Basecamp2 Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Basecamp2 Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP (Model Context Protocol) server that wraps the Basecamp 2 REST API, enabling Claude to create and manage todos through natural language.
git clone <repo-url>
cd Basecamp2_mcp
npm install.env file (or set environment variables directly):cp .env.example .envFill in the 4 required variables:
| Variable | Description |
|---|---|
BASECAMP_ACCOUNT_ID | Your Basecamp account ID (the number in your Basecamp URL) |
BASECAMP_USERNAME | Your Basecamp login email |
BASECAMP_PASSWORD | Your Basecamp login password |
BASECAMP_USER_AGENT | A User-Agent string identifying your app (e.g. MyApp ([email protected])) |
Basecamp 2 requires a User-Agent with contact info per their API policy.
Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"basecamp2": {
"command": "node",
"args": ["/absolute/path/to/Basecamp2_mcp/src/index.js"],
"env": {
"BASECAMP_ACCOUNT_ID": "your-account-id",
"BASECAMP_USERNAME": "your-email",
"BASECAMP_PASSWORD": "your-password",
"BASECAMP_USER_AGENT": "YourApp ([email protected])"
}
}
}
}Add to your Claude Code settings (.claude/settings.json or via claude mcp add):
claude mcp add basecamp2 -- node /absolute/path/to/Basecamp2_mcp/src/index.jsSet the environment variables in your shell or .env file before starting Claude Code.
| Tool | Description |
|---|---|
list_projects | List all active projects |
get_project | Get details of a specific project |
list_todolists | List all todo lists in a project |
get_todolist | Get a todo list with its todos |
create_todolist | Create a new todo list |
create_todo | Create a todo item (with optional assignee, due date, attachments) |
update_todo | Update a todo (content, assignee, due date, completion, position) |
get_todo | Get a todo item including its comments |
create_comment | Comment on a todo or todo list (with optional attachments) |
upload_attachment | Upload a file and get an attachment token + name |
list_people | List all people visible to you |
get_project_accesses | List people with access to a project |
list_events | Account-wide activity feed — who did what, when, in which project |
list_person_events | One person's activity — what they commented on, changed, completed or created |
"Missing required environment variables" — Ensure all 4 env vars are set. Check .env.example for the list.
401 Unauthorized — Verify your username and password. Basecamp 2 uses HTTP Basic Auth with your login credentials.
403 Forbidden — Your User-Agent may be missing or not include contact info.
429 Too Many Requests — The server automatically retries once after the Retry-After delay. If you still hit rate limits, slow down your requests.
Connection errors — Confirm your BASECAMP_ACCOUNT_ID is correct and that you can access https://basecamp.com/<id> in a browser.
list_events and list_person_events wrap Basecamp 2's events.json endpoints. They exist for answering "what has this person been up to" without asking them — the per-person route is the one BC2 serves best.
Both return a normalized row by default:
{ "id": 2814733369,
"created_at": "2026-09-16T04:07:22.000-07:00",
"action": "commented on",
"summary": "commented on TIME QUOTE: CV2 - Envisia Learning - Adding results from another as...",
"target": "TIME QUOTE: CV2 - Envisia Learning - Adding results from another as...",
"excerpt": "The import file would be around 5-6 hours The report scoring would be around 4 hours",
"creator": null,
"project": { "id": 17514231, "name": "@Time Quotes" },
"eventable": { "type": "Todo", "id": 519880692 },
"url": "https://basecamp.com/1757845/projects/17514231/todos/519880692#comment_978900828" }Two things worth knowing:
`changed a to-do from '<img alt="x" src="https://bcx-production-assets-cdn…'. Both tools strip tags and entities; excerpt prefers Basecamp's already-plain raw_excerpt. Pass raw: true` for the untouched payload.
by the path. Attribute from the person_id you asked for, never from this field. It IS populated on list_events.
Always pass since (ISO8601); without it you get only the most recent page. all_pages: true paginates the whole window, which can be slow over a long one.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.