Current situation
Currently, when users connect local or external MCP (Model Context Protocol) servers to Atlassian Cloud products (such as Jira and Confluence) using personal API tokens, this process occurs without notifying organisation administrators and does not require admin approval. This creates a significant governance and security gap, as administrators lack visibility into which external AI tools are interfacing with their corporate data and can't prevent unauthorised "shadow AI" integrations.

Suggested improvement
Implement a mandatory notification and approval workflow for all external MCP server connections. Specifically:

1. Admin Notification: Automatically notify organisation administrators whenever a user attempts to authorise an external MCP server using an Atlassian account identity or API token.

1. Approval Gate: Provide a setting in Atlassian Administration to require explicit admin approval before an external MCP connection is finalised, similar to the "App approval" workflow for Marketplace apps.

1. Centralised Governance: Allow administrators to view, manage, and revoke all active MCP-based connections from a single dashboard, regardless of whether they are using the Atlassian-hosted server or a local/third-party setup.

1. Audit Visibility: Ensure that the "installation" or connection event of an external MCP server is clearly recorded in the Atlassian Audit Logs, including details about the user, the client type, and the permissions granted.