
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
Docs: https://castor.moosejudge.com/docs
A secure MCP server that bridges Atlassian Confluence Data Center (9.2 and 10.2, the two current LTS lines) with AI agents like Claude.
Castor is an independent, community-built tool. It is not affiliated with, endorsed by, or sponsored by Atlassian. Confluence® is a registered trademark of Atlassian Pty Ltd.
As Atlassian sunsets Data Center support, this server ensures organizations can still leverage AI
safely within their on-premise Confluence infrastructure. It follows open standards, the MCP
specification, and a "secure by default" model — see alces-mcp (the sibling Jira DC server this
project mirrors) for the shared design lineage.
get_api_references for
querying the generated API catalog — docs/api-catalog.md tracks the full set of cataloged
Confluence DC operations and which are implemented.CONFLUENCE_USER_TOKEN for standard operations,
CONFLUENCE_ADMIN_TOKEN for elevated ones (e.g. admin_get_space_permissions) — admin tools are
invisible to the agent without the admin token configured.skill://spaces-pages.Just want to talk to your Confluence DC instance through Claude Desktop, without cloning or building anything? Install the pre-built bundle:
castor-mcp-<version>.mcpb from the
GitLab Releases page.Once connected, see docs/user/ for what you can do and how to ask for it.
If you're integrating Castor into a coding agent instead of Claude Desktop, it's also published on
npm as castor-mcp — point your agent's MCP config at
command: "npx", args: ["-y", "castor-mcp"] instead of cloning or building anything. See
Setup to develop below only if you're contributing or need to run from an
unreleased commit.
npm install
.env.example to .env and fill in CONFLUENCE_URL and CONFLUENCE_USER_TOKEN
(optionally CONFLUENCE_ADMIN_TOKEN).npm run build
npm test
There is no running local Confluence instance yet — docker-compose.yml defines one (see
docs/developer/testing-environment.md), but it requires a Confluence developer license this
project does not currently have, and has never been started.
docs/user/ — task-oriented guide to what the agent can do.docs/developer/ — codebase notes for contributors.docs/api-catalog.md — generated reference of every cataloged Confluence DC operation and its
implementation status.docs/specs/, docs/plans/ — design specs and implementation plans.FAQs
Castor — MCP server for Atlassian Confluence Data Center
We found that castor-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.