp.example.com/realms/myrealm\n        client_id: my-client\n        client_secret: \"${MCP__UPSTREAM__DEFAULT__AUTH__OIDC__CLIENT_SECRET}\"\n        scopes: openid\n        # token_url: \"\"   # auto-discovered from issuer /.well-known\n\n      # Static credentials for legacy / simple APIs\n      static:\n        web_token: \"${MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN}\"   # or set cookie_token\n\n# Reusable policies selected by HTTP-node `spec.pool` and `spec.retry`.\n# Omitted references use pool limits 32/32/32, request_timeout 0s, and 0 retries.\nmiddleware:\n  http_client_pool:\n    large:\n      max_idle_conns: 128          # reusable idle connections across all upstream hosts\n      max_idle_conns_per_host: 32  # reusable idle connections retained per upstream host\n      max_conns_per_host: 64       # hard cap: active + dialing + idle connections per host\n      dial_timeout: 10s            # TCP connection establishment timeout\n      request_timeout: 60s         # complete attempt, including response-body reads\n    medium:\n      max_idle_conns: 64\n      max_idle_conns_per_host: 16\n      max_conns_per_host: 32\n      dial_timeout: 5s\n      request_timeout: 30s\n    small:\n      max_idle_conns: 16\n      max_idle_conns_per_host: 4\n      max_conns_per_host: 8\n      dial_timeout: 3s\n      request_timeout: 15s\n  retry:\n    reliable:\n      max_retries: 4               # extra attempts after the first request\n      max_elapsed_time: 30s        # hard budget for all attempts and backoff\n    standard:\n      max_retries: 2\n      max_elapsed_time: 15s\n    besteffort:\n      max_retries: 0               # no automatic retry; max_elapsed_time is unnecessary\n\n# QoS-style names communicate retry intent without promising application success.\n\nnative_tools:\n  expose:\n    register_all_tools_by_default: true   # expose all native tools\n    # includes: [Tool1, Tool2]            # or whitelist specific tools\n    # excludes: [Tool3]                   # hide noisy tools\n```\n\nAll values can be set via `MCP__`-prefixed environment variables (e.g. `MCP__UPSTREAM__DEFAULT__AUTH__OIDC__CLIENT_ID`).\n\n## Management — Metrics, Tracing, Pprof\n\n```yaml\nmgmt:\n  enabled: true\n  host: 0.0.0.0\n  port: 9991\n\n  otel:\n    enabled: false\n    endpoint: localhost:4317\n    protocol: grpc\n    sample_rate: 1.0\n\n  metrics:\n    enabled: true\n    prometheus: true\n    export_interval: 30s\n\n  pprof:\n    enabled: false\n    server_bind: 0.0.0.0:6669\n```\n\n```sh\n./bin/confluence-mcp --transport http --port 8080\ncurl http://localhost:9991/metrics    # Prometheus endpoint\ncurl http://localhost:9991/health     # health check\n```\n\nTrace spans are named `mcp.tool.<name>`. W3C `traceparent` is propagated to upstream calls.\n\n## Available Tools (176)\n\n| Tool | Description |\n|------|-------------|\n| `Add` | Add a category to a space - Adds a category the description of a given {@link Space} identified by spaceKey.  Example request URI to add space category 'testCategory' to space with space key TEST:  `https://example.com/confluence/rest/api/space/TEST/category/testCategory` |\n| `AddContentWatcher` | Add content watcher - Create a new watcher for the given user and content id. User is optional. If not specified, currently logged-in user will be used. Otherwise, it can be specified by either user key or username. When a user is specified and is different from the logged-in user, the logged-in user needs to be a Confluence administrator.    Example request URI(s):  `http://example.com/confluence/rest/api/user/watch/content/131213` `http://example.com/confluence/rest/api/user/watch/content/131213?username=jblogs` `http://example.com/confluence/rest/api/user/watch/content/131213?key=ff8080815a58e24c015a58e263710000` |\n| `AddLabels` | Add Labels - Adds a list of labels to the specified content. The body is the json representation of the list. |\n| `AddSpaceWatch` | Add space watcher - Create a new watcher for the given user and space key. User is optional. If not specified, currently logged-in user will be used. Otherwise, it can be specified by either user key or username. When a user is specified and is different from the logged-in user, the logged-in user needs to be a Confluence administrator.    Example request URI(s):  `http://example.com/confluence/rest/api/user/watch/space/SPACEKEY` `http://example.com/confluence/rest/api/user/watch/space/SPACEKEY?username=jblogs` `http://example.com/confluence/rest/api/user/watch/space/SPACEKEY?key=ff8080815a58e24c015a58e263710000` `http://example.com/confluence/rest/api/user/watch/space/SPACEKEY?contentType=blogpost` |\n| `Archive` | Archive space - Archive the given Space identified by spaceKey. This method is idempotent i.e., if the Space is already archived then no action will be taken. |\n| `ByOperation` | Get all restrictions by Operation - Returns info about all restrictions by operation. |\n| `CancelAllQueuedJobs` | Cancel all queued jobs - Cancels all queued jobs. Does not affect jobs that are being processed at the moment. |\n| `CancelJob` | Cancel job - Cancels the job. If the job is already cancelled or failed, the method will do nothing. |\n| `ChangePassword` | Change password - Change the password for the user identified by the username.   **Validation rules** :   - The new password should not be null or blank.    |\n| `ChangePassword1` | Change password - Change the password for the current user.    Validation Rules:   - New password supplied cannot be null or blank  Example request URI(s):  `http://example.com/confluence/rest/api/user/current/password` |\n| `Children` | Get children of content - Returns a map of the direct children of a piece of Content. Content can have multiple types of children. For example, a Page can have children that are also Pages, but it can also have Comments and Attachments.   The types of the children returned is specified by the `expand` query parameter in the request. This parameter can include expands for multiple child types. If no types are included in the `expand` parameter, the map returned will just list the child types that are available to be expanded for the content referenced by the `id` path parameter. |\n| `ChildrenOfType` | Get children of content by type - Returns the direct children of a piece of Content, limited to a single child type.The types of the children returned is specified by the \"type\" path parameter in the request. |\n| `CommentsOfContent` | Get comments of content - Returns the comments of a piece of Content. Example request URI(s):   - `http://example.com/confluence/rest/api/content/1234/child/comment` - `http://example.com/confluence/rest/api/content/1234/child/comment?expand=body.view` - `http://example.com/confluence/rest/api/content/1234/child/comment?start=20&limit=10` - `http://example.com/confluence/rest/api/content/1234/child/comment?location=footer&location=inline&location=resolved` - `http://example.com/confluence/rest/api/content/1234/child/comment?expand=extensions.inlineProperties,extensions.resolution` |\n| `Contents` | Get contents in space - Returns the content in this given space.   Example request URI:   `http://example.com/confluence/rest/api/space/TEST/content?expand=history` |\n| `ContentsWithType` | Get trash contents of space - Returns the trash contents in this given space.   Example request URI:   `http://example.com/confluence/rest/api/space/TEST/trash?limit=100&cursor=content:false:612345` |\n| … | *161 more tools not shown* |\n\n## Virtual Tools\n\nCompose native tools via a declarative pipeline DSL:\n\n```yaml\nvirtual_tools:\n  - name: MyVirtualTool\n    description: Chain multiple native tools together\n    input_schema:\n      type: object\n      properties:\n        appId: { type: string }\n      required: [appId]\n    pipeline:\n      - id: getApp\n        kind: call\n        spec: { tool: GetApplication, args: { applicationId: \"$input.appId\" } }\n      - id: appName\n        kind: jq\n        spec: { from: \"$getApp\", expr: .name }\n      - id: done\n        kind: return\n        spec: { from: \"$appName\" }\n```\n\nPipeline kinds: `call`, `jq`, `foreach`, `emit`, `return`.\n\n## Agent Integration\n\n### OpenCode\n\n- `~/.config/opencode/opencode.json`:\n\n```json\n{\n  \"mcp\": {\n    \"confluence-mcp\": {\n      \"type\": \"local\",\n      \"command\": [\"bash\", \"-c\", \"/path/to/confluence-mcp\"],\n      \"args\": [\"--transport\", \"stdio\"],\n      \"env\": {\n        \"MCP__UPSTREAM__DEFAULT__ENDPOINT\": \"https://api.example.com\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\": \"your-token\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN_FILE\": \"/path/to/fallback/.credentials\"\n      },\n      \"enabled\": true\n    }\n  }\n}\n```\n\n### Claude Code\n\n- `~/.claude.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"confluence-mcp\": {\n      \"command\": \"/path/to/confluence-mcp\",\n      \"args\": [\"--transport\", \"stdio\"],\n      \"env\": {\n        \"MCP__UPSTREAM__DEFAULT__ENDPOINT\": \"https://api.example.com\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\": \"your-token\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN_FILE\": \"/path/to/fallback/.credentials\"\n      }\n    }\n  }\n}\n```\n\n### Codex CLI\n\n- `~/.codex/config.toml`:\n\n```toml\n[mcp_servers.confluence-mcp]\nurl = \"http://localhost:8080/mcp\"\nweb_token_env_var = \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\"\n```\n\n### Cursor\n\n- `~/.cursor/mcp.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"confluence-mcp\": {\n      \"command\": \"/path/to/confluence-mcp\",\n      \"args\": [\"--transport\", \"stdio\"],\n      \"env\": {\n        \"MCP__UPSTREAM__DEFAULT__ENDPOINT\": \"https://api.example.com\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\": \"your-token\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN_FILE\": \"/path/to/fallback/.credentials\"\n      }\n    }\n  }\n}\n```\n\n### OpenCode (Remote)\n\n- `~/.config/opencode/opencode.json`:\n\n```json\n{\n  \"mcp\": {\n    \"confluence-mcp\": {\n      \"type\": \"remote\",\n      \"url\": \"http://localhost:8080/mcp\",\n      \"env\": {\n        \"MCP__UPSTREAM__DEFAULT__ENDPOINT\": \"https://api.example.com\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\": \"your-token\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN_FILE\": \"/path/to/fallback/.credentials\"\n      }\n    }\n  }\n}\n```\n\n### Claude Code (Remote)\n\n- `~/.claude.json` (User MCPs):\n\n```json\n{\n  \"mcpServers\": {\n    \"confluence-mcp\": {\n      \"url\": \"http://localhost:8080/mcp\",\n      \"env\": {\n        \"MCP__UPSTREAM__DEFAULT__ENDPOINT\": \"https://api.example.com\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\": \"your-token\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN_FILE\": \"/path/to/fallback/.credentials\"\n      }\n    }\n  }\n}\n```\n\n### Codex CLI (Remote)\n\n- `~/.codex/config.toml`:\n\n```toml\n[mcp_servers.confluence-mcp]\nurl = \"http://localhost:8080/mcp\"\nweb_token_env_var = \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\"\n```\n\n### Cursor (Remote)\n\n- `~/.cursor/mcp.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"confluence-mcp\": {\n      \"url\": \"http://localhost:8080/mcp\"\n    }\n  }\n}\n```\n\n## Deployment — Docker\n\n### Build\n\n```sh\nmake build-image\n```\n\nOr manually:\n\n```sh\ndocker build -t ghcr.io/<YOUR_ORG>/confluence-mcp:latest -f deploy/docker/Dockerfile .\ndocker push ghcr.io/<YOUR_ORG>/confluence-mcp:latest\n```\n\n### Run\n\nPull the pre-built image from GitHub Container Registry:\n\n```sh\ndocker pull ghcr.io/<YOUR_ORG>/confluence-mcp:latest\n```\n\nFirst generate a default config, then mount it when running:\n\n```sh\n  docker run --rm ghcr.io/<YOUR_ORG>/confluence-mcp:latest --print-default-config > ~/.confluence-mcp/config.yaml\n```\n\n- **Static web token**\n\n```sh\n  docker run -d --name confluence-mcp \\\n    -p 8080:8080 -p 9991:9991 \\\n    -e MCP__UPSTREAM__DEFAULT__ENDPOINT=\"https://api.example.com\" \\\n    -e MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN=\"YOUR_WEB_TOKEN\" \\\n    -v ~/.confluence-mcp:/home/mcp/.confluence-mcp \\\n    ghcr.io/<YOUR_ORG>/confluence-mcp:latest \\\n    --transport http --port 8080\n  ```\n\n- **OIDC upstream auth**\n\n```sh\n  docker run -d --name confluence-mcp \\\n    -p 8080:8080 -p 9991:9991 \\\n    -e MCP__UPSTREAM__DEFAULT__ENDPOINT=\"https://api.example.com\" \\\n    -e MCP__UPSTREAM__DEFAULT__AUTH__OIDC__ENABLED=true \\\n    -e MCP__UPSTREAM__DEFAULT__AUTH__OIDC__ISSUER=\"https://idp.example.com/realms/myrealm\" \\\n    -e MCP__UPSTREAM__DEFAULT__AUTH__OIDC__CLIENT_ID=\"my-client\" \\\n    -e MCP__UPSTREAM__DEFAULT__AUTH__OIDC__CLIENT_SECRET=\"YOUR_CLIENT_SECRET\" \\\n    -v ~/.confluence-mcp:/home/mcp/.confluence-mcp \\\n    ghcr.io/<YOUR_ORG>/confluence-mcp:latest \\\n    --transport http --port 8080\n  ```\n\n### Test with mcpclient.sh\n\nAfter the container starts, use the bundled `mcpclient.sh` to verify.\n\n> **Note:** `mcpclient.sh` only supports **upstream static** token auth. If the server requires\n> **server OIDC** authentication, use a real AI-agent MCP client instead.\n\n```sh\n# Point to the mapped host port (include /mcp path)\nexport MCP_SERVER_ENDPOINT=http://localhost:18080/mcp\n# Call any tool (example: Add)\n./mcpclient.sh call Add --param value\n# List all available tools\n./mcpclient.sh list-tools\n```\n\n> **Tip:** Map the host config directory for persistent configuration:\n> `-v ~/.confluence-mcp:/home/mcp/.confluence-mcp`\n\n## Deployment — Kubernetes (Helm)\n\n\nFirst generate a default config, then mount it when running:\n\n```sh\n  docker run --rm ghcr.io/<YOUR_ORG>/confluence-mcp:latest --print-default-config > ~/.confluence-mcp/config.yaml\n```\n\n- **Static web token**\n\n```sh\n  helm upgrade -i confluence-mcp deploy/helm \\\n    --set image.repository=ghcr.io/<YOUR_ORG>/confluence-mcp \\\n    --set image.tag=latest \\\n    --set secret.static.create=true \\\n    --set secret.static.webToken=\"YOUR_WEB_TOKEN\" \\\n    --set config.upstream.default.endpoint=\"https://api.example.com\"\n  ```\n\n- **OIDC authentication**\n\n```sh\n  helm upgrade -i confluence-mcp deploy/helm \\\n    --set image.repository=ghcr.io/<YOUR_ORG>/confluence-mcp \\\n    --set image.tag=latest \\\n    --set secret.static.create=true \\\n    --set secret.static.oidcClientSecret=\"YOUR_OIDC_CLIENT_SECRET\" \\\n    --set config.upstream.default.auth.oidc.enabled=true \\\n    --set config.upstream.default.auth.oidc.issuer=\"https://idp.example.com\" \\\n    --set config.upstream.default.auth.oidc.client_id=\"my-client\" \\\n    --set config.upstream.default.endpoint=\"https://api.example.com\"\n  ```\n\nSee `deploy/helm/values.yaml` for all configurable parameters.\n\n## Contributing\n\nWe welcome contributions! Here's how you can help:\n\n1. **Fork** the repository and create a feature branch\n2. **Make your changes** — add features, fix bugs, or improve documentation\n3. **Add tests** — every new feature or bug fix should include unit tests\n4. **Run the test suite** — `make test` must pass with no regressions\n5. **Submit a Pull Request** — describe what you changed and why\n\n### Development Setup\n\n```sh\ngit clone https://github.com/<YOUR_ORG>/confluence-mcp.git\ncd confluence-mcp\nmake build\nmake test-ut\n```\n\n### Code Style\n\n- Follow standard Go conventions (`go fmt`, `go vet`)\n- Keep functions small and focused\n- Write clear commit messages\n\nPlease read [CONTRIBUTING.md](CONTRIBUTING.md) for detailed guidelines and our [Code of Conduct](CODE_OF_CONDUCT.md).\n\n## License\n\nThis generated MCP server project is licensed under the Apache License 2.0 —\nsee the [LICENSE](LICENSE) file for details.\n\nThe Apache-2.0 license is intentionally permissive for generated server\noutput: commercial use, internal enterprise deployment, modification,\nredistribution, and proprietary integration are allowed subject to the Apache\nLicense 2.0 terms. This generated project is not subject to mcpfather's AGPL\nlicense obligations solely because it was generated by mcpfather.\n\n## Contact\n\nFor questions, suggestions, or support:\n\n- **GitHub Issues**: [Create an issue](../../issues)\n- **Discussions**: [Start a discussion](../../discussions)\n- **Email**: <jameswong1376@gmail.com>\n\n## Acknowledgments\n\nThis MCP server was generated by [MCPFather](https://github.com/flowgent-labs/mcpfather), an enterprise-grade OpenAPI-to-MCP code generator.\n\nBuilt with these excellent open-source projects:\n\n- [mcp-go](https://github.com/mark3labs/mcp-go) — Go SDK for the Model Context Protocol\n- [OpenTelemetry](https://opentelemetry.io/) — observability framework for metrics and tracing\n- [Prometheus](https://prometheus.io/) — metrics collection and alerting\n- [Viper](https://github.com/spf13/viper) — Go configuration management\n- [go-jq](https://github.com/itchyny/gojq) — Pure Go implementation of jq\n- [Keycloak](https://www.keycloak.org/) — Open Source Identity and Access Management\n"}