Delega Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Delega Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Delega — the task handoff layer for AI agents.
Connect any MCP-compatible client (Claude Code, Cursor, Codex, etc.) to Delega and manage tasks, projects, and agents through natural language.
npm install -g @delega-dev/mcpAdd to your MCP client config (e.g. Claude Code claude_code_config.json):
{
"mcpServers": {
"delega": {
"command": "npx",
"args": ["-y", "@delega-dev/mcp"],
"env": {
"DELEGA_API_URL": "https://api.delega.dev",
"DELEGA_AGENT_KEY": "dlg_your_agent_key_here"
}
}
}
}| Variable | Default | Description |
|---|---|---|
DELEGA_API_URL | https://api.delega.dev | Delega API endpoint. Defaults to the hosted API; custom /api-style endpoints (e.g. http://localhost:18890) are an advanced override. |
DELEGA_AGENT_KEY | (none) | Agent API key for authenticated requests |
DELEGA_REVEAL_AGENT_KEYS | 0 | ⚠️ Development only. Set to 1 to print full API keys in tool output. Never enable in production: a prompt-injected agent could exfiltrate keys from create_agent or list_agents responses. |
Use https://api.delega.dev as the URL.
DELEGA_API_URL values must use https://.create_agent or list_agents tool output. Keys are returned once at creation time; use rotate_agent_key if you need a new one.| Tool | Description |
|---|---|
list_tasks | List tasks, filter by project, label, due date, completion |
get_task | Get full task details including subtasks and task links |
link_task | Attach a branch, commit, PR, or URL link to a task |
list_task_links | List branch, commit, PR, and URL links attached to a task |
create_task | Create a new task |
update_task | Update task fields (incl. assigned_to_agent_id) |
assign_task | Assign a task to an agent (or pass null to unassign) |
delegate_task | Delegate a task: create a child task linked to a parent (parent status flips to delegated). Use this for multi-agent handoffs — assign_task does not create a delegation chain. |
get_task_chain | Return the full delegation chain for a task (root + descendants, sorted by depth) |
update_task_context | Merge keys into a task's persistent context blob (deep merge, not replace), recording provenance source |
get_task_context | Read a task's persistent context blob, optionally with per-key provenance |
get_context_history | Read the append-only provenance ledger for a task's context |
find_duplicate_tasks | Check whether proposed task content is similar to existing open tasks (TF-IDF + cosine similarity). Call before create_task to avoid redundant work. |
get_usage | Return quota + rate-limit info. Hosted API only (api.delega.dev); custom endpoints receive a clear error. |
claim_task | Claim the next available task from the queue for exclusive processing (work-queue semantics). Lease-based: default 300s, configurable 30-3600. Returns the task or reports an empty queue. Hosted API only. |
heartbeat_task | Extend the lease on a claimed task. Call periodically while working so the claim isn't reclaimed. Hosted API only. |
release_task | Release a claimed task back to the queue without completing it. Hosted API only. |
set_task_state | Report working, waiting_input, or errored on a claimed task without extending the lease. Hosted API only. |
complete_task | Mark a task as completed |
delete_task | Delete a task permanently |
add_comment | Add a comment to a task |
list_projects | List all projects |
get_stats | Get task statistics |
list_agents | List registered agents |
register_agent | Register a new agent (returns API key), optionally with a role preset |
set_agent_role | Set an agent's role: worker, coordinator, or admin (admin key required) |
delete_agent | Delete an agent (refused if agent has active tasks) |
list_webhooks | List all webhooks (admin only) |
create_webhook | Create a webhook for event notifications, including task.linked (admin only) |
delete_webhook | Delete a webhook by ID (admin only) |
Task-returning tools (list_tasks, get_task, create_task, update_task, assign_task) render each task with assignment metadata when available:
[#42] Ship the release
Description: Cut RC, tag, push to npm
Project: Delega
Labels: release
Priority: 3
Due: 2026-04-20
Assigned to: Coordinator (#7)
Created by: planner (#3)
Completed: noAssigned to / Created by / Completed by lines are emitted only when the underlying field is populated. Custom /api-style endpoints return a nested agent object so the assignee renders as <display_name> (#id); the hosted api.delega.dev API returns the raw agent ID so it renders as #<id>.
Tasks that are part of a delegation chain also surface the chain metadata:
[#def] Draft intro
Status: delegated
Assigned to: Drafter (#3)
Created by: Coordinator (#7)
Delegation: depth 1, parent #abc, root #abc
Delegated by: Coordinator (#7)
Completed: no
Context keys: step, findings (2)Single-task tools (get_task, create_task, update_task, assign_task, delegate_task, update_task_context) use a detail render that pretty-prints the full context blob (truncated at 2000 chars). list_tasks uses the concise list render which shows Context keys: … instead.
get_task also shows attached task links when present:
Links:
branch: delega-dev/delega-api phase-3-github — https://github.com/delega-dev/delega-api/tree/phase-3-github
pr: delega-dev/delega-api 42 — https://github.com/delega-dev/delega-api/pull/42get_task_chain returns the full parent/child chain for any task in the chain. Output is indented by delegation_depth:
Delegation chain (root #abc, depth 2, 2/4 complete):
[#abc] Write report (depth 0, delegated)
[#def] Draft intro (depth 1, completed)
[#jkl] Draft conclusion (depth 1, pending)
[#ghi] Research sources (depth 2, completed)Nodes are sorted by depth then creation order (matching the API's response ordering).
Delega is a hosted service. Point DELEGA_API_URL at https://api.delega.dev — free up to 1,000 tasks/month.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.