.roo — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .roo (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This is the simplest task management system I could create. I need this for experimentation in another research project exploring agentic team workflows, collaboration, etc. Probably the biggest gaps are that there is no auth or the concept of users. Tasks are assigned to arbitrary names and the name becomes the queue of work for the name. This project was written entirely using AI (specifically RooCode and Anthropic). From start to finish the initial project took just a few hours and cost about $15.50 in tokens.
A minimal task management system designed for LLM agent collaboration. TinyTask provides both:
The command-line interface provides direct access to all TinyTask features:
# Install globally
cd tinytask-cli
npm install
npm run build
npm link
# Or use standalone executables (no Node.js required)
npm run package # Creates binaries in dist/binaries/
# Basic usage
tinytask task create "My first task" --assigned-to me
tinytask task list
tinytask task get 1
# Subtask management
tinytask subtask create 1 "Subtask title" --assigned-to alice
tinytask subtask list 1
# Queue management
tinytask queue list
tinytask queue stats dev
tinytask queue tasks dev --status idleSee tinytask-cli/README.md for complete CLI documentation.
The easiest way to run TinyTask MCP server is using Docker:
Note: Docker Compose v2+ is required. Theversionfield has been removed fromdocker-compose.ymlfor v2+ compatibility. If you're using Docker Compose v1.x, please upgrade to v2.0 or later.
# Start the server
docker-compose up -d
# View logs
docker-compose logs -f
# Stop the server
docker-compose downThe server will be available at http://localhost:3000
# Install dependencies
npm install
# Build the project
npm run build
# Run Streamable HTTP (default HTTP transport)
npm run start:http
# Run Streamable HTTP with stdio sidecar
npm run start:both
# Legacy SSE (HTTP) transport
npm run start:http:sse
# Legacy SSE with stdio sidecar
npm run start:both:sse
# Direct stdio mode (no HTTP server)
npm run start:stdio
# Development mode with auto-reload
npm run devNeed guidance on which option to pick? See the HTTP Transport Selection section and the dedicated docs/product/streamable-http-migration-guide.md.
For local development with MCP clients like Claude Desktop:
{
"mcpServers": {
"tinytask": {
"command": "node",
"args": ["/path/to/tinytask/build/index.js"],
"env": {
"TINYTASK_MODE": "stdio",
"TINYTASK_DB_PATH": "/path/to/data/tinytask.db"
}
}
}
}For HTTP-based access using the Streamable HTTP transport (recommended):
{
"mcpServers": {
"tinytask": {
"url": "http://localhost:3000/mcp"
}
}
}If you explicitly enable SSE via TINYTASK_ENABLE_SSE=true, the endpoint is the same, but you may want a different client profile to track the legacy transport:
{
"mcpServers": {
"tinytask-sse": {
"url": "http://localhost:3000/mcp",
"headers": {
"X-Tinytask-Transport": "sse"
}
}
}
}SSE continues to work for backward compatibility but will be removed in a future major release. Plan migrations with the docs/product/streamable-http-migration-guide.md.
TINYTASK_MODE: Server mode (stdio, http, or both) - default: bothTINYTASK_ENABLE_SSE: Force legacy SSE transport when true (default: false)TINYTASK_PORT: HTTP server port - default: 3000TINYTASK_HOST: HTTP server host - default: 0.0.0.0TINYTASK_DB_PATH: Path to SQLite database file - default: ./data/tinytask.dbTINYTASK_LOG_LEVEL: Logging level - default: infoTinyTask supports multiple logging levels for debugging and troubleshooting agent interactions.
#### Docker (Recommended)
Edit docker-compose.yml:
environment:
TINYTASK_LOG_LEVEL: trace # Change from 'info' to enable forensic loggingThen restart:
docker-compose down
docker-compose up -d
docker-compose logs -f tinytask # Watch logs in real-time#### Local Development
# Set for single run
TINYTASK_LOG_LEVEL=debug npm run dev
# Or export for session
export TINYTASK_LOG_LEVEL=trace
npm run dev#### MCP Client (stdio mode)
{
"mcpServers": {
"tinytask": {
"command": "node",
"args": ["/path/to/tinytask/build/index.js"],
"env": {
"TINYTASK_MODE": "stdio",
"TINYTASK_LOG_LEVEL": "debug"
}
}
}
}If an agent (like goose) is having issues creating tasks or performing operations:
TINYTASK_LOG_LEVEL=traceTINYTASK_LOG_LEVEL=infoTinyTask exposes the following tools for LLM agents via MCP:
#### Task Tools
create_task - Create a new task (supports parent_task_id and queue_name)update_task - Update an existing task (can change parent and queue)get_task - Retrieve a task by IDdelete_task - Delete a taskarchive_task - Archive a completed tasklist_tasks - List all tasks (filter by queue, parent, status, etc.)get_my_queue - Get tasks assigned to a specific agent⚡ High-Efficiency Tools: These tools combine multiple operations into single atomic transactions, reducing token consumption by 40-60% for common workflows.
#### Subtask Tools
create_subtask - Create a subtask under a parent taskget_subtasks - Get all subtasks for a parent task (immediate or recursive)get_task_with_subtasks - Get a task with its complete subtask hierarchymove_subtask - Move a subtask to a different parent or make it top-level#### Queue Tools
list_queues - List all queue names currently in useget_queue_stats - Get statistics for a specific queueadd_task_to_queue - Add an existing task to a queueremove_task_from_queue - Remove a task from its queuemove_task_to_queue - Move a task from one queue to anotherget_queue_tasks - Get all tasks in a queue with optional filtersclear_queue - Remove all tasks from a queue#### Comment Tools
add_comment - Add a comment to a taskupdate_comment - Update a commentdelete_comment - Delete a commentlist_comments - List all comments for a task#### Link Tools
add_link - Add a link/artifact to a taskupdate_link - Update a linkdelete_link - Delete a linklist_links - List all links for a taskTinyTask provides the following resources via MCP:
#### Task Resources
task://{id} - Full task details with comments and linkstask://{id}/comments - All comments for a specific tasktask://{id}/links - All links/artifacts for a specific tasktask://hierarchy/{id} - Task with its complete subtask hierarchy#### Queue Resources
queue://{agent_name} - All open tasks assigned to a specific agentqueue://{agent_name}/summary - Summary statistics for an agent's queuequeue://list - List all queues with basic statisticsqueue://stats/{queue_name} - Detailed statistics for a specific queuequeue://tasks/{queue_name} - All tasks in a specific queue#### Task List Resources
tasks://active - All active (non-archived) taskstasks://archived - All archived tasksFor detailed API documentation, see API Documentation
TinyTask now uses Streamable HTTP as the default HTTP transport. The legacy SSE transport can still be enabled via configuration for environments that rely on it.
| Scenario | TINYTASK_MODE | TINYTASK_ENABLE_SSE | Result |
|---|---|---|---|
| Default HTTP deployment | http | _unset_ / false | Streamable HTTP (unified /mcp endpoint) |
| Mixed stdio + HTTP | both | _unset_ / false | stdio + Streamable HTTP |
| Legacy SSE (HTTP only) | http | true | SSE (deprecated) |
| Legacy SSE + stdio | both | true | stdio + SSE |
When TINYTASK_MODE=stdio, no HTTP transport is started regardless of TINYTASK_ENABLE_SSE.
The routing logic lives in src/server/http.ts. It delegates to the Streamable HTTP implementation in src/server/streamable-http.ts by default and falls back to the SSE implementation in src/server/sse.ts when the legacy flag is enabled.
Refer to the docs/product/streamable-http-migration-guide.md for detailed migration steps and troubleshooting tips.
TinyTask follows a layered architecture:
For detailed architecture documentation, see Architecture Documentation
// Create epic in product queue
const epic = create_task({
title: "Add dark mode toggle",
description: "Users want dark mode option",
queue_name: "product",
assigned_to: "product-agent",
priority: 10
})
// Break down into subtasks for different teams
create_subtask({
parent_task_id: epic.id,
title: "Design dark mode UI/UX",
queue_name: "product",
assigned_to: "designer-agent"
})
create_subtask({
parent_task_id: epic.id,
title: "Implement dark mode toggle",
queue_name: "dev",
assigned_to: "code-agent"
})
create_subtask({
parent_task_id: epic.id,
title: "Test dark mode across browsers",
queue_name: "qa"
})// 🚀 Claim highest priority task from dev queue
const task = signup_for_task({ agent_name: "code-agent" })
// Add implementation link
add_link({
task_id: task.id,
url: "/src/components/DarkModeToggle.tsx",
description: "Implementation file"
})
// 🚀 Transfer to QA with handoff comment
move_task({
task_id: task.id,
current_agent: "code-agent",
new_agent: "qa-agent",
comment: "Implementation complete. Toggle component ready for testing."
})// Get unassigned tasks in QA queue
const queueTasks = get_queue_tasks({
queue_name: "qa",
status: "idle"
})
// Claim and test
update_task({
id: queueTasks.tasks[0].id,
assigned_to: "qa-agent",
status: "working"
})
// Complete testing
add_comment({ task_id: queueTasks.tasks[0].id, content: "All tests passed" })
update_task({ id: queueTasks.tasks[0].id, status: "complete" })// Get epic with all subtasks
const epicTree = get_task_with_subtasks({
task_id: epic.id,
recursive: true
})
// Calculate completion
const subtasks = get_subtasks({ parent_task_id: epic.id })
const completed = subtasks.filter(t => t.status === "complete").length
console.log(`Progress: ${completed}/${subtasks.length} subtasks complete`)// List all active queues with statistics
const queues = list_queues()
// Get detailed stats for dev queue
const devStats = get_queue_stats({ queue_name: "dev" })
// Get all idle tasks in a queue
const devTasks = get_queue_tasks({
queue_name: "dev",
status: "idle"
})
// Move task between queues
move_task_to_queue({
task_id: 42,
new_queue_name: "qa"
})# Create epic with subtasks
tinytask task create "Add dark mode" --queue product -p 10
tinytask subtask create 1 "Design UI" --queue product
tinytask subtask create 1 "Implement" --queue dev
tinytask subtask create 1 "Test" --queue qa
# Check queue status
tinytask queue list
tinytask queue stats dev
tinytask queue tasks dev --status idle
# Claim and work on task
tinytask task update 2 --assigned-to me --status working
tinytask task get 2
# Track progress
tinytask subtask list 1 --treeFor more examples, see Example Workflows
# Run all tests
npm test
# Run tests in watch mode
npm run test:watch
# Generate coverage report
npm run test:coverage# Install dependencies
npm install
# Run in development mode
npm run dev
# Build the project
npm run build
# Format code
npm run format
# Lint code
npm run lint
# Clean build artifacts
npm run cleanSee Deployment Guide for production deployment instructions, including Streamable HTTP vs SSE configuration details.
See Troubleshooting Guide for common issues and transport troubleshooting steps.
ISC
For issues and questions, please file an issue on GitHub.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.