Atlassian

Work Jira issues, Confluence pages and Bitbucket repos from inside the container, build Forge apps there, and let a coding agent do the same. The Atlassian feature bundles three official tools that share one Atlassian account:

• Rovo Dev (acli rovodev) is Atlassian’s AI coding agent.
• Teamwork Graph CLI (twg) is pre-authenticated access to Jira, Confluence and Bitbucket.
• Forge CLI (forge) builds and deploys Atlassian Forge apps.

Installing twg also writes its skills straight into the AI tools in the container, so an agent can act on your work items with no extra wiring. Authentication persists across rebuilds.

Note

acme is just a sample workbench name - it’s whatever you passed to monoceros init. Substitute your own throughout.

Added automatically with a Bitbucket repo

Bitbucket has no CLI of its own in Monoceros; twg fills that role, the way gh does for GitHub. So configuring a Bitbucket repo - with monoceros init --with-repos=… or monoceros add-repo - adds the Atlassian feature for you, with just twg turned on (no Rovo Dev, no Forge):

acme.yml

features:
  - ref: ghcr.io/getmonoceros/monoceros-features/atlassian:1
    options:
      rovodev: false
      twg: true
      forge: false
      instance: ${ATLASSIAN_INSTANCE}
      email: ${ATLASSIAN_EMAIL}
      apiToken: ${ATLASSIAN_API_TOKEN}
      rovodevToken: ${ATLASSIAN_ROVODEV_TOKEN}
      bitbucketToken: ${ATLASSIAN_BITBUCKET_TOKEN}

Add the full feature by hand when you also want Rovo Dev or Forge, or access to Jira and Confluence. See Authentication for which token each side needs.

Add it

At init, when you create the workbench:

monoceros init acme --with-features=atlassian

Or later, on an existing one:

monoceros add-feature acme atlassian

Variants

Add just one of the tools with a variant:

• atlassian installs all three tools.
• atlassian/twg installs only the Teamwork Graph CLI.
• atlassian/rovodev installs only Rovo Dev.
• atlassian/forge installs only the Forge CLI.

Adding a sub-tool to a workbench that already has Atlassian is additive: monoceros add-feature acme atlassian/forge turns Forge on and leaves the other tools as they were. To turn a sub-tool off, edit acme.yml and re-apply.

Remove it

monoceros remove-feature acme atlassian

Or delete the feature’s entry from acme.yml by hand and re-run monoceros apply acme - the yml is the source of truth.

Authentication

The tools authenticate from three separate Atlassian API tokens, because no single token covers all three sides today. Set only the sides you need:

To use	Set
Jira, Confluence, Assets, and Forge	ATLASSIAN_INSTANCE, ATLASSIAN_EMAIL, and ATLASSIAN_API_TOKEN
Rovo Dev (acli rovodev)	ATLASSIAN_EMAIL and ATLASSIAN_ROVODEV_TOKEN
Bitbucket (clone and twg’s Bitbucket work)	ATLASSIAN_EMAIL and ATLASSIAN_BITBUCKET_TOKEN

Rovo Dev has its own because acli only accepts a token scoped to the Rovo Dev app. Hand it the Teamwork Graph one and it answers authentication failed, with nothing about why. Since Monoceros 1.52 that no longer stops an apply: the login warns, names the token it wants, and the rest of the container comes up.

ATLASSIAN_INSTANCE is your site host, yoursite.atlassian.net. It is required for the Jira and Confluence side (the CLIs resolve your cloud ID from it) but not for Bitbucket on its own.

Create the tokens

For Jira, Confluence, Rovo and Forge, create a scoped API token with Teamwork Graph as the app. Fastest: this pre-filled link opens the token form with Teamwork Graph and every scope selected - create it as is and copy the value (Atlassian shows it once), or step Back to the start to rename or trim the scopes. Or set it up by hand:

1. Open Atlassian API tokens.
2. Click Create API token with scopes.
3. Give it a name and expiry, then continue.
4. Choose Teamwork Graph as the app, then continue.
5. Tick the scopes (select all for twg’s full toolset).
6. Create the token and copy the value - Atlassian shows it once.

For Rovo Dev, create a second scoped token with Rovo Dev as the app. Fastest: this pre-filled link opens the form with Rovo Dev and every scope selected. Its scopes cover reading Jira, Confluence, Compass and Bitbucket plus Rovo’s own search, which is what the agent works from. Put the value in ATLASSIAN_ROVODEV_TOKEN.

acli accepts nothing else. Give it the Teamwork Graph token and it answers authentication failed, without saying that the token is the wrong kind rather than the wrong value.

For Bitbucket, create a scoped token with Bitbucket as the app. Fastest: this pre-filled link opens the form with Bitbucket and every scope selected. Which scopes matter:

• Cloning and pushing needs read:repository:bitbucket and write:repository:bitbucket.
• twg’s full Bitbucket workflow - pull requests, pipelines, deployments and branches, the way gh covers GitHub - adds read:pullrequest:bitbucket and write:pullrequest:bitbucket, read:pipeline:bitbucket and write:pipeline:bitbucket, and read:workspace:bitbucket.

Git and repositories has the by-hand steps.

Three tokens by design: the Teamwork Graph app carries no repository scopes, so Bitbucket clone and push need their own Bitbucket-scoped token, and Rovo Dev only accepts a token scoped to its own app.

Where the tokens live

All three resolve from your env, never from the yml: put them in acme.env for one workbench, or in the global monoceros-config.env to share them across every workbench. A value in acme.env wins over the global one. The ${…} placeholders in the yml are filled from there at apply time.

Options

Option	Default	Description
rovodev	true	Install acli, with the Rovo Dev agent.
twg	true	Install twg, the Teamwork Graph CLI.
forge	true	Install the Forge CLI. Authenticates from email and apiToken, no forge login and no keychain.
instance	(empty)	Your Atlassian site host (yoursite.atlassian.net). Required for Jira and Confluence, not for Bitbucket.
email	(empty)	Your Atlassian account email.
apiToken	(empty)	Teamwork-Graph-scoped Atlassian API token for Jira, Confluence, Assets and Forge.
rovodevToken	(empty)	Rovo-Dev-scoped Atlassian API token. A different token from apiToken; acli accepts no other.
bitbucketToken	(empty)	Bitbucket-scoped Atlassian API token for clone and twg’s Bitbucket work. Scopes: see Authentication.

The feature block and its env keys, as monoceros init --with-features=atlassian generates them:

acme.yml

features:
  - ref: ghcr.io/getmonoceros/monoceros-features/atlassian:1
    options:
      rovodev: true
      twg: true
      forge: true
      instance: ${ATLASSIAN_INSTANCE}
      email: ${ATLASSIAN_EMAIL}
      apiToken: ${ATLASSIAN_API_TOKEN}
      rovodevToken: ${ATLASSIAN_ROVODEV_TOKEN}
      bitbucketToken: ${ATLASSIAN_BITBUCKET_TOKEN}

acme.env

ATLASSIAN_INSTANCE=
ATLASSIAN_EMAIL=
ATLASSIAN_API_TOKEN=
ATLASSIAN_ROVODEV_TOKEN=
ATLASSIAN_BITBUCKET_TOKEN=

Tip

Installing twg writes Teamwork Graph skills straight into the AI tools in the container (Claude Code, OpenCode), so an agent gets pre-authenticated access to Jira, Confluence and Bitbucket with no extra wiring.

What you get

The acli, twg and forge commands on PATH, ready in any monoceros shell or via monoceros run, and pre-authenticated from the tokens above. Because they are just commands on PATH, the AI coding tools in the container reach for them too - ask an agent about a Jira issue or a Confluence page and it shells out to twg on your behalf.